PRIVACY AND COOKIE POLICY

Last updated: 10 June 2026
Turtle Mortgages Ltd (“we”, “us”, “our”) understands that your privacy matters and that you care about how your personal data is used and protected. This policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to our website at https://www.turtlemortgages.co.uk and to the mortgage and protection services we provide.
Please read it carefully. If you have any questions, contact us using the details in section 17.

1. Who we are and how to contact us
Turtle Mortgages Ltd is the data controller responsible for your personal data. This means we decide how and why your personal data is processed.
Company name: Turtle Mortgages Ltd
Registered in: England and Wales
Company number: 15804362
Registered office: 1 Allied Business Centre, Coldharbour Lane, Harpenden, AL5 4UT
Email: hello@turtlemortgages.co.uk
Telephone: 01582 292391
Turtle Mortgages Ltd is an Appointed Representative of The Right Mortgage Network Ltd, which is authorised and regulated by the Financial Conduct Authority (FCA).

Our FCA reference number: 1017264
Our ICO registration number: ZB719652

We are a small firm. We are not legally required to appoint a Data Protection Officer and have not appointed one. Any questions or requests about your personal data should be sent to us using the contact details above.

We work with our principal, The Right Mortgage Network Ltd, which is authorised and regulated by the FCA. Depending on the service you receive, The Right Mortgage Network Ltd may also handle your personal data in connection with the advice given and the products arranged through us. If you would like more detail about how this arrangement works, please contact us and we will explain it.

2. What this policy covers
This policy covers personal data we collect when you:
– Visit or interact with our website
– Make an enquiry or request a call back
– Sign up to our newsletter
– Become a client and receive mortgage or protection advice from us
Our website may contain links to other websites. We have no control over how those websites collect or use your data, so please check their own privacy policies before sharing any data with them.

3. The personal data we collect
Depending on how you use our services, we may collect and process the following:
Identity details: your name, date of birth, nationality, marital or relationship status, and details of dependants
Contact details: email address, telephone number, and current and previous home addresses
Financial details: income, employment details, regular outgoings, assets, debts and other liabilities, bank account details, and credit history
Property details: information about the property you are buying, remortgaging, or protecting
Verification data: identity and anti-money-laundering documents (for example, passport, driving licence, and proof of address)
Website and technical data: your IP address, browser type and version, device type, operating system, and information about how you use our website (collected through cookies and similar technologies, see section 14)
We also collect certain “special category” and criminal offence data, which is explained separately in section 4.

4. Special category and criminal offence data
Some of the data we handle needs extra protection under data protection law. We only collect it where it is necessary to advise you properly, and we apply additional safeguards.
Health information: we may collect information about your health when arranging protection or insurance products (for example, to help identify suitable cover). Our condition for processing this is normally your explicit consent.
Criminal conviction information: where it is relevant to a mortgage or protection application, or to meet our legal and regulatory obligations, we may process information about criminal convictions or offences.
Customer vulnerability information: we may record information indicating that you are, or may be, in a vulnerable situation. We do this to meet our FCA obligation to treat customers fairly and to make sure we give you appropriate support.


5. Where we get your data from
We collect most of your personal data directly from you, for example when you complete a form on our website, speak to us by phone or email, or provide information during a fact-find or application.
We also receive personal data about you from third parties, including:
introducers and professional contacts, such as estate agents
lead-generation or comparison websites
lenders, product providers, and insurers during the application process
credit reference agencies and fraud prevention agencies
Where we obtain your data from a third party, we will use it in line with this policy.

6. How and why we use your data, and our lawful bases
Data protection law requires us to have a “lawful basis” for using your personal data. The table below sets out what we use your data for and the lawful basis we rely on for each purpose.

What we use your data for
– Lawful basis
– Responding to your enquiries and requests
– Taking steps at your request before entering into a contract; our legitimate interests (see section 7)
– Providing mortgage and protection advice and arranging products for you
– Taking steps at your request before entering into a contract, and performing our services; our legitimate interests
– Carrying out identity and anti-money-laundering checks
– Compliance with a legal obligation (the Money Laundering Regulations 2017)
– Keeping records and meeting our regulatory obligations to the FCA and our network
– Compliance with a legal obligation; our legitimate interests
– Preventing and detecting fraud and financial crime
– Compliance with a legal obligation; our legitimate interests
– Sending you marketing emails and our newsletter
– Your consent
– Understanding how our website is used through analytics
– Your consent (for non-essential cookies); our legitimate interests
– Handling complaints
– Compliance with a legal obligation; our legitimate interests
Providing some of your personal data is necessary for us to give you advice and arrange products. If you choose not to provide it, we may not be able to act for you.

7. Our legitimate interests explained
Where we rely on legitimate interests, this means we use your data because doing so is reasonable, you would expect it, and it does not override your rights and freedoms. Our legitimate interests include:
– Running and improving our business and website
– Responding to and managing enquiries
– Providing a good standard of advice and service to our clients
– Keeping our own and our clients’ information secure
– Preventing fraud and protecting our business and our clients
meeting expectations placed on us by our network and the wider regulatory framework

Before relying on legitimate interests, we consider the impact on you and your rights. You can object to this processing at any time (see section 13).

8. Marketing
With your consent, we may contact you by email with news, updates, and offers about our services. Every marketing email includes an unsubscribe link, and you can opt out at any time by clicking it or by emailing hello@turtlemortgages.co.uk.
You have an absolute right to ask us to stop sending you direct marketing. We will act on any such request promptly. Withdrawing your consent will not affect any processing we carried out before you withdrew it.
We will not send you unsolicited marketing, and we handle all marketing in line with the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR).

9. Who we share your data with
We do not sell your personal data. We share it only where necessary to provide our services, meet our legal and regulatory obligations, or run our business. We may share your data with:
–Llenders and mortgage product providers, to arrange your mortgage
– Insurers and protection product providers, to arrange your cover
– Conveyancers and solicitors, where relevant to your transaction
– The Right Mortgage Network Ltd, our principal, in connection with the advice and products arranged through us
– Credit reference agencies and fraud prevention agencies
– Our software and service suppliers, who process data on our behalf under contract, including:

– Our customer relationship management (CRM) system: ACRE
– Our automation tool: Zapier
– Our website hosting and IT suppliers: WordPress, Calendly & Hiyield
– Regulators and public authorities, including the FCA, the Information Commissioner’s Office (ICO), and HMRC, where we are required to do so
– Professional advisers, such as our accountants and auditors
Where suppliers process data on our behalf, we put contracts in place that require them to protect your data and use it only on our instructions.

10. Sending data outside the UK
Some of the providers we use store or process data outside the UK, including in the United States.
Where we transfer your personal data outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law. Depending on the provider, this will be one of the following:
a transfer to a country the UK government has decided provides an adequate level of protection
the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s Standard Contractual Clauses
a transfer to a US organisation certified under the UK Extension to the EU-US Data Privacy Framework
You can ask us for more information about these safeguards, including a copy where available, using the contact details in section 17.

11. How long we keep your data
We keep your personal data only for as long as we need it for the purposes set out in this policy, and to meet our legal and regulatory obligations. Our retention periods are:
Type of record
How long we keep it
Client advice files (mortgage and protection)
Typically at least 6 years after our relationship with you ends
Anti-money-laundering and identity records
Typically at least 6 years after our relationship with you ends

Complaint records
Typically 3 years from resolution of the complaint
Marketing records
Until you withdraw your consent or ask us to stop

When we no longer need your data, we securely delete or anonymise it.

12. How we keep your data secure
We take the security of your data seriously and use appropriate technical and organisational measures to protect it, including access controls, secure storage, and staff awareness. We also carry out checks on the suppliers who handle data on our behalf.
No transmission of data over the internet can be guaranteed as completely secure, but we take reasonable steps to protect your personal data and to reduce the risk of loss, misuse, or unauthorised access.

13. Your rights
Under the UK GDPR, you have the following rights:
The right to be informed about how we use your personal data (this policy)
The right of access to the personal data we hold about you
The right to rectification if any data we hold about you is inaccurate or incomplete
The right to erasure (to ask us to delete your data), subject to our legal and regulatory obligations to keep certain records
The right to restrict processing of your data in certain circumstances
The right to data portability, to obtain and reuse your data
The right to object to processing based on our legitimate interests, and an absolute right to object to direct marketing
The right to withdraw consent at any time, where we rely on your consent (this does not affect processing we carried out before you withdrew it)
Rights relating to automated decision-making. We do not make any decisions about you using solely automated means. Advice is given and decisions are made by a human adviser.
To exercise any of these rights, contact us using the details in section 17. We will respond within one month. There is normally no charge.
You also have the right to complain to the ICO (see section 17).

14. Cookies and similar technologies
Our website uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit a website.
We use cookies in line with PECR and the UK GDPR. We set non-essential cookies (such as analytics and marketing cookies) only after you have given your consent through our cookie banner. Strictly necessary cookies, which are required for the website to work, do not need your consent. We do not treat continued use of the site as consent.
You can accept or reject non-essential cookies when you first visit, and you can change your choice at any time using the “Change Cookie Preferences” link on our website. You can also control cookies through your browser settings, although blocking some cookies may affect how the site works.

15. Children’s information

Our website and services are intended for adults aged 18 and over. We do not market to, or provide our services directly to, children.

We do collect a limited amount of personal data about children when you provide it to us as part of your mortgage or protection advice, normally the names and dates of birth of your dependants. We collect this because lenders take dependants into account when assessing how much you can afford to borrow, and because it helps us recommend suitable protection cover for your family.

This information is given to us by you, as the parent or guardian, rather than by the child. We rely on our legitimate interests, and yours, in giving you accurate advice and arranging suitable products, and we only collect what we need for those purposes. We hold this information securely, keep it as part of your client file for the retention periods set out in section 11, and do not use it for any other purpose.

If you have any questions about the information we hold about your dependants, or you want it corrected or removed, please contact us using the details in section 17.

16. Changes to this policy
We may update this policy from time to time. When we do, we will change the “last updated” date at the top. Significant changes will be brought to your attention where appropriate. Please check this page periodically.

17. How to contact us and how to complain
For any question or request about your personal data, or to exercise your rights, contact us:
Email: hello@turtlemortgages.co.uk
Telephone: 01582 292391
Post: Turtle Mortgages Ltd, 1 Allied Business Centre, Coldharbour Lane, Harpenden, AL5 4UT
If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: https://ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF