Privacy Notice

1. Introduction

This Privacy Notice explains how Cherry Street Holdings Ltd trading as Quick Mortgages (“we”, “us”, “our”) collects, uses, and protects your personal information. We act as the Data Controller, meaning we determine how and why your information is processed. We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all relevant FCA requirements including Consumer Duty.

2. What personal data we collect

We may collect the following personal information:

• Name, date of birth, contact details
• Address history
• Employment and income details
• Financial information for affordability assessment
• Details of credit commitments
• Family and lifestyle information relevant to advice
• Identification documents (for AML checks)
• Information provided during fact-finding and advice conversations

We do not carry out our own credit searches. Lenders may complete credit checks once an application is submitted.

3. How we collect personal data

We collect information:

• Directly from you
• From introducers (if applicable)
• Through affordability or mortgage sourcing systems
• From lenders once an application begins

4. Why we process your personal data (legal bases)

a. Contract

To provide mortgage or protection advice, including:

• Assessing your needs
• Sourcing suitable products
• Submitting applications to lenders or insurers

b. Legal obligation

To comply with:

• FCA rules (including MCOB)
• Anti-Money Laundering and fraud-prevention requirements
• Statutory record-keeping requirements

c. Legitimate interests

For purposes such as:

• Internal management and audits
• Maintaining records of advice
• Improving our services
• Limited, relevant marketing (where permitted by PECR)

d. Consent

Used for:

• Email and SMS marketing where consent is required
• Sharing your information with third parties where not essential to your application

Consent can be withdrawn at any time.

5. Who we share your personal data with

We may share your information with:

• Mortgage lenders
• Insurance providers (if protection advice is taken)
• Conveyancers or solicitors (where instructed)
• External compliance and audit firms
• System providers (e.g. sourcing and affordability tools)
• Regulators such as the FCA or ICO
• Law enforcement where legally required

We do not share data with:

• Debt collectors
• Tracing agents
• Recovery agents

6. Information we collect through our website

This section covers quickmortgages.com. It applies to anyone who uses the site, whether or not they go on to become a client.

When you complete an enquiry form

We collect:

• your first and last name;
• your email address;
• your telephone number;
• the page you submitted the form from, and any campaign or referral reference attached to your visit;
• the date and time of your submission.

We use this only to respond to your enquiry. Giving it to us is voluntary, but we cannot call you back without it. Our legal basis is our legitimate interest in responding to a request you have made of us and, once we begin advising you, the performance of a contract.

We do not record your IP address, your browser, or the website you arrived from as part of your enquiry.

Cookies, analytics and advertising

We set only essential cookies until you tell us otherwise. With your consent we also use cookies to measure how the site is used and how well our advertising works. Our Cookie Policy lists every cookie we set, what each one does, how long it lasts, and how to change or withdraw your consent at any time.

Referral and campaign references

If you reached us through an advertisement or a partner website, a reference identifying that source may be recorded alongside your enquiry, so that we can tell where our enquiries come from and confirm to the partner that a referral led to one. We work with Optimise Media (UK) Ltd and Impact for this.

Two kinds of reference are involved. One is given to us by the partner at the moment you click their link. The other we generate ourselves when you press send, to stand for your enquiry before it has reached our systems and been given a number of its own.

Neither names you. We do not send our partners your name, your contact details, or anything you tell us about your finances — these references exist precisely so that a partner can match a click to an enquiry without us having to tell them who you are. Data protection law nevertheless treats references of this kind as personal data, because they relate to you, your device and your visit. That is why we create them only where you have consented to marketing cookies. Where you have not, no reference is created.

7. International transfers

Most of the personal data we hold never leaves the UK. Our customer relationship management system and the servers that host this website are both UK-based, so your enquiry and our record of it stay in the UK.

Some of the services that support our website operate outside it:

• Delivering your enquiry. Enquiries submitted through our website are passed into our customer relationship management system using Zapier, a workflow automation service provided by Zapier, Inc. in the United States. Zapier is certified under the UK Extension to the EU–US Data Privacy Framework.
• Advertising measurement. Where you consent to marketing cookies, we share two references with the advertising partner whose link you clicked: the one that partner gave us at the moment you clicked, and one we generate ourselves to stand for your enquiry. Together they let the partner confirm that their click led to an enquiry. One of those partners, Impact Tech, Inc., is based in the United States. Partners receive those references and nothing else — not your name, not your contact details, and nothing you tell us about your finances.
• Analytics. Where you consent to statistics cookies, Google may process information about your use of the site outside the UK.

Our partner marketing provider, Optimise Media (UK) Ltd, is UK-registered and stores data in the UK or the EEA, although limited data may be processed by a group company in India under safeguards agreed with us.

Where we transfer personal data outside the UK, we rely on the UK Government’s adequacy regulations where they apply — including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it — and otherwise on the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Details of the safeguards relied on for a particular transfer are available on request.

Other than as described above, we do not routinely transfer your data outside the UK. If that changes, we will put appropriate safeguards in place before it does.

8. Data retention

We keep your personal data for:

• 6 years from the end of our relationship (in line with FCA and MCOB rules)
• Longer where legal or regulatory obligations require it (e.g. lifetime mortgage cases)

Website enquiries

When you submit an enquiry through our website, a copy is written to our web server before it is passed to our customer relationship management system. That copy exists for one reason: so that an enquiry cannot be lost if the onward delivery fails. Our customer relationship management system, not the web server, is our record of your enquiry.

Server-side copies are automatically deleted 90 days after they are created.

Deleting that copy does not delete the enquiry itself. If your enquiry leads to us advising you, the record is kept under the six-year rule above. If it does not, we keep it for no longer than six years, and in practice usually delete it sooner.

9. Your rights

You have rights under data protection law, including:

• Access
• Rectification
• Erasure (“right to be forgotten”)
• Restriction
• Objection
• Data portability
• Withdraw consent

You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

10. Marketing

We may contact you for relevant mortgage or protection updates:

• With your explicit consent, and/or
• Under legitimate interests where proportionate

You may opt out at any time.

11. Changes to this notice

We may update this Privacy Notice periodically. The most up-to-date version will always be available upon request or on our website.