Privacy Notice

Quantum Mortgages Privacy Notice

Policy update 09.10.2025 v8.0

Who we are

We are Quantum Mortgages Limited, and we understand the importance of data security and privacy for all data subjects with whom engage with including mortgage intermediaries, customers and partners. We comply with the requirements of UK GDPR (“General Data Protection Regulation”) and Data Protection Act 2018. GDPR is an EU legal requirement which has been implemented into the UK due to Brexit in what is now known as UK GDPR.

Details of Quantum Mortgages notification to the data protection supervisory authority may be found in the Information Commissioner’s Office Public Register of Data Controllers at www.ico.org.uk under registration number ZB279980.

Introduction

At Quantum Mortgages we are committed to protecting and respecting your privacy, being completely open and transparent in the way we collect or obtain your personal information and how we treat that information.

For the purposes of applicable data protection legislation, we are a data controller in respect of the information that we collect or obtain about you. This is because we determine why and how your personal information is processed.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering, and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies can be found here www.cifas.org.uk/fpn, and your data protection rights, can be found in this policy.

If you have any queries relating to our use of your personal information or any other related data protection questions, please contact us by writing to:

Data Protection Officer
Quantum Mortgages Limited
P.O.BOX 1043
Ipswich
Suffolk
IP1 9XZ

By email: complianceandrisk@quantummortgages.co.uk 

Or by telephone 01908 909650

Types of Personal Data we Collect

We collect personal information from you, your mortgage intermediary, and other third parties such as your employer, landlord, other lenders and financial institutions, HM Revenue and Customs (“HMRC”), and the Department for Work and Pensions (“DWP”). This may occur when you apply for a Decision in Principle or submit a full mortgage application, or when you or a third party acting on your behalf contacts us regarding an existing account.

We may also use publicly available sources such as directories, social media platforms, internet searches, and news articles to gather relevant information.

The personal data we collect or receive may include:

  • Name
  • Date of birth
  • Biometric data (if used for identification purposes)
  • Residential address and address history
  • Contact details (e.g., email address and telephone numbers)
  • Financial information
  • Employment details
  • Details of your physical and mental health (special category data)
  • Identifiers assigned to your computer or internet-connected device, including your Internet Protocol (“IP”) address
  • Information about the conduct of any existing or previous accounts or applications with us
  • Financial associate’s accounts (anyone financially linked to you)
  • Business account details (if you are an owner, director, or partner in a business)

If you provide us with false or inaccurate information and we suspect or identify fraud we will record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention.

When you visit our website, we will use cookies to distinguish you from other users to help us provide you with a good experience when you browse our website and to help us improve our site. To find out more about our use of cookies, please read our cookie policy available from our website: www.quantummortgages.co.uk/cookie-policy/

Lawful Basis for Processing your Personal Data 

Under data protection laws, we must have a lawful basis to collect, use, and share your personal data. At least one of the following legal grounds must apply:

  • Contractual or legal duty – where processing is necessary to fulfil our contract with you or to comply with a legal obligation.
  • Legitimate interest – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and interests.
  • Public interest – where processing is necessary for tasks carried out in the public interest or in the exercise of official authority.
  • Vital individual interest – where processing is necessary to protect someone’s life.
  • Consent – where you have given clear permission for us to process your personal data for a specific purpose.

In this section we explain which one we rely on to use your data in a certain way.

Use of Personal Data for Contractual Purposes

We use your personal data where it is necessary to enter into or perform a contract with you. This includes:

  • Assessing and processing your application.
  • Providing the services we have agreed to, in line with our terms and conditions.
  • Communicating with you about your account and the services you use, including responding to enquiries or notifying you of important updates.
  • Exercising our rights under any contract with you, including managing your account and recovering any outstanding payments.
  • Investigating and resolving complaints or other issues related to your account or our services.

Use of Personal Data to Comply with Legal Obligations

We process your personal data where it is necessary to comply with legal and regulatory requirements. This includes:

  • Confirming your identity when you apply for a mortgage.
  • Checking your records with fraud prevention agencies.
  • Preventing illegal activities such as money laundering, tax evasion, and fraud.
  • Reviewing your credit history and understanding your financial circumstances to support responsible lending decisions.
  • Maintaining records in accordance with legal and regulatory obligations.
  • Sharing customer information with regulators, tax authorities, law enforcement agencies, or other third parties when required by law.
  • Verifying your tax residency information to ensure accuracy and compliance.

When we ask for your Consent

We’ll ask for your consent to:

  • Record any issues you want us to know about so we understand how to best support you (if the information is sensitive, we need a second lawful basis, see ‘Our reasons for using special category information’ below).
  • Share information about you with companies we work with when we need your permission (see ‘Other parties with whom we may share your details with’).

You don’t have to share information about yourself. But if you don’t, you may not be able to use some, or any, of our services.

Our Reasons for Using Special Category Information

In certain circumstances, we may need to process sensitive personal data, known under data protection laws as special category data. This includes information that may reveal:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Genetic or biometric data (used for identification purposes)
  • Health-related information
  • Sex life or sexual orientation
  • Physical or mental health conditions

Under data protection legislation, we must have an additional lawful basis to process this type of data. Depending on the context, we may rely on one or more of the following:

  • Explicit consent from you
  • Protecting your vital interests, where you are unable to give consent
  • Establishing, exercising, or defending legal claims
  • Substantial public interest, as defined by law
  • Compliance with employment or social protection law, where applicable

We will only process special category data where it is necessary and where appropriate safeguards are in place to protect your rights and freedoms.

In this section we explain which lawful basis we rely on to use your special category data in a certain way.

It’s Necessary for Reasons of Substantial Public Interest

  • We use facial recognition technology to identify people who use our mortgage services. We do this because it’s necessary for reasons of substantial public interest to prevent or detect unlawful acts.

It’s Necessary for the Purpose of Meeting Regulatory Requirements Relating to Unlawful Acts and Dishonesty etc.,

We obtain necessary health information only where absolutely necessary for the purposes of meeting regulatory requirements relating to unlawful acts and dishonesty etc.

Data We Receive From, and Share with Third Parties

In order to process your application, we will also perform credit and/or identity checks on you with one or more credit reference agency (“CRAs”). When you have a mortgage with us we may also make periodic searches at CRAs to manage your account.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

How We Use This Data

The information we collect and share will help us to:

  • Assess this and further applications from you or other members of your household for this and other products and services and to make decisions about any such application(s), agreement or correspondence which you may have with us.
  • Make lending decisions, to process mortgage applications, to obtain references and to administer mortgage accounts. This type of processing is necessary for the performance of our contract with you and in order to fulfil our legal obligations.
  • Provide the services requested and manage the relationship between us.
  • Prevent, detect, prosecute or mitigate the consequences of fraud and money laundering or other crimes, trace debt and recover debt and comply with applicable law and regulations.
  • Verify the accuracy of the data you have provided to us.
  • Process, obtain and check other information, manage your account and administer any product or services that we provide you with or at your request.
  • Perform obligations or exercise rights that we may have under any agreement with you.
  • Trace and recover debts.
  • Undertake market research, statistical and business analysis and create and maintain a customer profile.
  • contact HM Revenue and Customs, Department for Work and Pensions, any lender, landlord, employer or professional adviser named on an application, to obtain information or confirm any income received, outstanding liabilities and payments made.
  • When we and the third parties we may share your data with, process this data, we do so on the basis that it is necessary for us to enter into or manage a contract with you. We also have a legitimate interest in preventing fraud and money laundering, and to verify identity in order to protect our business and to comply with laws that apply to us. This type of processing is necessary for our legitimate interests (ie the prevention of fraud and money laundering) and compliance with our legal obligations.

Data and Security

As part of our data security, we will look to protect the rights, property or safety of us, our customers or others. We carry out security and maintenance checks to ensure the website and other services provided for you are secure to protect your data.

Our data centres are secure and located in the UK/Europe with very limited personnel access. Any data will be encrypted at rest (i.e., where your data is stored).

Unfortunately, the transmission of your information via the internet can never be 100% secure. Although we will do our best to protect your information, we cannot guarantee the security of information about you transmitted to us, and so any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Information about your visit to our website may include:

  • The full Uniform Resource Locator (URL) clickstream to, through, and from our websites (including date and time).
  • Products you viewed or searched for.
  • Page response times, download errors, and length of visits to certain pages.
  • Page interaction details, such as scrolling, clicks, and mouse-overs.
  • Methods used to navigate away from pages.

Our websites may also use cookies (please refer to our Cookie Policy for detailed information on this: https://quantummortgages.co.uk/cookies/).

Credit Reference Agencies and Our Use of Them

When CRAs receive a search from us they will place a hard “footprint” on your credit file whether or not this application proceeds. If the search was for a credit application the record of that search (but not the name of the organisation that carried it out) may be seen by other organisations when you apply for credit in the future.

The CRA will link together the records of you and anyone that you have advised is your financial associate including previous and subsequent names of parties to the account. Links between financial associates will remain on yours and their files until such time as you or your partner successfully files for a disassociation with the credit reference agencies.

Your data may also be used by us or other third parties to offer you other products, but only if you have given your prior consent.

The identities of the CRAs, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (“CRAIN”). You can obtain this from each of the three CRAs using the links below:

www.experian.co.uk/crain

We will continue to exchange information about you with CRAs and Fraud Prevention Agencies, (if we determine that you pose a fraud or money laundering risk) while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

If you are making an application with two or more applicants or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them and share with them this information, before lodging the application.

Other Third Parties with Whom We May Share Your Data

We may also disclose your personal information to:

  • External Auditors, regulatory bodies, and relevant authorities or bodies who have a legal right to access the information or whom you authorise us to disclose it – including the Financial Ombudsman Service (“FOS”), and our funding partners.
  • Our Insurers.
  • Intermediaries or specialist distributers, including mortgage clubs who submit applications to us or who you appoint in connection with any application to us.
  • Agents or third-party contractors appointed to administer or operate your account, including any party who may take over the administration of your account.
  • Solicitors and valuers acting on our behalf.
  • Field agents and tracing agents.
  • HM Revenue and Customs (“HMRC”) and the Department for Work and Pensions (“DWP”).
  • The Insolvency Service and insolvency practitioners instructed by you.
  • Providers of information technology and communication services.
  • Data processors acting on our behalf or on behalf of any person who may be the beneficial owner of your loan.
  • Market research organisations, for the purpose of conducting confidential market research on our behalf.
  • Law enforcement agencies, where necessary, to detect, investigate, and prevent crime.

Sending Data Outside of the United Kingdom (“UK”) and European Economic Area (“EEA”)

Quantum Mortgages Limited does not routinely transfer your personal information outside of the UK or the European Economic Area (“EEA”). However, some of the third parties listed above may do so when carrying out tasks necessary for the performance of our contract with you. In certain cases, we may also be required to send data to organisations outside the UK and EEA to obtain information about you.

Where such transfers are necessary, we will either:

  • Notify you in advance,
  • Put appropriate contractual safeguards in place, or
  • Rely on an adequacy decision recognised by the UK government, confirming that the receiving organisation ensures a level of data protection equivalent to that required in the UK.

These measures are designed to ensure your personal data remains protected and secure.

How Long We Will Keep Your Personal Data

For all data subjects we will retain your data in line with our record retention requirements and applicable laws. As a customer we will keep your data for as long as you are our customer, and for up to 6 years after you are no longer a customer.

If you have applied for a mortgage with us or have had a mortgage with us in the past we may keep your data for up to 6 years.

We retain your personal data to:

  • Respond to any questions or complaints.
  • Demonstrate that we have treated you fairly.
  • Maintain records in accordance with applicable regulations.

In certain circumstances we may need to keep your data for longer than this, for example, where legal, regulatory or technical reasons require it. If this is the case, we will ensure your privacy is protected and that your data is only used for legitimate purposes.

Fraud prevention agencies may retain your personal data for varying periods. If you are identified as posing a fraud or money laundering risk, your data may be held for up to six years.

Automated Decision Making or Profiling and The Use of Artificial Intelligence

We may use automated systems to assist in decision-making based on the personal data we hold about you or your business. This helps us make quicker, fairer, and more consistent decisions, including determining which products or services we can offer you.

In some cases, automated processing may identify a potential fraud or money laundering risk. This could occur if your behaviour matches patterns associated with known fraudulent activity, differs significantly from previous submissions, or appears to conceal your true identity.

Quantum Mortgages Limited does not currently use artificial intelligence (“AI”) or machine learning technologies to make decisions. All automated decisions are based on rule-based systems and predefined criteria, not AI-driven models.

You have the right to request that decisions are not made solely by automated means. If you are unhappy with an automated decision, you can ask for it to be reviewed by a person. To do so, please contact your Mortgage Intermediary in the first instance.

Other Consequences of Data Processing

If we, or one of the third parties we share data with, identify that you pose a fraud or money laundering risk, we may refuse to provide the services, goods or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies and may result in others refusing to provide services or financing to you. If you have any questions about this, please contact us using the details at the start of this notice.

Information for Intermediaries

By registering with us to submit client applications and use our mortgage portal, we will process your personal information and other relevant data to:

  • Manage our relationship with you.
  • Prevent and detect fraud.
  • Comply with legal and regulatory requirements.
  • Conduct market research.

We may share your personal information with third parties who process data on our behalf, including:

  • Marketing agencies.
  • Consumer review services.
  • Third-party IT providers.

By registering a case with us, you (the intermediary) confirm that you have obtained the applicant’s consent to share their personal information with us, including any sensitive personal data.

You must ensure that:

  • You understand how we use the applicant’s personal information.
  • The information you provide as part of the application is accurate and complete.

Your Rights

You have the right to:

  • Access the personal data we hold about you or request a copy of it.
  • Request a copy of your personal data in a portable (machine-readable) format, or ask us to send it to someone else.
  • Ask us to correct inaccurate data.
  • Request that we delete, block, or suppress your data (subject to legal limitations).
  • Object to the use of your data for direct marketing or in certain legitimate interest scenarios.
  • Withdraw any consent you’ve previously given.
  • Request a review of any automated decision made by a computer.

To exercise any of these rights, please contact us at: complianceandrisk@quantummortgages.co.uk

If you have questions about this notice or suggestions for improvement, please contact us at the same email address. Our Data Protection Officer can also be reached via this address for any data protection-related queries.

What to Do If You Have Concerns or Want to Make a Complaint

If you have any concerns regarding our use of your information, please notify our as soon as possible using the contact information set-out in the ‘Introduction’ section of this privacy notice. If we cannot resolve a complaint to your satisfaction, you can contact the Information Commissioner’s Office at www.ico.org.uk or contact 01908 909 650 if the complaint relates to the way your personal information has been handled.

Review of This Policy

We keep this policy under review. This policy is v8.0 and was last updated on the 09.10.2025.

Chat Now