1. Mercury Mortgages
Dominic Booth trading as Mercury Mortgages (“we“) are committed to protecting and respecting privacy and complying with the Data Protection Act 1998. This policy, together with our Terms of Website and Acceptable Use Policy (“terms of use”) and any other documents referred to, sets out the privacy obligations that we have in relation to the personal data we collect from you as a user of the Mercury Mortgages website (“you”) and the personal data that you supply to us.
Please read the following carefully to understand our views and practices, and our and your obligations, regarding privacy and personal data and how we will treat it.
For the purpose of the Data Protection Act 1998 (the “Act”), the data controller is Dominic Booth trading as Mercury Mortgages.
2. Data protection generally
Data is information which is stored electronically, on a computer, or in certain paper based filing systems.
Data subjects for the purpose of this policy include all living individuals about whom we or you hold personal data. A data subject need not be a UK national or resident. All data subjects have legal rights in relation to their personal data.
Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in our possession). Personal data can be factual (such as a name, address or date of birth) or it can be an opinion about that person, their actions and behaviour.
Data controllers are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed. They have a responsibility to establish practices and policies in line with the Act. We are the data controller of all personal data used in relation to this site.
Data users include employees and others whose work involves using personal data. Data users have a duty to protect the information they handle by following our privacy policy at all times.
Data processors include any person who processes personal data on behalf of a data controller.
Processing is any activity that involves use of the data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.
Sensitive personal data includes information about a person’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition or sexual life, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings. Sensitive personal data can only be processed under strict conditions, and will usually require the express consent of the person concerned.
3. Data protection principles
Anyone processing personal data must comply with the eight enforceable principles of good practice. These provide that personal data must be:
- Processed fairly and lawfully.
- Processed for limited purposes and in an appropriate way.
- Adequate, relevant and not excessive for the purpose.
- Accurate.
- Not kept longer than necessary for the purpose.
- Processed in line with data subjects’ rights.
- Secure.
- Not transferred to people or organisations situated in countries without adequate protection.
4. Fair and lawful processing
The Act is intended not to prevent the processing of personal data, but to ensure that it is done fairly and without adversely affecting your rights as the data subject. The data subject must be told who the data controller is (in this case Dominic Booth trading as Mercury Mortgages) the purpose for which the data is to be processed, and the identities of anyone to whom the data may be disclosed or transferred.
For personal data to be processed lawfully, certain conditions have to be met. These may include, among other things, requirements that the data subject has consented to the processing, or that the processing is necessary for the legitimate interest of the data controller or the party to whom the data is disclosed. When sensitive personal data is being processed, more than one condition must be met. In most cases the data subject’s explicit consent to the processing of such data will be required.
5. Processing for limited purposes
Personal data may only be processed for the specific purposes notified to the data subject when the data was first collected or for any other purposes specifically permitted by the Act. This means that personal data must not be collected for one purpose and then used for another. If it becomes necessary to change the purpose for which the data is processed, the data subject must be informed of the new purpose before any processing occurs. We only process your data for the purpose of fulfilling your orders, requests or queries.
6. Adequate, relevant and non-excessive processing
Personal data should only be collected to the extent that it is required for the specific purpose notified to the data subject. Any data which is not necessary for that purpose should not be collected in the first place.
7. Accurate data
Personal data must be accurate and kept up to date. Information which is incorrect or misleading is not accurate and steps should therefore be taken to check the accuracy of any personal data at the point of collection and at regular intervals afterwards. Inaccurate or out-of-date data should be destroyed. You are responsible for the accuracy of the personal data you supply and you should let us know if the personal data you supply to us needs updating.
8. Timely processing
Personal data should not be kept longer than is necessary for the purpose. This means that data should be destroyed or erased from our systems when it is no longer required.
9. Processing in line with data subject’s rights
Data must be processed in line with your rights. You have a right to:
- Request access to any data held about you by a data controller.
- Prevent the processing of your data for direct-marketing purposes.
- Ask to have inaccurate data amended.
- Prevent processing that is likely to cause damage or distress to you or anyone else.
10. Data security
We must ensure that appropriate security measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data. Data subjects may apply to the courts for compensation if they have suffered damage from such a loss.
The Act requires us to put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data may only be transferred to a third-party data processor if the data processor agrees to comply with those procedures and policies, or if the data processor puts in place adequate measures itself.
Maintaining data security means guaranteeing the confidentiality, integrity and availability of the personal data, defined as follows:
- Confidentiality means that only people who are authorised to use the data can access it.
- Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.
- Availability means that authorised users should be able to access the data if they need it for authorised purposes. Personal data should therefore be stored on our central computer system instead of individual PCs.
Security procedures include:
- Entry controls. Any stranger seen in the vicinity a computer or private documents should be reported.
- Secure lockable desks and cupboards. Desks and cupboards should be kept locked if they hold confidential information of any kind. (Personal information is always considered confidential).
- Methods of disposal. Paper documents should be shredded. All personal data or other sensitive data stored on any medium including but not limited to DVD, USB memory sticks, external hard drives, the cloud or portable devices should be deleted when they are no longer required.
- Equipment. Data users should ensure that individual monitors and other devices do not show confidential information to passers-by and that they log off from their PC when it is left unattended and that computers automatically lock after a set period of time when not used.
11. Dealing with subject access requests
A formal request from you for information that we hold about them must be made in writing. A fee of £10 is payable by the data subject for provision of this information. Any data controller who receives a written request for personal data should deal with it in accordance with the Data Protection Act 1998. If you have any questions about our obligations, please contact Dominic Booth immediately.
12. Dealing with Data Breaches
If you believe the security of any Personal Data or Sensitive Personal Data has been breached, please speak to Dominic Booth immediately.
Although not a statutory requirement the Information Commissioner believes that a serious breach of the data protection principles should be reported. In the first instance any breach will be reported to Dominic Booth. In any matter that might affect personal safety the police will be informed immediately.
13. Providing information over the telephone
Any person dealing with telephone enquiries will be careful about disclosing any personal information held by us. In particular, we will:
- Check the caller’s identity to make sure that information is only given to a person who is entitled to it.
- Suggest that the caller put their request in writing if they are not sure about the caller’s identity and where their identity cannot be checked.
- Refer to Dominic Booth for assistance in difficult situations. No-one should be bullied into disclosing personal information.
14. Google Analytics
We use Google Analytics to find out more about how and why visitors come to and interact with, our websites. Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. This Analytics data is collected via a JavaScript tag in the pages of our site and is not tied to personally identifiable information. We therefore do not collect or store your personal information (e.g. your name or address) in this context so this information cannot be used to identify who you are.
We have implemented Google Analytics features based on Display Advertising (Google Analytics Demographics and Interest Reporting). We will use the data provided by Google Analytics Demographics and Interest Reporting to develop and tailor ours sites, content, features, resources and direction to those who visit our sites.
Here are some of the ways you can control the information that is shared by your web browser when you visit or interact with Google services on partners sites across the web:
- Ads Settings helps you control the ads by Google that you see across the web. You can learn how ads are selected for you, opt out of certain categories and block specific
advertisers. Learn more about advertising. - We, like many sites across the web use Google Analytics to understand how visitors engage with their sites or apps. If you don’t want Analytics to be used in your browser, you can install the Google Analytics browser add-on. Learn more about Google Analytics and privacy.
- Google makes it easy for you to make recommendations for your friends for example, by clicking the +1 button on content you like. Some of your +1s may show your name and Google+ profile photo in ads, but you can opt out if you don’t want to appear in ads. You can also visit the +1 tab on your Google+ profile to review and manage all of your +1’s. Learn more about how to get to your +1 tab.
- Incognito mode in Chrome allows you to browse the web without recording webpages and files in your browser history. Cookies are deleted after you’ve closed all of your incognito windows and tabs, and your bookmarks and settings are stored until you delete them. Learn more about cookies.
15. Privacy and Information collected
We may collect and process the following data about you and the data subjects whose personal data you provide:
- Information that you provide by filling in forms on our site. This includes information provided at the time of registering to use our site and the information you input. We may also collect information about your computing environment, and/or when you contact us we may ask you for further information.
- If you contact us, we may keep a record of that correspondence.
- Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access, whether this is required for our own purposes or otherwise.
16. IP addresses
We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.
17. Information about the use of cookies
We may also collect and store information about you using cookies. These are very small files which are sent by us to your computer or other access devices and which we can access when you visit our website in the future. The cookie itself does not store any of your personal information. We use cookies to analyse how visitors use our website, for example, to identify which pages on our site are the most popular. The information collected is used to evaluate your use of our website, compile reports on website activity and provide other services relating to website activity and internet usage. We do this to make your experience of our website more efficient, for example by providing you with easier and faster access to website features.
We use the following cookies:
- Strictly necessary cookies. These are cookies that are required for the operation of our websites. They include, for example, cookies that enable you, where provided, to log onto the secure area of our websites.
- Analytical/performance cookies. These allow us to recognise and count the number of users and to see how the users move around our websites when they are using it. This helps us to improve the way our websites work, for example, by ensuring that users are finding what they are looking for easily.
You can find more information about the individual cookies we use and the purposes for which we use them in the table below:
| Cookie Name | Cookie Category | Description | Duration |
|---|---|---|---|
| wordpress_ | 2 | WordPress cookie for a logged in user. | session |
| wordpress_logged_in_ | 2 | WordPress cookie for a logged in user | session |
| wordpress_test_ | 2 | WordPress cookie for a logged in user | session |
| wordpress_test_cookie | 2 | WordPress test cookie | session |
| wp-settings- | 1 | WordPress also sets a few wp-settings-[UID] cookies. The number on the end is your individual user ID from the users database table. This is used to customize your view of admin interface, and possibly also the main site interface. | 1 year |
| wp-settings-time- | 2 | WordPress also sets a few wp-settings-{time}-[UID] cookies. The number on the end is your individual user ID from the users database table. This is used to customize your view of admin interface, and possibly also the main site interface. | 1 year |
| PHPSESSID | 1 | To identify your unique session on the website | session |
| SESS | 1 | To ensure that you are recognised when you move from page to page within the site and that any information you have entered is remembered. | session |
| __utma | 2 | This cookie keeps track of the number of times a visitor has been to the site pertaining to the cookie, when their first visit was, and when their last visit occurred. Google Analytics uses the information from this cookie to calculate things like Days and Visits to purchase. | permanent |
| __utmb | 2 | __utmb is a Google Analytics cookie. It takes a timestamp of the exact moment in time when a visitor enters a site. | session |
| __utmc | 2 | __utmc takes a timestamp of the exact moment in time when a visitor leaves a site. | 30 mins |
| __utmz | 2 | Keeps track of where the visitor came from, what search engine you used, what link you clicked on, what keyword you used, and where they were in the world when you accessed a website. This cookie is how Google Analytics knows to whom and to what source / medium / keyword to assign the credit for a Goal Conversion or an Ecommerce Transaction. | 6 months |
Information about deleting or controlling cookies is available at www.AboutCookies.org.
18. Where we store personal data
The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password which enables you to access our site, you are responsible for keeping this password confidential. We ask you not to share the password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
19. How we use the information we collect/store
We use information held about you and the information you provide in relation to third party personal data, in the following ways:
- to ensure that our websites are presented in the most effective manner for those who visit and use them and for their computer or internet connected device
- to provide the features and functions of our sites (and their related services) to those who visit and use them
- to make contact for the purposes of the administration, support, and continued operation of this website
- to help develop and tailor ours sites, content, features, resources, functionality, and direction to those who visit our sites and use our products and resources
- to provide information about other products, initiatives, resources, and/or news stories to which we wish attention to be drawn
- to send additional periodic e-newsletters where they have been requested
20. Disclosure of information
By providing your information you give consent that we may disclose it to such other Mercury Mortgage related entities as may be necessary to provide you with our services.
We may also disclose your personal information to other parties without seeking your prior consent provided that the disclosure would not be in breach of the Act, for the purpose of law enforcement, or when we:
- are subject to a legal obligation to disclose the information;
- believe it is necessary to protect your vital interests
- believe it is necessary to protect our rights, property or the safety of our staff
- need to do so in order to enforce or apply our Terms of Use
21. Where we store personal data
The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
All information you provide to us is stored on secure servers. Where we have given you (or where you have chosen) a password which enables you to access our site, you are responsible for keeping this password confidential. We ask you not to share the password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site. any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
22. Access to information
You may ask for a copy of the information that we hold about you by writing to us at: Dominic Booth, 27 Silk Mill Mews Cookridge Leeds LS16 6SU.
Please note that we may charge a statutory fee of up to £10 for providing this information, and we may also charge you for postage.
In order to be sure that your personal information is not disclosed improperly we may require you to provide us with proof of identity before the information is provided to you.
Once you have paid the statutory fee (if requested) and ID has been confirmed your request will be dealt with within 40 calendar days.
You may also ask us to correct the information that we hold about you, or to delete or stop using such information, by writing to the same address.
23. Changes to our privacy policy
Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.
24. Contact
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to Dominic Booth at 27 Silk Mill Mews Cookridge Leeds LS16 6SU, or call 0113 267 5536.
Further information
Independent advice about data protection, privacy and access to information, is available from the
Information Commissioner’s office at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.gov.uk
Useful References
The Data Protection Act (1998)