Privacy Policy
Why your privacy matters
This Privacy Policy explains how Zerodown (referred to as “Zerodown”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use our website and services. Zerodown is an introducer service based in Spain. We pre‑qualify your case and introduce you to specialist mortgage brokers and lenders – we are not a lender or broker and do not provide regulated mortgage advice. Starting a pre‑qualification means that you agree to our Privacy Policy and consent to us sharing your data with selected partners for mortgage assessment. Please read this Policy carefully; it applies to all visitors and users of our website.
1. Who we are
The controller responsible for your personal data is (your legal company name), trading as “Zerodown”, with its registered address at (legal address). For privacy matters, you can contact us at (privacy email address). We are subject to the EU General Data Protection Regulation (GDPR) and applicable Spanish and UK data protection laws.
2. Scope of this Policy
This Policy covers personal data collected through our website (including our calculator and pre‑check forms), through our WhatsApp and phone communications, via email, and via any case‑pack upload tool we provide. It also covers personal data we receive from partners and public sources when necessary to perform our services. It does not cover the privacy practices of third parties that we do not control. Our website may contain links to third‑party sites; we are not responsible for their privacy statements.
3. What information we collect
We collect the following categories of personal data, depending on how you interact with us:
Identification and contact data: your name, email address, WhatsApp number, residential address, nationality, and identification documents (passport or NIE). We collect these data when you complete our calculator, start a pre‑check, book a call, or contact us via the site.
Financial and eligibility data: employment details, income, assets, liabilities, existing loans and debts, property price, deposit amount, projected mortgage amount, tax returns and bank statements. We ask for these data to assess eligibility and assemble a case pack for brokers.
Uploaded documents: scans of passports/NIEs, pay slips, bank statements, tax returns, or property links. We provide a secure upload tool for these files.
Communications data: messages you send to us via WhatsApp, email, or phone calls (including call notes), as well as any feedback or survey responses. WhatsApp communication is optional and you can opt out at any time.
Technical and usage data: your IP address, browser type, device information and pages you visit on our site. Our website uses cookieless analytics that hash IP addresses and user agents with a daily rotating secret to count unique visitors and page views; no personal data is stored.
Marketing preferences: your consents for receiving marketing messages and records of opt‑in/opt‑out.
4. How we collect your data
We collect personal data in various ways:
Directly from you: when you use our calculator, start a pre‑check, upload documents, book a call, communicate with us on WhatsApp, or otherwise contact us. You choose whether to provide optional fields.
Automatically: when you visit our website, we automatically collect certain technical and usage data via cookieless analytics (IP address and user agent hashed per day). If we add third‑party analytics or advertising tools, we will ask for your consent before collecting any non‑essential data.
From third parties: with your consent, we may collect information from partner brokers (e.g., additional know‑your‑customer details and credit information), public sources (such as land registries or property listings) and credit/reference agencies to verify the information you provide and to prepare your case. We may also receive contact details if you are referred by a partner agency.
5. Legal bases and purposes of processing
We rely on one or more of the following legal bases to process your personal data:
Performance of a contract / pre‑contractual steps: when you request our services, we process your personal data to assess your eligibility, prepare a case pack, and introduce you to selected brokers and lenders. Without these data, we cannot perform our services.
Legitimate interests: we process certain data for our legitimate interests, including running our business, maintaining records, improving our services, responding to enquiries, preventing fraud, ensuring network and information security, and defending legal claims. We only rely on this basis after assessing that our interests do not override your fundamental rights and freedoms.
Consent: we rely on your consent for specific purposes, such as sending marketing communications, contacting you via WhatsApp, and sharing optional data. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Legal obligations: we may need to process your data to comply with legal and regulatory obligations, such as anti‑money‑laundering and know‑your‑customer requirements, tax and accounting laws, and to respond to lawful requests from public authorities.
6. How we use your data
We use your personal data for the following purposes:
Providing our introducer service: to evaluate your information, determine whether you may qualify for a mortgage, create a case pack, and introduce you to appropriate brokers and lenders.
Communicating with you: to send you updates about your case, scheduling information, and respond to your queries via WhatsApp, phone or email. You can block us on WhatsApp at any time.
Sharing with partners: to share your case information and documents with selected specialist brokers and lenders to obtain preliminary decisions and, if you proceed, to prepare formal applications. These partners will contact you directly to complete full know‑your‑customer and credit checks.
Operations and analytics: to use aggregated, anonymised data to understand how our website is used and improve our products. Our analytics do not collect personal data and use hashed IP addresses that reset daily.
Marketing and promotions: with your consent, to send marketing messages about our services and partner offers by WhatsApp or email. You can opt out at any time.
Legal and regulatory compliance: to comply with know‑your‑customer, anti‑money‑laundering, tax, accounting and other legal requirements, and to respond to lawful requests from public authorities or courts.
Security, fraud prevention and risk management: to verify your identity, prevent fraud and protect our systems.
7. Sharing your data
We may share your data in the following circumstances:
Selected mortgage brokers and lenders: after we assess your information, we will introduce you to one or more specialist brokers and lenders who will continue the mortgage process. They act as independent controllers of your data and have their own privacy obligations.
Service providers: we use trusted third‑party service providers to operate and manage our website, communications, scheduling, analytics, document storage, payment processing, and customer support. These providers act as processors, meaning they process personal data on our behalf under binding contracts that require them to protect your data, not to use it for their own purposes, and to process it only according to our instructions.
Professional advisers and regulators: we may share your data with professional advisers (lawyers, auditors, bankers and insurers) and with tax authorities or regulators when required by law.
Business transfers: if we undergo a merger, acquisition, or sale of assets, your data may be transferred to the successor entity subject to this Policy.
We do not sell your personal data.
8. International data transfers
Some of our service providers may be located outside the European Economic Area (EEA). To ensure that any international data transfers are lawful, we use appropriate safeguards such as standard contractual clauses approved by the European Commission. These model clauses provide a lawful basis for data transfers from the EU to third countries. We may also rely on adequacy decisions recognised by the European Commission. Copies of the relevant safeguards can be provided on request.
9. Cookies and similar technologies
Our website uses only essential cookies necessary to operate the site. Our analytics are cookieless: IP addresses and user agents are hashed with a daily rotating secret to count unique visitors and page views, and no personal data is stored. We do not use cookies for analytics. If we integrate additional services that place non‑essential cookies on your device, we will display a cookie banner and ask for your consent before such cookies are set. Our cookie banner will allow you to accept or reject different categories of cookies and will link to a detailed Cookie Policy.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encryption of data in transit and at rest, access controls, secure storage of documents, pseudonymisation, and staff training. We regularly review our security protocols to ensure they remain adequate. Despite our efforts, no security measures are perfect; if we become aware of a personal data breach, we will notify you and the appropriate authorities as required by law.
11. Data retention
We retain your personal data only for as long as necessary for the purposes set out in this Policy. Our standard retention periods are:
Enquiries that do not progress to a case: we keep your basic contact details and enquiry information for up to (e.g., 12 months) from the date of your last contact, in case you decide to proceed in future.
Active cases: we keep case files and supporting documents while your application is in progress and for (e.g., 6 years) after completion or cancellation, to comply with legal and regulatory requirements (such as anti‑money‑laundering and tax laws) and to respond to any queries or claims.
Marketing consent: we retain your marketing preferences until you withdraw your consent or until (e.g., 24 months) after your last interaction with us.
Analytics: technical data collected by our analytics is anonymised and resets every day.
We may need to keep data longer if required by law or to defend legal claims. When your data are no longer needed, we will securely delete or anonymise them.
12. Your rights
Under the GDPR and applicable data‑protection laws, you have the following rights (subject to conditions and exceptions):
Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of such data.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data (the “right to be forgotten”), for example when the data are no longer needed or if you withdraw consent.
Right to restriction of processing: to request that we stop using your data while we assess a request to rectify or erase it, or to object.
Right to data portability: to receive your data in a structured, commonly used format or to have it transferred to another controller.
Right to object: to object to the processing of your data based on legitimate interests or for direct marketing.
Right to withdraw consent: to withdraw your consent at any time where processing is based on consent (e.g., marketing or WhatsApp communications). Withdrawal does not affect the lawfulness of processing before withdrawal.
If you wish to exercise any of these rights, please contact us at (privacy email address). We may need to verify your identity before responding. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) or your local supervisory authority.
13. WhatsApp communications
If you choose to contact us via WhatsApp, please be aware of the following:
Opt‑in and opt‑out: we will only message you on WhatsApp if you opt in (for example by entering your WhatsApp number or clicking our WhatsApp link). You can opt out by replying “STOP” or by blocking our number at any time.
End‑to‑end encryption: WhatsApp uses end‑to‑end encryption for messages and calls, meaning that message content is protected from the moment it leaves your device until it reaches ours. Message content is not shared with Meta.
Business communications: WhatsApp will make it clear when you are chatting with a business. We do not sell your WhatsApp messages to third parties. If we use advertising services, limited information (such as the fact that you started a chat) may be shared to manage ad preferences.
Privacy settings: you can review and adjust your ad settings through your Meta account or via the Digital Advertising Alliance’s tools if you do not want your activity to be used for personalised advertising.
14. Children’s privacy
Our services are directed at adults. We do not knowingly collect data from individuals under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data can contact us to request removal.
15. Third‑party websites and social media
Our website may contain links to third‑party sites (such as brokers, calculators, or external resources) and to social‑media platforms (such as YouTube, Facebook, and Instagram). Clicking on those links may allow third parties to collect or share data about you. We do not control these third‑party sites and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.
16. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our data‑processing practices. If we make significant changes, we will notify you via our website or by email. The date of the latest revision will be indicated at the top. We encourage you to review this page regularly.
17. How to contact us
If you have questions or concerns about this Privacy Policy or our data practices, or if you want to exercise your rights, please contact us at:
Email: (privacy email address) – primary contact for data requests and complaints.
Postal address: (legal address)
WhatsApp: (WhatsApp number) – for general enquiries (not for exercising rights).
You also have the right to file a complaint with the Agencia Española de Protección de Datos (AEPD) or your local data‑protection authority.
Last updated: 06 November 2025
Privacy Policy
Why your privacy matters
We give you a branded webpage for your agency to use as your own.
1. Who we are
The controller responsible for your personal data is (your legal company name), trading as “Zerodown”, with its registered address at (legal address). For privacy matters, you can contact us at (privacy email address). We are subject to the EU General Data Protection Regulation (GDPR) and applicable Spanish and UK data protection laws.
2. Scope of this Policy
This Policy covers personal data collected through our website (including our calculator and pre‑check forms), through our WhatsApp and phone communications, via email, and via any case‑pack upload tool we provide. It also covers personal data we receive from partners and public sources when necessary to perform our services. It does not cover the privacy practices of third parties that we do not control. Our website may contain links to third‑party sites; we are not responsible for their privacy statements.
3. What information we collect
We collect the following categories of personal data, depending on how you interact with us:
Identification and contact data: your name, email address, WhatsApp number, residential address, nationality, and identification documents (passport or NIE). We collect these data when you complete our calculator, start a pre‑check, book a call, or contact us via the site.
Financial and eligibility data: employment details, income, assets, liabilities, existing loans and debts, property price, deposit amount, projected mortgage amount, tax returns and bank statements. We ask for these data to assess eligibility and assemble a case pack for brokers.
Uploaded documents: scans of passports/NIEs, pay slips, bank statements, tax returns, or property links. We provide a secure upload tool for these files.
Communications data: messages you send to us via WhatsApp, email, or phone calls (including call notes), as well as any feedback or survey responses. WhatsApp communication is optional and you can opt out at any time.
Technical and usage data: your IP address, browser type, device information and pages you visit on our site. Our website uses cookieless analytics that hash IP addresses and user agents with a daily rotating secret to count unique visitors and page views; no personal data is stored.
Marketing preferences: your consents for receiving marketing messages and records of opt‑in/opt‑out.
4. How we collect your data
We collect personal data in various ways:
Directly from you: when you use our calculator, start a pre‑check, upload documents, book a call, communicate with us on WhatsApp, or otherwise contact us. You choose whether to provide optional fields.
Automatically: when you visit our website, we automatically collect certain technical and usage data via cookieless analytics (IP address and user agent hashed per day). If we add third‑party analytics or advertising tools, we will ask for your consent before collecting any non‑essential data.
From third parties: with your consent, we may collect information from partner brokers (e.g., additional know‑your‑customer details and credit information), public sources (such as land registries or property listings) and credit/reference agencies to verify the information you provide and to prepare your case. We may also receive contact details if you are referred by a partner agency.
5. Legal bases and purposes of processing
We rely on one or more of the following legal bases to process your personal data:
Performance of a contract / pre‑contractual steps: when you request our services, we process your personal data to assess your eligibility, prepare a case pack, and introduce you to selected brokers and lenders. Without these data, we cannot perform our services.
Legitimate interests: we process certain data for our legitimate interests, including running our business, maintaining records, improving our services, responding to enquiries, preventing fraud, ensuring network and information security, and defending legal claims. We only rely on this basis after assessing that our interests do not override your fundamental rights and freedoms.
Consent: we rely on your consent for specific purposes, such as sending marketing communications, contacting you via WhatsApp, and sharing optional data. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Legal obligations: we may need to process your data to comply with legal and regulatory obligations, such as anti‑money‑laundering and know‑your‑customer requirements, tax and accounting laws, and to respond to lawful requests from public authorities.
6. How we use your data
We use your personal data for the following purposes:
Providing our introducer service: to evaluate your information, determine whether you may qualify for a mortgage, create a case pack, and introduce you to appropriate brokers and lenders.
Communicating with you: to send you updates about your case, scheduling information, and respond to your queries via WhatsApp, phone or email. You can block us on WhatsApp at any time.
Sharing with partners: to share your case information and documents with selected specialist brokers and lenders to obtain preliminary decisions and, if you proceed, to prepare formal applications. These partners will contact you directly to complete full know‑your‑customer and credit checks.
Operations and analytics: to use aggregated, anonymised data to understand how our website is used and improve our products. Our analytics do not collect personal data and use hashed IP addresses that reset daily.
Marketing and promotions: with your consent, to send marketing messages about our services and partner offers by WhatsApp or email. You can opt out at any time.
Legal and regulatory compliance: to comply with know‑your‑customer, anti‑money‑laundering, tax, accounting and other legal requirements, and to respond to lawful requests from public authorities or courts.
Security, fraud prevention and risk management: to verify your identity, prevent fraud and protect our systems.
7. Sharing your data
We may share your data in the following circumstances:
Selected mortgage brokers and lenders: after we assess your information, we will introduce you to one or more specialist brokers and lenders who will continue the mortgage process. They act as independent controllers of your data and have their own privacy obligations.
Service providers: we use trusted third‑party service providers to operate and manage our website, communications, scheduling, analytics, document storage, payment processing, and customer support. These providers act as processors, meaning they process personal data on our behalf under binding contracts that require them to protect your data, not to use it for their own purposes, and to process it only according to our instructions.
Professional advisers and regulators: we may share your data with professional advisers (lawyers, auditors, bankers and insurers) and with tax authorities or regulators when required by law.
Business transfers: if we undergo a merger, acquisition, or sale of assets, your data may be transferred to the successor entity subject to this Policy.
We do not sell your personal data.
8. International data transfers
Some of our service providers may be located outside the European Economic Area (EEA). To ensure that any international data transfers are lawful, we use appropriate safeguards such as standard contractual clauses approved by the European Commission. These model clauses provide a lawful basis for data transfers from the EU to third countries. We may also rely on adequacy decisions recognised by the European Commission. Copies of the relevant safeguards can be provided on request.
9. Cookies and similar technologies
Our website uses only essential cookies necessary to operate the site. Our analytics are cookieless: IP addresses and user agents are hashed with a daily rotating secret to count unique visitors and page views, and no personal data is stored. We do not use cookies for analytics. If we integrate additional services that place non‑essential cookies on your device, we will display a cookie banner and ask for your consent before such cookies are set. Our cookie banner will allow you to accept or reject different categories of cookies and will link to a detailed Cookie Policy.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encryption of data in transit and at rest, access controls, secure storage of documents, pseudonymisation, and staff training. We regularly review our security protocols to ensure they remain adequate. Despite our efforts, no security measures are perfect; if we become aware of a personal data breach, we will notify you and the appropriate authorities as required by law.
11. Data retention
We retain your personal data only for as long as necessary for the purposes set out in this Policy. Our standard retention periods are:
Enquiries that do not progress to a case: we keep your basic contact details and enquiry information for up to (e.g., 12 months) from the date of your last contact, in case you decide to proceed in future.
Active cases: we keep case files and supporting documents while your application is in progress and for (e.g., 6 years) after completion or cancellation, to comply with legal and regulatory requirements (such as anti‑money‑laundering and tax laws) and to respond to any queries or claims.
Marketing consent: we retain your marketing preferences until you withdraw your consent or until (e.g., 24 months) after your last interaction with us.
Analytics: technical data collected by our analytics is anonymised and resets every day.
We may need to keep data longer if required by law or to defend legal claims. When your data are no longer needed, we will securely delete or anonymise them.
12. Your rights
Under the GDPR and applicable data‑protection laws, you have the following rights (subject to conditions and exceptions):
Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of such data.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data (the “right to be forgotten”), for example when the data are no longer needed or if you withdraw consent.
Right to restriction of processing: to request that we stop using your data while we assess a request to rectify or erase it, or to object.
Right to data portability: to receive your data in a structured, commonly used format or to have it transferred to another controller.
Right to object: to object to the processing of your data based on legitimate interests or for direct marketing.
Right to withdraw consent: to withdraw your consent at any time where processing is based on consent (e.g., marketing or WhatsApp communications). Withdrawal does not affect the lawfulness of processing before withdrawal.
If you wish to exercise any of these rights, please contact us at (privacy email address). We may need to verify your identity before responding. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) or your local supervisory authority.
13. WhatsApp communications
If you choose to contact us via WhatsApp, please be aware of the following:
Opt‑in and opt‑out: we will only message you on WhatsApp if you opt in (for example by entering your WhatsApp number or clicking our WhatsApp link). You can opt out by replying “STOP” or by blocking our number at any time.
End‑to‑end encryption: WhatsApp uses end‑to‑end encryption for messages and calls, meaning that message content is protected from the moment it leaves your device until it reaches ours. Message content is not shared with Meta.
Business communications: WhatsApp will make it clear when you are chatting with a business. We do not sell your WhatsApp messages to third parties. If we use advertising services, limited information (such as the fact that you started a chat) may be shared to manage ad preferences.
Privacy settings: you can review and adjust your ad settings through your Meta account or via the Digital Advertising Alliance’s tools if you do not want your activity to be used for personalised advertising.
14. Children’s privacy
Our services are directed at adults. We do not knowingly collect data from individuals under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data can contact us to request removal.
15. Third‑party websites and social media
Our website may contain links to third‑party sites (such as brokers, calculators, or external resources) and to social‑media platforms (such as YouTube, Facebook, and Instagram). Clicking on those links may allow third parties to collect or share data about you. We do not control these third‑party sites and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.
16. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our data‑processing practices. If we make significant changes, we will notify you via our website or by email. The date of the latest revision will be indicated at the top. We encourage you to review this page regularly.
17. How to contact us
If you have questions or concerns about this Privacy Policy or our data practices, or if you want to exercise your rights, please contact us at:
Email: (privacy email address) – primary contact for data requests and complaints.
Postal address: (legal address)
WhatsApp: (WhatsApp number) – for general enquiries (not for exercising rights).
You also have the right to file a complaint with the Agencia Española de Protección de Datos (AEPD) or your local data‑protection authority.
Last updated: 06 November 2025
Privacy Policy
Why your privacy matters
This Privacy Policy explains how Zerodown (referred to as “Zerodown”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use our website and services. Zerodown is an introducer service based in Spain. We pre‑qualify your case and introduce you to specialist mortgage brokers and lenders – we are not a lender or broker and do not provide regulated mortgage advice. Starting a pre‑qualification means that you agree to our Privacy Policy and consent to us sharing your data with selected partners for mortgage assessment. Please read this Policy carefully; it applies to all visitors and users of our website.
1. Who we are
The controller responsible for your personal data is (your legal company name), trading as “Zerodown”, with its registered address at (legal address). For privacy matters, you can contact us at (privacy email address). We are subject to the EU General Data Protection Regulation (GDPR) and applicable Spanish and UK data protection laws.
2. Scope of this Policy
This Policy covers personal data collected through our website (including our calculator and pre‑check forms), through our WhatsApp and phone communications, via email, and via any case‑pack upload tool we provide. It also covers personal data we receive from partners and public sources when necessary to perform our services. It does not cover the privacy practices of third parties that we do not control. Our website may contain links to third‑party sites; we are not responsible for their privacy statements.
3. What information we collect
We collect the following categories of personal data, depending on how you interact with us:
Identification and contact data: your name, email address, WhatsApp number, residential address, nationality, and identification documents (passport or NIE). We collect these data when you complete our calculator, start a pre‑check, book a call, or contact us via the site.
Financial and eligibility data: employment details, income, assets, liabilities, existing loans and debts, property price, deposit amount, projected mortgage amount, tax returns and bank statements. We ask for these data to assess eligibility and assemble a case pack for brokers.
Uploaded documents: scans of passports/NIEs, pay slips, bank statements, tax returns, or property links. We provide a secure upload tool for these files.
Communications data: messages you send to us via WhatsApp, email, or phone calls (including call notes), as well as any feedback or survey responses. WhatsApp communication is optional and you can opt out at any time.
Technical and usage data: your IP address, browser type, device information and pages you visit on our site. Our website uses cookieless analytics that hash IP addresses and user agents with a daily rotating secret to count unique visitors and page views; no personal data is stored.
Marketing preferences: your consents for receiving marketing messages and records of opt‑in/opt‑out.
4. How we collect your data
We collect personal data in various ways:
Directly from you: when you use our calculator, start a pre‑check, upload documents, book a call, communicate with us on WhatsApp, or otherwise contact us. You choose whether to provide optional fields.
Automatically: when you visit our website, we automatically collect certain technical and usage data via cookieless analytics (IP address and user agent hashed per day). If we add third‑party analytics or advertising tools, we will ask for your consent before collecting any non‑essential data.
From third parties: with your consent, we may collect information from partner brokers (e.g., additional know‑your‑customer details and credit information), public sources (such as land registries or property listings) and credit/reference agencies to verify the information you provide and to prepare your case. We may also receive contact details if you are referred by a partner agency.
5. Legal bases and purposes of processing
We rely on one or more of the following legal bases to process your personal data:
Performance of a contract / pre‑contractual steps: when you request our services, we process your personal data to assess your eligibility, prepare a case pack, and introduce you to selected brokers and lenders. Without these data, we cannot perform our services.
Legitimate interests: we process certain data for our legitimate interests, including running our business, maintaining records, improving our services, responding to enquiries, preventing fraud, ensuring network and information security, and defending legal claims. We only rely on this basis after assessing that our interests do not override your fundamental rights and freedoms.
Consent: we rely on your consent for specific purposes, such as sending marketing communications, contacting you via WhatsApp, and sharing optional data. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Legal obligations: we may need to process your data to comply with legal and regulatory obligations, such as anti‑money‑laundering and know‑your‑customer requirements, tax and accounting laws, and to respond to lawful requests from public authorities.
6. How we use your data
We use your personal data for the following purposes:
Providing our introducer service: to evaluate your information, determine whether you may qualify for a mortgage, create a case pack, and introduce you to appropriate brokers and lenders.
Communicating with you: to send you updates about your case, scheduling information, and respond to your queries via WhatsApp, phone or email. You can block us on WhatsApp at any time.
Sharing with partners: to share your case information and documents with selected specialist brokers and lenders to obtain preliminary decisions and, if you proceed, to prepare formal applications. These partners will contact you directly to complete full know‑your‑customer and credit checks.
Operations and analytics: to use aggregated, anonymised data to understand how our website is used and improve our products. Our analytics do not collect personal data and use hashed IP addresses that reset daily.
Marketing and promotions: with your consent, to send marketing messages about our services and partner offers by WhatsApp or email. You can opt out at any time.
Legal and regulatory compliance: to comply with know‑your‑customer, anti‑money‑laundering, tax, accounting and other legal requirements, and to respond to lawful requests from public authorities or courts.
Security, fraud prevention and risk management: to verify your identity, prevent fraud and protect our systems.
7. Sharing your data
We may share your data in the following circumstances:
Selected mortgage brokers and lenders: after we assess your information, we will introduce you to one or more specialist brokers and lenders who will continue the mortgage process. They act as independent controllers of your data and have their own privacy obligations.
Service providers: we use trusted third‑party service providers to operate and manage our website, communications, scheduling, analytics, document storage, payment processing, and customer support. These providers act as processors, meaning they process personal data on our behalf under binding contracts that require them to protect your data, not to use it for their own purposes, and to process it only according to our instructions.
Professional advisers and regulators: we may share your data with professional advisers (lawyers, auditors, bankers and insurers) and with tax authorities or regulators when required by law.
Business transfers: if we undergo a merger, acquisition, or sale of assets, your data may be transferred to the successor entity subject to this Policy.
We do not sell your personal data.
8. International data transfers
Some of our service providers may be located outside the European Economic Area (EEA). To ensure that any international data transfers are lawful, we use appropriate safeguards such as standard contractual clauses approved by the European Commission. These model clauses provide a lawful basis for data transfers from the EU to third countries. We may also rely on adequacy decisions recognised by the European Commission. Copies of the relevant safeguards can be provided on request.
9. Cookies and similar technologies
Our website uses only essential cookies necessary to operate the site. Our analytics are cookieless: IP addresses and user agents are hashed with a daily rotating secret to count unique visitors and page views, and no personal data is stored. We do not use cookies for analytics. If we integrate additional services that place non‑essential cookies on your device, we will display a cookie banner and ask for your consent before such cookies are set. Our cookie banner will allow you to accept or reject different categories of cookies and will link to a detailed Cookie Policy.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encryption of data in transit and at rest, access controls, secure storage of documents, pseudonymisation, and staff training. We regularly review our security protocols to ensure they remain adequate. Despite our efforts, no security measures are perfect; if we become aware of a personal data breach, we will notify you and the appropriate authorities as required by law.
11. Data retention
We retain your personal data only for as long as necessary for the purposes set out in this Policy. Our standard retention periods are:
Enquiries that do not progress to a case: we keep your basic contact details and enquiry information for up to (e.g., 12 months) from the date of your last contact, in case you decide to proceed in future.
Active cases: we keep case files and supporting documents while your application is in progress and for (e.g., 6 years) after completion or cancellation, to comply with legal and regulatory requirements (such as anti‑money‑laundering and tax laws) and to respond to any queries or claims.
Marketing consent: we retain your marketing preferences until you withdraw your consent or until (e.g., 24 months) after your last interaction with us.
Analytics: technical data collected by our analytics is anonymised and resets every day.
We may need to keep data longer if required by law or to defend legal claims. When your data are no longer needed, we will securely delete or anonymise them.
12. Your rights
Under the GDPR and applicable data‑protection laws, you have the following rights (subject to conditions and exceptions):
Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of such data.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data (the “right to be forgotten”), for example when the data are no longer needed or if you withdraw consent.
Right to restriction of processing: to request that we stop using your data while we assess a request to rectify or erase it, or to object.
Right to data portability: to receive your data in a structured, commonly used format or to have it transferred to another controller.
Right to object: to object to the processing of your data based on legitimate interests or for direct marketing.
Right to withdraw consent: to withdraw your consent at any time where processing is based on consent (e.g., marketing or WhatsApp communications). Withdrawal does not affect the lawfulness of processing before withdrawal.
If you wish to exercise any of these rights, please contact us at (privacy email address). We may need to verify your identity before responding. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) or your local supervisory authority.
13. WhatsApp communications
If you choose to contact us via WhatsApp, please be aware of the following:
Opt‑in and opt‑out: we will only message you on WhatsApp if you opt in (for example by entering your WhatsApp number or clicking our WhatsApp link). You can opt out by replying “STOP” or by blocking our number at any time.
End‑to‑end encryption: WhatsApp uses end‑to‑end encryption for messages and calls, meaning that message content is protected from the moment it leaves your device until it reaches ours. Message content is not shared with Meta.
Business communications: WhatsApp will make it clear when you are chatting with a business. We do not sell your WhatsApp messages to third parties. If we use advertising services, limited information (such as the fact that you started a chat) may be shared to manage ad preferences.
Privacy settings: you can review and adjust your ad settings through your Meta account or via the Digital Advertising Alliance’s tools if you do not want your activity to be used for personalised advertising.
14. Children’s privacy
Our services are directed at adults. We do not knowingly collect data from individuals under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data can contact us to request removal.
15. Third‑party websites and social media
Our website may contain links to third‑party sites (such as brokers, calculators, or external resources) and to social‑media platforms (such as YouTube, Facebook, and Instagram). Clicking on those links may allow third parties to collect or share data about you. We do not control these third‑party sites and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.
16. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our data‑processing practices. If we make significant changes, we will notify you via our website or by email. The date of the latest revision will be indicated at the top. We encourage you to review this page regularly.
17. How to contact us
If you have questions or concerns about this Privacy Policy or our data practices, or if you want to exercise your rights, please contact us at:
Email: (privacy email address) – primary contact for data requests and complaints.
Postal address: (legal address)
WhatsApp: (WhatsApp number) – for general enquiries (not for exercising rights).
You also have the right to file a complaint with the Agencia Española de Protección de Datos (AEPD) or your local data‑protection authority.
Last updated: 06 November 2025