1. Who we are
Cashback Remortgages is a trading style of Crayon Financial Solutions Ltd, registered in England & Wales. Registered office: 10 Hercies Road, Uxbridge, UB10 9NA. We are authorised and regulated by the Financial Conduct Authority (FRN 753785).
We are registered with the Information Commissioner's Office (ICO) under registration number ZB309685.
We are the data controller for the personal information we collect and use about you. That means we determine the purpose and means of processing your personal information.
We may make changes to this privacy policy from time to time. If we make substantial changes, we'll let you know — usually by email. If you'd like a copy of a previous version, email us at privacyanddata@cashbackremortgages.co.uk.
2. What personal information we collect
We collect, use, store and transfer two types of data.
Personal data is any information that tells us something about you. This could include your name, contact details, date of birth, bank account details, or any information about your needs or circumstances which allows us to identify you.
Special category data is information classified as 'sensitive' under data protection legislation — health data, religion or sexual orientation. There are also special conditions for criminal-conviction data. We need additional lawful bases under the Data Protection Act 2018 to collect, store and process this data.
If you're enquiring about, or applying for, a mortgage through us, we'll collect:
| Personal information we may collect | Why we collect it |
|---|---|
| Name, address, phone, email, marital status, gender, date of birth, nationality, tax status, employment details, NI number, residential status, bank details, credit history, previous addresses, mother's maiden name. | To apply for or enquire about mortgage products and to carry out referencing and credit checks. |
| Proof of identity (passport, driving licence) and proof of address. Details of mortgage arrangements, ownership history and source of deposit funds. | To perform 'know your customer', anti-money laundering and counter-terrorist financing checks as required by law. |
| Bank account / payment card details. | Processing cashback payments and reconciling our procuration-fee accounts. |
| Bank statements, mortgage statements, proof of deposit, payslips, P60s, SA302s, SA100s, tax-year overviews. | Supporting your mortgage application. |
| IP address, browser type, operating system, URL data. | To improve our website and the services we offer through analytics insight. |
| Communication & marketing preferences. | To only send you details of products and services you're interested in, through your preferred channel. |
If you're making a joint application, we'll also collect some of this information about the person you're applying with (your spouse, partner or co-applicant). Please make sure you have their agreement before you give us their data. If you're applying for a company buy-to-let mortgage, we'll collect some information about the directors or shareholders of the SPV.
We do not offer products or services to children. Telephone calls to or from you may be monitored and recorded for training, compliance and security purposes.
3. How we collect your personal information
You give us your personal information
You give us data when you do any of the following:
- Create a Cashback Remortgages account on our website
- Contact us by email, phone or chat
- Use or apply for any of our products or services
- Subscribe to our newsletter or opt in to marketing
- Provide feedback or take part in a survey
We automatically collect data
Our website automatically collects technical data — the equipment you're using and a record of which pages you visit. We use cookies for this; full details are in our Cookie Policy.
We receive personal information from another source
- Google Analytics — to understand how people use the website.
- Authentication providers (Google) when you sign in with social login.
- Credit reference agencies (e.g. Experian, Equifax) for affordability and identity checks.
- Public sources like Companies House and the Electoral Register, to verify the information you've told us.
- Identity verification providers (e.g. Onfido, Smart Search) for KYC and anti-money laundering.
- Other brokers, where you have previously applied for a mortgage and consented to share your file with us.
We can't control how those other places use your data, and we're not responsible for their privacy policies. Please read their policies if you'd like more information.
4. How we use your personal information
We only use your personal information when the law allows us to. Companies can't use your personal information without having a legal basis — this is called a "lawful basis". The lawful bases we rely on are:
- Consent — you've given clear and unambiguous consent (e.g. to send you marketing).
- Contract — where processing is necessary to perform a contract you're party to, or to take steps before entering one.
- Legal obligation — to comply with laws and regulations (e.g. anti-money laundering identity checks).
- Legitimate interest — where we have a legitimate business interest, such as detecting and preventing fraud or improving our products.
Where we process special category data (e.g. health information used to assess income replacement on a mortgage), we will only do so where we have a valid legal basis and, where required, your explicit consent.
5. Who we share your personal information with
We share information with the following parties:
| Third party | Why we share it |
|---|---|
| Mortgage lenders | To progress your enquiry or application for a mortgage. |
| Insurance providers | If you separately request a quote for life cover, critical illness or income protection. |
| Solicitors / conveyancers / panel managers | To provide conveyancing services tied to your mortgage completion. |
| Surveyors / valuers | To undertake a structural or homebuyer survey on the property. |
| Mortgage clubs | Companies that route case submissions between brokers and lenders. |
| Credit reference & risk agencies | For fraud prevention, anti-money laundering checks and identity verification. |
| Law-enforcement bodies (Police, HMRC, local authorities) | To comply with court orders or legal obligations. |
| HM Land Registry | For conveyancing and ownership-record purposes. |
| Our IT and cloud-infrastructure providers | Strictly to deliver the technical platform that powers our service. They are contractually bound to confidentiality. |
Automated decision-making
We do not carry out solely automated decision-making that produces legal or similarly significant effects on you. Some of our partners (such as lenders) may use automated decision-making as part of their underwriting. You can ask the relevant provider for more information or request a human review.
6. Transferring your personal information to another country
We are based in the UK. Some of our service providers (e.g. cloud infrastructure) are based in the European Economic Area (EEA) or in countries with an adequate level of personal-data protection. Where we transfer data outside the UK or EEA, we use the Standard Contractual Clauses transfer mechanism — robust contracts that offer the same level of protection as the UK and the EEA.
7. Storing your personal information & how long we keep it for
How we keep your data safe
Only a limited and authorised number of people can access your information, on a business-need-to-know basis. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 on AWS DynamoDB). We have incident-response procedures in place; if something goes wrong, we'll tell you — and the ICO — where the law requires us to.
How long we keep your data
Usually, mortgage and AML-related information is kept for around 7 years after the relationship ends, in line with FCA and HMRC record- keeping rules. Where you use our conveyancing or specialist-lender services, we may need to retain certain records for longer (up to 15 years).
You can ask us to delete your data by emailing privacyanddata@cashbackremortgages.co.uk. If law or regulation requires us to keep some data for a set period, we'll explain why when we respond.
8. Your rights
You have rights under the UK GDPR when it comes to your personal information. You have the right to:
- Be informed about how we collect and use your data.
- Access a copy of the personal information we hold about you.
- Rectify data we hold that is inaccurate or incomplete.
- Erase your data — though we may have to keep some records to comply with law.
- Restrict how we process your data in certain situations.
- Object to processing, including direct marketing (which we'll always stop on request).
- Portability — receive your data in a structured, commonly used format so you can move it elsewhere.
- Challenge any automated decision and request human review.
To exercise any of these rights, email privacyanddata@cashbackremortgages.co.uk. We'll respond within one calendar month.
9. Contact us
If you want to talk to us about your data or make a complaint, email privacyanddata@cashbackremortgages.co.uk or write to Cashback Remortgages, 10 Hercies Road, Uxbridge, UB10 9NA.
You also have the right to contact the Information Commissioner's Office (ICO) — the independent UK regulator that protects information rights. If you have a complaint, we'd love the chance to help you first, but you can also complain to the ICO at any time.