This privacy policy explains how Tomohard ltd, trading as Tomohard, collects, uses, stores and shares personal data when you use this website, ask us about a mortgage, remortgage, protection or equity release, or otherwise deal with us. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read it with our UK GDPR notice, Cookie Policy, Terms of Use and Complaints procedure.
1. Who we are
For the personal data described in this policy, Tomohard ltd is the controller. That means we decide why and how the data is used.
Tomohard ltd, trading as Tomohard.
Email: info@tomohard.com
We have not appointed a statutory data protection officer. Privacy questions and rights requests should be sent to the email address above, with the subject line “Data protection”. If no email address is shown, please use the address on this page or the contact details given in your client documents.
2. The rules we follow
When we handle personal data we follow:
- the UK GDPR;
- the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and electronic marketing; and
- where a matter moves into regulated advice or a product application, the Financial Conduct Authority’s record-keeping rules and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
Your rights, and how to use them, are set out in section 13 and in more detail on our UK GDPR page.
3. Personal data we collect
The website enquiry form asks for your first name, last name, email address and telephone number, together with the UK dialling code. If you continue with an appointment or an application, we may also collect the following, depending on the product and what you ask us to do.
Identity and contact data
- name, title, date of birth and contact details;
- address history and how we should contact you; and
- identity documents and proof of address where we must check identity.
Financial and property data
- employment, income, expenditure, dependants and existing credit commitments;
- details of the property, the loan you want, deposit, and any existing mortgage; and
- bank details, source of funds, and information a lender or insurer asks for so it can assess an application.
Special category and related data
Health information can be relevant to protection insurance or to some mortgage and later-life lending decisions. We collect it only where it is needed for that purpose, and we rely on a UK GDPR Article 9 condition, usually your explicit consent or the condition for insurance. We do not ask for this information on the website form.
Technical and usage data
- browser type, device type, pages viewed, and the date and time of a visit, where your browser provides that information as part of a normal request;
- your cookie choice, stored in local storage on your device under the key cookies_accepted; and
- records of emails, calls and messages between you and us.
We ask you to give accurate information. If you give us information about another person, such as a joint applicant, you confirm that you have their permission to do so and that they know how we will use it.
4. How we collect personal data
- you type it into a form on this website;
- you email, telephone or meet us;
- a lender, insurer, solicitor, surveyor or other professional sends it to us because you asked them to, or because it is needed to progress a case you have asked us to handle; and
- it is generated by your use of the website, as described in the Cookie Policy.
Submitting the website form is a request for us to contact you about your financial requirements. It is not itself an application for a mortgage and it does not start a credit search.
5. Why we use personal data, and the lawful basis
We must have a lawful basis under Article 6 of the UK GDPR for each purpose. The table below is a summary. More than one basis can apply to the same information.
| Purpose | Lawful basis | What this means in practice |
|---|---|---|
| Responding to an enquiry and arranging an appointment | Steps taken at your request before entering a contract, and consent to be contacted | We use your name, email and phone number to reply by telephone, email or post about the requirement you described. |
| Giving mortgage, protection or lifetime-mortgage advice and arranging a product | Contract, and legal obligation | We use the financial and property information needed to research a suitable product and to submit an application you have agreed to. |
| Checking identity and preventing financial crime | Legal obligation, and legitimate interests | We keep the records the money-laundering regulations require, and we may refuse to act if we cannot complete those checks. |
| Keeping advice and complaint records | Legal obligation, and legitimate interests | We retain the file so we can evidence what was recommended, deal with a complaint, and meet regulatory record-keeping duties. |
| Running and protecting this website | Legitimate interests | We use limited technical data to keep the site available, remember your cookie choice, and understand whether pages work. |
| Optional marketing about other services | Consent | We only send marketing that is separate from your enquiry if you have agreed to it. You can withdraw that agreement at any time. |
Where we rely on legitimate interests, we balance those interests against your rights. You can object, as explained on the UK GDPR page. Our legitimate interests are running a mortgage advisory business, keeping clients and staff safe, and improving this website.
6. Marketing and electronic contact
The sentence under the enquiry form is the consent for us to contact you about the financial requirement you have asked us to look at. That contact may be by telephone, email or post.
We treat messages that are needed to progress your enquiry, an appointment, or an application as service messages. We will not use your details to send unrelated promotions unless you have agreed, or unless a narrow PECR exception applies and we have given you a clear way to opt out. You can withdraw consent or opt out by using the link or reply instruction in the message, or by contacting us. Withdrawing consent does not affect the lawfulness of contact that took place before you withdrew it, and it does not stop service messages about an application that is still in progress.
7. Who we share personal data with
We do not sell personal data. We share it only where we need to:
- mortgage lenders, lifetime-mortgage providers and insurers you ask us to approach, or that we recommend and you agree we should approach;
- an approved specialist, where a home reversion scheme is more suitable than a product we can arrange ourselves;
- solicitors, conveyancers, surveyors and other professionals involved in a transaction you have asked us to support;
- credit reference agencies, if a credit search is required for an application. A full application search can leave a record. The website form does not trigger a credit search;
- our IT, email, telephony and lead-handling providers, who process data on our written instructions. Enquiry details submitted on this website are sent to that lead-handling system;
- professional advisers, auditors and our professional indemnity insurer, where they need the information to advise or insure us;
- the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner, HM Revenue & Customs, the courts, or law enforcement, where the law requires or allows the disclosure.
Providers who act as processors must protect the data and use it only for our instructions. Lenders and insurers who receive an application are separate controllers of that application. Their own privacy notices describe how they use it.
8. Transfers outside the United Kingdom
We store and use personal data in the United Kingdom where we can. Some providers, including lead-handling, email or cloud tools, may process data in another country. Where that country is not covered by UK adequacy regulations, we put in place an approved safeguard, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we assess whether any extra measures are needed.
You can ask us for a summary of those safeguards using the contact details in section 1.
9. How long we keep personal data
We keep personal data only for as long as we need it for the purpose we collected it, including any period the law or a regulator requires.
- Website enquiries that do not become a client file are kept for up to 24 months after our last contact with you, unless you ask us to delete them sooner and we have no duty to keep them.
- Records of regulated advice, applications and complaints are kept for at least six years after the relationship ends. We keep them for longer if the mortgage, a complaint, a claim or a legal hold is still open, or if a longer period is required for the product.
- Identity and money-laundering records are kept for five years after the business relationship ends, or for any longer period the regulations allow.
- Cookie-choice storage stays on your device until you clear site data or change the choice.
When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.
10. Security
We use appropriate technical and organisational measures, including access controls, limited staff access, and secure transmission of enquiry data. No website or email system is completely secure. Please do not send full bank details, passwords, or copies of identity documents by ordinary email unless we have asked you to use a secure method.
We will not ask you to transfer money because of an unexpected email or call. If you are unsure a message is from us, contact us on the details published on this website before you pay anyone or disclose further information. Tomohard ltd is not responsible for a payment you make to a fraudster after failing to verify the request.
11. Children
This website and our mortgage services are directed at adults. We do not knowingly collect personal data from anyone under 18 through the enquiry form. If you believe a child has sent us their data, contact us and we will delete it unless the law requires us to keep it.
12. Automated decisions
We do not make decisions that produce a legal effect, or a similarly significant effect, about you by solely automated means on this website. A lender or insurer may use automated credit or underwriting tools when an application is submitted. Where that happens, their privacy notice explains the logic and your right to ask for human review.
13. Your rights
Under the UK GDPR you can ask us to:
- confirm whether we process your personal data, and for a copy of it;
- correct inaccurate data, or complete data that is incomplete;
- delete data in the situations the UK GDPR allows;
- restrict how we use data while a request or objection is considered;
- receive certain data you provided, in a portable format;
- object to processing based on legitimate interests, and object to direct marketing at any time;
- withdraw consent, where consent is the basis we rely on; and
- ask for a human review of a solely automated decision, where one is made.
These rights are explained, with timescales and the information we may need, on our UK GDPR page. Some rights are limited where we must keep a record for the law, for a claim, or to evidence advice we have given.
We aim to respond within one month. We may need to confirm your identity before we release or change data. There is usually no fee.
14. Cookies
We use a small amount of storage on your device to remember whether you have accepted or declined the cookie notice. Details, including how to control storage in your browser, are in the Cookie Policy.
15. Changes to this policy
We will post any change on this page and update the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email or at your next contact where that is appropriate.
16. Complaints about data protection
Please contact us first so we can try to resolve the concern. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for personal data:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Our general service complaints procedure, including the Financial Ombudsman Service where it applies, is on the Complaints page.