At a glance
What we do
You tell us what remortgage, mortgage or homeowner-loan help you want. We pass your enquiry to one firm from our panel of regulated firms, which then contacts you. We do not give advice, arrange mortgages or lend money ourselves.
What we collect
Your answers about your property, borrowing and circumstances; your name, date of birth, email and phone number; messages you send through our contact form; and details of your visit, such as the advert that brought you here.
Why
To pass your enquiry to a panel firm, to check enquiries are genuine, to run and protect the site, to measure which adverts work and, where you have agreed or the law allows, to send you our own marketing.
Who we share it with
The panel firm that takes your enquiry, the suppliers that run our systems, and advertising platforms, which receive scrambled contact details and an advert reference only, never your answers or financial details.
How long
Enquiries we pass to a panel firm: 6 years. Enquiries we do not pass on: 2 years. Other periods are in section 9.
Cookies
Until you choose in our banner, only necessary cookies are set, with two exceptions explained in our cookie policy.
Your rights
You can ask to see, correct or delete your data, object to how we use it, and withdraw consent.
Contact
Our contact form, or by post to 32 Squared Media Ltd, Henleaze Business Centre, 13 Harbury Road, Henleaze, Bristol BS9 4PN. Our director is our Data Protection Officer and can be reached the same way.
1. Who we are
GetMyMortgage (getmymortgage.co.uk) is run by 32 Squared Media Ltd, registered in England and Wales, company number 09095076. Our registered office is Henleaze Business Centre, 13 Harbury Road, Henleaze, Bristol BS9 4PN.
We are the controller of the personal data described in this policy and are registered with the Information Commissioner's Office (ICO), registration number ZA171363.
32 Squared Media Ltd (FRN 979113) is an Introducer Appointed Representative of Your Mortgage People Ltd (FRN 685250), which is authorised and regulated by the Financial Conduct Authority and approves our financial promotions.
We introduce you to a regulated firm. We do not give mortgage advice, arrange mortgage contracts, assess applications, lend money, or receive or hold client money. We do not ask for health or other special category data, and we do not record phone calls.
This policy covers getmymortgage.co.uk only. Other websites we link to have their own policies.
2. How to contact us and our Data Protection Officer
To contact us about your data, use our contact form or write to the address above.
Our director is our appointed Data Protection Officer (DPO). You can reach the DPO through the contact form or by post, marked "Data Protection Officer".
3. What we collect
When you make an enquiry (remortgage, homeowner loan or mortgage forms)
| Type | Examples |
|---|---|
| What you want to do | Remortgage, buy a home, or take a homeowner loan, and why (which can include paying off other debts) |
| Property and mortgage details | Property value, where it is, your current mortgage and how much you want to borrow |
| Income and employment | Your income, outgoings and employment status |
| Credit history | How you describe your credit record, so we can match you to a suitable firm |
| Contact and identity details | Name, date of birth, email address, phone number |
| Phone check | Some visitors confirm their phone number by entering a code we send by text message |
When you use the contact form. We receive your name, email address, reason for contact and message. The form emails these to our company mailbox (Google Workspace); the website itself stores nothing. Cloudflare Turnstile checks the form is not being used by a bot, which involves Cloudflare processing signals from your device and browser.
When you visit
| Type | Examples |
|---|---|
| Device and connection | IP address, browser and device type |
| Your visit | Pages you view, the page you landed on and when |
| How you found us | The advert or link that brought you here: advert click references from Google, Microsoft and Meta, and campaign tags in the page address. If you arrive from an advert or tracked link, we keep these for 7 days with the landing page, time and the rest of the page address (with any email addresses removed), linked to a cookie called __Host-lg_touch that lasts 24 hours. See our cookie policy. |
| Your cookie choices | Which cookie categories you accepted or declined, and when |
From others. The panel firm that takes your enquiry may tell us what happened to it, for example that it was accepted or returned. We use this to measure and improve our service and advertising.
4. How we use your data and why we are allowed to
UK data protection law requires a lawful reason ("lawful basis") for each use.
| What we do | Data used | Lawful basis |
|---|---|---|
| Pass your enquiry to a panel firm so it can contact you | Your answers and contact details | Contract: delivering the introduction you asked for. When you submit the form you also agree to be contacted by the panel firm we pass your enquiry to. |
| Confirm your phone number by text code | Phone number | Legitimate interests: making sure enquiries are real and reach you |
| Check enquiries and reject fake, invalid or duplicate ones, and block bot traffic (including Turnstile on the contact form) | Visit and device data, enquiry data | Legitimate interests: protecting our service, our panel firms and you |
| Credit your enquiry to the advert that brought you | Advert click references, campaign tags, landing page | Legitimate interests: knowing which adverts bring enquiries, so we spend less on those that do not |
| Tell advertising platforms that an enquiry from their advert was passed on | Scrambled email and phone, advert click reference, value and time | Legitimate interests: measuring our adverts |
| Keep records of enquiries, who we introduced you to and what happened | Enquiry, introduction record, panel firm outcome | Legitimate interests: running our business, being paid by panel firms and handling complaints; legal obligation where records are required |
| Keep the website and our systems secure | Logs, device and connection data | Legitimate interests: security; legal obligation to protect data |
| Website statistics | Visit data | Consent (Statistics cookies) |
| Advert measurement and remarketing using cookies | Visit data, advert click reference | Consent (Marketing cookies) |
| Answer your messages, complaints and rights requests | Whatever you send us | Legitimate interests; legal obligation for rights requests |
| Send you our own marketing, including following up a past enquiry | Contact details, what you enquired about and what happened to it | Consent given on our enquiry form, or the "soft opt-in" for similar products |
Where we rely on legitimate interests we have weighed our interests against yours. You can object at any time (section 12).
Our own marketing. We may email or text you about products and services similar to the one you enquired about, or follow up an enquiry you made earlier to help you book an appointment with a panel firm. We only do this where you agreed to it on our enquiry form, or where the law allows us to contact people who have enquired with us about similar products (the "soft opt-in"). We stop 12 months after your enquiry or your last engagement with us, whichever is later. Every message tells you how to opt out, and you can opt out at any time through the contact form. When you do, we keep a suppression record so we do not contact you again.
5. Passing your enquiry to a panel firm
When you submit an enquiry, we send it to one firm from our panel of regulated firms. Some panel firms may pass your enquiry to a regulated firm they work with, under their own privacy policy.
How it works:
- You answer our questions and give your contact details.
- Our website sends your enquiry to our Lead API, run on Cloudflare, which stores it in private storage in the EU and records it in a ledger.
- Our lead-delivery supplier, LeadByte, checks the enquiry and delivers it to the panel firm.
- The firm contacts you. From then on it is a separate controller of your data under its own privacy policy. Each panel firm and we are independent controllers; we do not act on each other's instructions.
- The firm may tell us whether it accepted your enquiry.
Panel firms may pay us a fee for enquiries we introduce.
If we stop working with a panel firm, that firm may keep the enquiries we have already passed to it, and continue to use them under its own privacy policy.
6. Advertising and measurement
We advertise on Google, Microsoft (Bing), Meta (Facebook and Instagram) and Taboola. We want to know which adverts lead to useful enquiries so we spend less on adverts that do not work.
On the website. Our cookie banner denies everything except necessary cookies by default. Our tag manager, Cloudflare Zaraz, runs the banner and loads tools only after you accept the relevant category:
- Statistics: Google Analytics 4 and PostHog (EU), which record page views. Both run from our server rather than your browser.
- Marketing: Google Ads remarketing with Google's conversion linker, Microsoft Advertising, Meta (page views sent from our server) and Taboola.
Two things happen before you choose, as our cookie policy explains. Microsoft Advertising's script sends a cookieless page-view signal. And if you arrive from an advert or tracked link, we set our own __Host-lg_touch cookie, which lasts 24 hours and points to a 7-day server record of the advert details, so we can credit any enquiry to that advert. We do this under legitimate interests: knowing which advert brought an enquiry. The cookie holds only a random reference, no personal details.
When we pass your enquiry on. Our server tells Google, Microsoft and Meta that an enquiry came from their advert, so they can measure our adverts. We do this whatever you chose in the cookie banner. We send:
- your email address and phone number in hashed (scrambled) form, which a platform can only match to an account it already holds;
- the advert click reference, if you arrived from an advert;
- the value and time of the enquiry.
If you accepted Marketing cookies, we pass that choice on to Google as well.
7. Our suppliers
These suppliers process data for us under contract and on our instructions, unless stated.
| Supplier | What they do for us | Where data is held |
|---|---|---|
| Cloudflare | Hosts and protects the website; runs our Lead API, which stores submitted enquiries in private storage with a ledger; runs Zaraz (tag manager) and Turnstile (bot check) | Enquiries: EU. Website traffic and security: Cloudflare's global network |
| LeadByte | Receives each enquiry from our Lead API, checks it and delivers it to the panel firm; holds our record of submitted enquiries | Ireland |
| Google Workspace | Our email, including contact-form messages | See section 8 |
| Google Cloud (Cloud SQL) | Holds older enquiry records, now being archived and retired | EU |
| Twilio | Sends the text messages we use to confirm phone numbers and to contact you | USA |
| PostHog | Website statistics (page views) | EU |
| Google (Analytics, Ads), Microsoft Advertising, Meta, Taboola | Statistics and advert measurement | USA and elsewhere |
We may also share data if the law requires it, for example with a court, regulator or the police, or to protect our rights. If our business, or part of it, is sold or merged, your data may pass to the new owner, who must use it in line with this policy.
8. Sending data outside the UK
Enquiries you submit are stored in the UK or the EU, which the UK treats as providing adequate protection. Some of our suppliers and the advertising platforms we use, including Twilio and the US-based platforms, process data outside the UK. When they do, we rely on one of these protections:
- the country is covered by UK adequacy regulations (this includes the EU and EEA);
- a UK-approved contract: the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
You can ask us for more details about the protection that applies.
9. How long we keep your data
| Data | How long |
|---|---|
| Enquiries passed to a panel firm, with our record of the introduction | 6 years from your last submission |
| Enquiries we received but did not pass to a panel firm | 2 years from your last submission |
| Incomplete or failed form submissions | 7 days |
| Invalid, duplicate or unmatched enquiries | 90 days after the decision |
| Record of the advert that brought you (click references, campaign tags, landing page) | 7 days; the __Host-lg_touch cookie expires after 24 hours |
| Form cookies (lg_form_start, lg_ty, lg_sms) | 30 minutes |
| Website and security logs | 90 days |
| Messages sent through the contact form, and requests to use your rights | 3 years from receipt, or until the matter closes if later |
| Complaints | 6 years |
| Temporary exports of enquiry data | 30 days after use |
| Backups | Removed within 90 days of deletion from live systems |
| Older enquiry records in the archived database | Being deleted as the archive is retired; no longer than the enquiry periods above |
| Anything else (website statistics, cookie choice records, phone-check logs, records of what we sent to advertising platforms) | As long as necessary for the purpose, then deleted |
After that we delete or anonymise the data.
Some limited records are kept beyond these periods:
- Legal hold. If a record is needed for a legal claim, a complaint or a regulator's request, we keep it until that matter closes.
- Accounting and commercial records, such as invoices to panel firms: 6 years.
- Marketing suppression. If you ask us to stop contacting you, we keep a short note so we do not contact you again, and review it each year.
10. How we protect your data
We use named accounts, unique passwords and two-factor authentication on the systems that hold enquiries, including our email and LeadByte. The website runs over HTTPS and is protected by Cloudflare. Access to administration of our systems is restricted to the people who need it, and we keep website software up to date. No system is completely secure, but we take reasonable steps to protect your data.
If a data breach puts you at risk, we will tell the ICO within 72 hours of becoming aware of it, tell you without undue delay where the risk to you is high, and tell the panel firm that received your enquiry if the breach affects data we shared with it.
11. Automated decisions
Matching your enquiry to a panel firm is partly automated, based on the answers you give. Enquiries that are incomplete, invalid, duplicated or look suspicious may be rejected automatically. We do not make decisions about you that have a legal or similarly significant effect: any decision on whether to offer you a mortgage or loan is made by the firm you deal with. If you would like a person to review how your enquiry was matched, ask us through the contact form.
12. Your rights
You have the right to:
- see the data we hold about you (a "subject access request");
- correct data that is wrong or incomplete;
- delete your data, in some cases;
- object to uses based on legitimate interests, and to direct marketing at any time;
- restrict our use while a concern is looked into;
- move data you gave us to another organisation, in some cases;
- withdraw consent at any time, including your cookie choice, without affecting what was done before.
To use a right, send us a message through the contact form or write to us. It is free. We will reply within one month, or tell you if we need longer. We may ask you to confirm who you are.
The firm that took your enquiry holds its own copy. When you ask us to correct, delete or restrict your data, or object to its use, we also tell the panel firm that received your enquiry, so it can act on its own copy. You can contact that firm directly too.
Stopping calls. You can register free with the Telephone Preference Service (tpsonline.org.uk). It does not stop a firm you asked to call you.
13. Complaints
Please contact us first, through the contact form or by post, and we will try to put it right. We handle complaints about our advertising, our introductions and how we handle your data. We will acknowledge your complaint and reply within one month.
Complaints about mortgage or loan advice, an application or a product go to the firm that received your enquiry. Complaints about our activity as an Introducer Appointed Representative are handled by Your Mortgage People Ltd. If you are not sure who to contact, ask us and we will tell you.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
14. Changes to this policy
We will update this policy when how we use data changes, and change the "last updated" date at the top. If a change is significant we will say so on the site. A change does not take away your rights.
15. Contact
32 Squared Media Ltd (GetMyMortgage), Henleaze Business Centre, 13 Harbury Road, Henleaze, Bristol BS9 4PN. Contact form.