Where you contact the Society to enquire about our products or rates, we will act as the data controller for your personal information. We will process your information for as long as you wish to receive this information from us.

Responsibilities for protecting a mortgage applicant’s personal information change through the application and lending process:

Once an applicant contacts you to find a suitable mortgage product, you act as the data controller for the applicant’s personal information.

When you send the applicant’s personal information to us as part of an enquiry about our mortgage products, we will act as the data processor on your behalf.

However, once we send the applicant an Offer in Principle, we become the data controller of the applicant’s personal information. For any personal information subsequently sent to us through you, you will act as the data processor.

Once we advance the mortgage funds, and you have been paid your commission, the applicant’s personal information will no longer be sent through you but will be sent directly to us. We will remain the data controller for the period of the mortgage contract.

Data protection laws require us to explain what legal grounds justify our processing of personal information, including sharing it with other organisations.  More than one legal ground may be relevant for some processing, except where we rely on consent.   The legal grounds that are relevant to us are:

• Fulfilling our agreement with you and with applicants
• Complying with the law
• Achieving our legitimate interests as a building society, and
• Supporting the public interest or protecting your vital interests.

We are based in the UK but sometimes your personal information may be transferred outside the UK or the European Economic Area (EEA). If it is processed within the EEA then it is protected by European data protection standards.  Some countries outside the EEA have equivalent protections for personal information and so we are allowed to transfer personal information to companies based in these countries.

We may monitor your use of our website where permitted to do so by law and where the law requires it.  In addition, we will record certain telephone lines or in person meetings where we are required to by the Financial Conduct Authority.

We may use your personal information to profile your activity and may use an applicant’s personal information to profile their financial situation. We may do this lawfully to help us fulfil our contracts, or for legal or regulatory purposes, or for our legitimate interests as an organisation.

You and applicants have a series of rights over how your personal information is processed and have the right to exercise these rights at any time:

• To be informed
• To request access
• To object to processing
• To restrict processing
• To have personal information ‘erased’, and
• To obtain a copy of one’s personal information.