This page explains how the UK General Data Protection Regulation and the Data Protection Act 2018 apply to personal data held by Tomohard ltd, trading as Tomohard. It sits alongside our Privacy Policy, which describes the data we collect, why we use it, and who we share it with.
1. What the UK GDPR requires of us
The UK GDPR is the United Kingdom’s data protection law for personal data. Personal data is information that relates to an identified or identifiable living person. The Data Protection Act 2018 sets extra UK rules, including conditions for using special category data and exemptions from certain rights.
Tomohard ltd is the controller of the personal data described in the Privacy Policy. Staff and suppliers who handle that data on our instructions do so as processors, or as separate controllers where the law gives them their own responsibility, for example a lender assessing an application.
Tomohard ltd, trading as Tomohard.
Email: info@tomohard.com
2. Data protection principles
Article 5 of the UK GDPR requires us to handle personal data according to these principles. We apply them as follows.
| Principle | How we apply it |
|---|---|
| Lawfulness, fairness and transparency | We use a recognised lawful basis, we avoid surprising uses, and we explain our processing in the Privacy Policy and in client documents. |
| Purpose limitation | We collect data for stated purposes, such as answering an enquiry, giving advice, arranging a product, or meeting a legal duty. We do not later use it for an incompatible purpose. |
| Data minimisation | The website form asks only for the details we need to contact you. We ask for financial, property and identity information when a case actually requires it. |
| Accuracy | We rely on you to give accurate information and to tell us if it changes. You can ask us to correct data we hold. |
| Storage limitation | We keep data for the periods in the Privacy Policy, then delete it or anonymise it. |
| Integrity and confidentiality | We limit access to people who need it and use appropriate security for the systems that store enquiries and client files. |
| Accountability | We are responsible for showing that we comply. We keep a record of our processing, use written terms with processors, and review high-risk processing before it starts. |
3. Lawful bases in more detail
Article 6 allows processing only where at least one of these applies. The bases we use are:
Consent
Consent must be a freely given, specific, informed and unambiguous indication of your wishes. The statement under the enquiry form is your consent for us to contact you about the requirement you submit. Where we need health information for insurance, we will ask for a separate explicit consent if that is the Article 9 condition we rely on. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal, and it does not require us to delete records we must keep by law.
Contract, and steps before a contract
We use this basis when you ask us to look at your circumstances, to arrange an appointment, or to submit an application. We cannot provide that service without the relevant personal data.
Legal obligation
We use this basis where the law or a regulator requires a record or a check. Examples include identity checks under the money-laundering regulations, retaining evidence of regulated advice, and responding to a lawful request from the Financial Conduct Authority, the Financial Ombudsman Service, HMRC, a court, or law enforcement.
Legitimate interests
We use this basis for limited website operation, securing our systems, establishing or defending a legal claim, and keeping our business records in good order where a stricter basis does not already apply. We only rely on it after considering whether your interests or rights override ours. You can object, and we will stop unless we can show compelling grounds that override your interests, or we need the data for a legal claim.
We do not use personal data on this website for solely automated decisions that have a legal or similarly significant effect on you.
4. Special category data
Special category data includes health, racial or ethnic origin, biometric data used for identification, and information about sexual life or orientation. Criminal-offence data is subject to similar extra rules under the Data Protection Act 2018.
A mortgage or protection case can involve health information, for example where income protection, life cover, or a lending decision depends on it. We collect that information only when the product requires it. In addition to an Article 6 basis, we rely on one of these Article 9 conditions:
- your explicit consent; or
- the insurance condition in the Data Protection Act 2018, where the processing is necessary for an insurance purpose and it would not be reasonable to rely only on consent.
We do not ask for special category data on the public enquiry form.
5. Your rights
The rights below are personal to you. They are not absolute. We will tell you if an exemption applies, unless telling you would undermine the exemption.
Right to be informed
You have the right to clear information about how we use personal data. This page and the Privacy Policy are how we provide it for the website. If you become a client, we also give you the disclosures required for the advice or product.
Right of access
You can ask for confirmation that we process your personal data, for a copy of it, and for the information listed in Article 15, including the purposes, the categories of data, the recipients, the retention period, and the existence of your other rights. We may redact information that identifies another person, or that is legally privileged, before we send the copy.
Right to rectification
You can ask us to correct inaccurate personal data and to complete data that is incomplete. Please tell us what is wrong and, where you can, what the accurate information is. If we have shared the data with a lender or insurer, we will take reasonable steps to tell them about the correction where that is still relevant.
Right to erasure
You can ask us to delete personal data where it is no longer needed, where you withdraw consent and we have no other basis, where you object and we have no overriding ground, or where we have processed it unlawfully. We can refuse erasure where we must keep the data to comply with a legal obligation, to evidence regulated advice, or to establish, exercise or defend a legal claim.
Right to restriction
You can ask us to restrict processing while we check accuracy, where the processing is unlawful but you prefer restriction to deletion, where we no longer need the data but you need it for a legal claim, or while we consider an objection. Restricted data is stored and used only with your consent, for a legal claim, to protect another person’s rights, or for important public-interest reasons.
Right to data portability
Where processing is based on consent or on a contract, and is carried out by automated means, you can ask for the personal data you provided to us in a structured, commonly used, machine-readable format, and you can ask us to transmit it to another controller where that is technically feasible. This right does not cover data we created ourselves, such as an adviser’s notes, and it does not apply to processing based only on a legal obligation or on legitimate interests.
Right to object
You can object at any time to processing based on legitimate interests, on grounds relating to your particular situation. You can also object to direct marketing at any time, including profiling related to that marketing. We will stop marketing when you object. For other objections we will stop unless we demonstrate compelling legitimate grounds, or we need the data for a legal claim.
Rights related to automated decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces a legal effect or a similarly significant effect, unless a UK GDPR exception applies. We do not make that kind of decision on this website. If a lender does so on an application, you can ask the lender for human intervention, to express your point of view, and to contest the decision.
6. How to make a request
Contact us using the details in section 1. Please include:
- your full name and the email address or phone number you used with us;
- the right you want to use, and enough detail for us to find the data;
- for a correction, the accurate information; and
- a copy of identification if we ask for it, so we do not disclose your data to someone else.
You do not need a special form. A request can be made by email or post. We will not treat a request as invalid because it does not use the words “Article 15” or “subject access”.
7. Timescales and fees
- We respond without undue delay and within one month of receiving the request, or of receiving any identity information we reasonably asked for.
- If a request is complex, or you have made several requests, we may extend the time by up to two further months. We will tell you within the first month if we do that, and we will explain why.
- We do not charge a fee for a reasonable request. We may charge a reasonable fee, or refuse a request, if it is manifestly unfounded or excessive. We will explain that decision.
8. When we may limit a request
The Data Protection Act 2018 contains exemptions. The ones most relevant to a mortgage file are legal professional privilege, the prevention or detection of crime, corporate-finance and management forecasting information that is not your personal data, and information that would disclose another person’s data where it would be unreasonable to do so. Regulatory record-keeping duties can also mean we retain data even after an erasure request.
If we refuse a request, or rely on an exemption, we will tell you why, unless the law prevents that, and we will remind you that you can complain to the Information Commissioner and apply to a court.
9. Processors and international transfers
Where a supplier processes personal data for us, Article 28 requires a contract that sets out the subject matter, duration, nature and purpose of the processing, the type of data, and our instructions. The supplier must keep the data confidential, assist us with rights requests and security, delete or return the data at the end of the service, and not appoint a further supplier without safeguards.
If a supplier processes data outside the United Kingdom, we use an adequacy regulation or an approved transfer tool, as described in the Privacy Policy. Enquiry data from this website is handled through our lead-handling system, which may involve such a supplier.
10. Personal data breaches
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If we become aware of a breach, we will assess the risk to people. Where the UK GDPR requires it, we will notify the Information Commissioner within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to you, we will tell you without undue delay and describe the steps you can take to protect yourself.
11. Complaints to the Information Commissioner
We would like the chance to put a data-protection concern right. Please contact us first. You may complain to the Information Commissioner at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
You may also apply to a court for compensation or another remedy if you believe the UK GDPR has been infringed and you have suffered damage.