Privacy Notice

1. Introduction

This Privacy Notice explains how Cherry Street Holdings Ltd trading as Quick Mortgages (“we”, “us”, “our”) collects, uses, and protects your personal information. We act as the Data Controller, meaning we determine how and why your information is processed. We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all relevant FCA requirements including Consumer Duty.

2. What personal data we collect

We may collect the following personal information:

• Name, date of birth, contact details
• Address history
• Employment and income details
• Financial information for affordability assessment
• Details of credit commitments
• Family and lifestyle information relevant to advice
• Identification documents (for AML checks)
• Information provided during fact-finding and advice conversations

We do not carry out our own credit searches. Lenders may complete credit checks once an application is submitted.

3. How we collect personal data

We collect information:

• Directly from you
• From introducers (if applicable)
• Through affordability or mortgage sourcing systems
• From lenders once an application begins

4. Why we process your personal data (legal bases)

a. Contract

To provide mortgage or protection advice, including:

• Assessing your needs
• Sourcing suitable products
• Submitting applications to lenders or insurers

b. Legal obligation

To comply with:

• FCA rules (including MCOB)
• Anti-Money Laundering and fraud-prevention requirements
• Statutory record-keeping requirements

c. Legitimate interests

For purposes such as:

• Internal management and audits
• Maintaining records of advice
• Improving our services
• Limited, relevant marketing (where permitted by PECR)

d. Consent

Used for:

• Email and SMS marketing where consent is required
• Sharing your information with third parties where not essential to your application

Consent can be withdrawn at any time.

5. Who we share your personal data with

We may share your information with:

• Mortgage lenders
• Insurance providers (if protection advice is taken)
• Conveyancers or solicitors (where instructed)
• External compliance and audit firms
• System providers (e.g. sourcing and affordability tools)
• Regulators such as the FCA or ICO
• Law enforcement where legally required

We do not share data with:

• Debt collectors
• Tracing agents
• Recovery agents

6. Information we collect through our website

This section covers quickmortgages.com. It applies to anyone who uses the site, whether or not they go on to become a client.

When you complete an enquiry form

We collect:

• your first and last name;
• your email address;
• your telephone number;
• the page you submitted the form from, and any campaign or referral reference attached to your visit;
• the date and time of your submission.

We use this only to respond to your enquiry. Giving it to us is voluntary, but we cannot call you back without it. Our legal basis is our legitimate interest in responding to a request you have made of us and, once we begin advising you, the performance of a contract.

We do not record your IP address, your browser, or the website you arrived from as part of your enquiry.

Cookies, analytics and advertising

We set only essential cookies until you tell us otherwise. With your consent we also use cookies to measure how the site is used and how well our advertising works. Our Cookie Policy lists every cookie we set, what each one does, how long it lasts, and how to change or withdraw your consent at any time.

Referral and campaign references

If you reached us through an advertisement or a partner website, a reference identifying that source may be recorded alongside your enquiry, so that we can tell where our enquiries come from and confirm to the partner that a referral led to one. We work with Optimise Media (UK) Ltd and Impact for this.

Two kinds of reference are involved. One is given to us by the partner at the moment you click their link. The other we generate ourselves when you press send, to stand for your enquiry before it has reached our systems and been given a number of its own.

Neither names you. We do not send our partners your name, your contact details, or anything you tell us about your finances — these references exist precisely so that a partner can match a click to an enquiry without us having to tell them who you are. Data protection law nevertheless treats references of this kind as personal data, because they relate to you, your device and your visit. That is why we create them only where you have consented to marketing cookies. Where you have not, no reference is created.

If we ask you to sign a document electronically

We may email you a link to read and sign a document online, such as a letter or form we need you to sign or acknowledge. Each person who is asked to sign gets their own link. When you use it we record:

• your name and email address, and the document we asked you to sign;
• each step: when the link was sent and opened, when we emailed you a code to confirm it was you and when you entered it, when you viewed the document, when you signed, and any request for a new link, each with the date, time, IP address and web browser used;
• your signature, whether you drew it or typed it, and the wording you agreed to when you signed.

We use this to provide our services to you, and for our legitimate interests in being able to show who signed a document, when, and that it has not been changed since. The signed document and a report of these steps are emailed to everyone who signed it and to the members of our staff who deal with it. They are held on the servers that host this website, and the emails are sent through our Microsoft 365 email. The signing page sets one cookie, which is strictly necessary for it to work and is deleted when you close your browser. Signed documents and their signing records are kept for up to six years after the document is completed (or withdrawn), then deleted automatically; we may delete them sooner once we no longer need them.

If you work for us: the staff area

Our staff can sign in to a private area of this website to get documents for their work and to book holiday and working-from-home days. Accounts are given only to people with a Quick Mortgages work email address. For each account we hold:

• your name, work email address and your role (staff, holiday admin, documents admin or administrator);
• your password, in a scrambled form that cannot be turned back into the password; how you get your sign-in code; the setup key for your authenticator app if you use one; and, for the few minutes it lasts, a scrambled copy of any sign-in code we email you;
• a record of signing in and out, failed attempts, password resets, documents opened and changes made to accounts, each with the date, time, IP address and web browser used.

We use this for our legitimate interests: to keep the area secure, to control who can see our documents, and to investigate misuse. It is held on the servers that host this website, and the emails that let you set a password, and any sign-in codes we email you, are sent through our Microsoft 365 email. Signing in sets one cookie, which is strictly necessary for the area to work and is deleted when you close your browser. The record of activity is deleted automatically after 12 months.

The same area is used to book holiday and working-from-home days. For each member of staff we hold their allowances for the year, the days they ask for, approve, decline or cancel, any note added to a request, who decided it and when, and a log of every change. We also record days off sick: the dates, and a note if one is added. Sickness records are information about your health, which the law treats as more sensitive. We hold them to meet our obligations as your employer, including statutory sick pay and managing absence; only the people who approve holidays can see them, and you do not see them in the area yourself (you can ask us for a copy at any time). Colleagues can see who has approved holiday or working from home on which days, but never sickness or the reasons for any request.

We use holiday and working-from-home records to run your employment contract and to plan cover. Holiday, working-from-home and sickness records, and the log of changes to them, are kept for six years after the end of the year they relate to, then deleted automatically. When you leave, your account is closed straight away; your name is kept for as long as those records are, so that they still say whose they are, and is then deleted.

7. International transfers

Most of the personal data we hold never leaves the UK. Our customer relationship management system and the servers that host this website are both UK-based, so your enquiry and our record of it stay in the UK.

Some of the services that support our website operate outside it:

• Delivering your enquiry. Enquiries submitted through our website are passed into our customer relationship management system using Zapier, a workflow automation service provided by Zapier, Inc. in the United States. Zapier is certified under the UK Extension to the EU–US Data Privacy Framework.
• Advertising measurement. Where you consent to marketing cookies, we share two references with the advertising partner whose link you clicked: the one that partner gave us at the moment you clicked, and one we generate ourselves to stand for your enquiry. Together they let the partner confirm that their click led to an enquiry. One of those partners, Impact Tech, Inc., is based in the United States. Partners receive those references and nothing else — not your name, not your contact details, and nothing you tell us about your finances.
• Analytics. Where you consent to statistics cookies, Google may process information about your use of the site outside the UK.

Our partner marketing provider, Optimise Media (UK) Ltd, is UK-registered and stores data in the UK or the EEA, although limited data may be processed by a group company in India under safeguards agreed with us.

Where we transfer personal data outside the UK, we rely on the UK Government’s adequacy regulations where they apply — including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it — and otherwise on the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Details of the safeguards relied on for a particular transfer are available on request.

Other than as described above, we do not routinely transfer your data outside the UK. If that changes, we will put appropriate safeguards in place before it does.

8. Data retention

We keep your personal data for:

• 6 years from the end of our relationship (in line with FCA and MCOB rules)
• Longer where legal or regulatory obligations require it (e.g. lifetime mortgage cases)

Website enquiries

When you submit an enquiry through our website, a copy is written to our web server before it is passed to our customer relationship management system. That copy exists for one reason: so that an enquiry cannot be lost if the onward delivery fails. Our customer relationship management system, not the web server, is our record of your enquiry.

Server-side copies are automatically deleted within 90 days of being created.

Deleting that copy does not delete the enquiry itself. If your enquiry leads to us advising you, the record is kept under the six-year rule above. If it does not, we keep it for no longer than six years, and in practice usually delete it sooner.

Documents signed electronically

Documents signed through our website, and the record of how they were signed, are kept for up to six years after the document is completed or withdrawn, then deleted automatically.

9. Your rights

You have rights under data protection law, including:

• Access
• Rectification
• Erasure (“right to be forgotten”)
• Restriction
• Objection
• Data portability
• Withdraw consent

You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

10. Marketing

We may contact you for relevant mortgage or protection updates:

• With your explicit consent, and/or
• Under legitimate interests where proportionate

You may opt out at any time.

11. Changes to this notice

We may update this Privacy Notice periodically. The most up-to-date version will always be available upon request or on our website.