Burrow is a trading name of DPR Consulting Limited (registration number 03178610), whose registered office is at 6th Floor Commodity Quay, St Katharine Docks, London, United Kingdom, E1W 1AZ.
DPR Consulting Limited is a subsidiary of DPR Midco Limited which is registered with the Information Commissioner (ZA355923).
Saffron Mortgage Finders is a wholly owned subsidiary of Saffron Building Society. Collectively known as “the Group”. The Group may use your data as set out in the privacy notice.
We also provide tools through which you may interact with Saffron Mortgage Finders. Your information will be shared directly with Saffron Mortgage Finders who will maintain their own record of your data. You may manage the data you have entered in your Burrow account and your marketing preferences within the Burrow service. You will need to contact Saffron Mortgage Finders separately to update your information and preferences held by them.
Saffron Mortgage Finders is the mortgage broker on behalf of whom we provide our services.
To help ensure all of our legal and regulatory obligations, we have appointed a Data Protection Officer. If you have any questions or concerns about how your personal information is being used you can contact us at:
- EMAIL: firstname.lastname@example.org
- PHONE: 020 7050 2000
- ADDRESS: 6th Floor, Commodity Quay, St Katharine Docks, London E1W 1AZ
- You can find out more information about your rights from the UK’s Information Commissioner’s Office. The ICO is the UK’s independent body for the explicit purpose of protecting information rights. You can find out more here.
What information will Burrow collect from you? How will we use it?
Our core business is on-boarding consumers looking for a mortgage on behalf of mortgage brokers. This involves searching a broker’s products to find the mortgage that best matches applicant profiles. We will complete this activity by using the information that you provide to us. This may therefore include your identity; contact details; property or tenancy history; your family; your nationality and residence status; your financial status and history; your employment details; credit history and details of your financial circumstances.
Mortgage brokers are data controllers in their own right and have their own privacy notices as applicable.
However, because brokers may automatically profile your information against their lending criteria and against Credit Reference Agencies as soon as your information is forwarded to them and this may affect your credit score, we will always bring this to your attention as part of the process so that you are forewarned, if this is completed within the Burrow journey. If it occurs during your consultation with the broker directly, then Burrow is unable to provide any warnings.
Updating your detail
If you are a pre-existing customer, we may use information that we have previously collected to pre-fill forms when you apply for a new product, but you will be able to check that these details are accurate and up to date.
We are working with partner services such as Experian to enable us to pre-populate our on-line data collection forms with information about you that is available from accessible sources. This means there is less information for you to type in. But you have control and can change any answer.
If you've opened an account or policy with another organisation that we introduced you to, you will need to contact them separately to update your information.
Profiling, Marketing and Market Research
Burrow or Saffron Mortgage Finders may use your information to contact you about your enquiry. We may provide reminders and notifications regarding the progress of your mortgage journey. By creating an account with Burrow, you agree to being contacted by email, telephone or other electronic methods for the purposes above.
Where you have consented, we may contact you about mortgages from other brokers or other products that match your profile and may be of interest to you. We make sure we are clear about what methods we can use to contact you. We make sure that you are able to opt out of marketing communications at any time in a way that is convenient to you, including the method you used to contact us.
Quite separately, if you have taken out either a mortgage or an insurance product through us we will contact you when your product is coming to an end to ensure that you are protected and can access the best rates on a new deal. If you do not want us to do this you can ask us at any time to mark your records 'do not contact'.
To help us target audiences more accurately online we share information with organisations such as Experian, who provide third party data services, and publishers such as Facebook. Data service providers can help us in a number of ways; through data matching, that provides additional data about users, and through segmentation and profiling. Segmentation is the process of aggregating normally anonymised information to create a series of 'types' which are then matched against a population which exhibit similar characteristics. Where that data matches to records held by the publisher it can be used to serve tailored online advertisements or similarly to 'suppress' or exclude that audience. Where we do so we make sure that those third party organisations cannot use our customers personal data to enrich their data. Any online advertising platforms we use will enable you to control direct marketing via their privacy settings. We also profile the information we collect from clients to help us improve the customer journey.
We may contact you to conduct market research. We occasionally run promotions, competitions and prize draws but if we ask you for your contact details we will ensure these are not used for marketing unless you are happy to consent to that separately.
Money Laundering and preventing and detecting unlawful acts
Burrow is required by law to submit a Suspicious Activity Report to the National Crime Agency whenever an act of money laundering or fraud is detected. The law also permits us to report suspected crime to the appropriate authorities.
We are also required to disclose personal data where required to do so by law or by the order of a court.
We have discretion to disclose personal data where this is in the public interest.
Information that we collect indirectly
When any of our customers apply for a product, the law requires the broker to check their identity. This makes it harder for criminals to use financial systems, or to use false names and addresses to steal the identities of innocent people. Checking everyone's identity is an important way of fighting money laundering and other criminal activities.
To confirm that you are who you say you are, we'll try to verify your name and address by checking your details against databases held by credit reference agencies and the electoral roll. Alternatively, we may ask you to provide us with other documents to confirm these details or use technologies such as biometric ID verification to complete the checks. This does not affect you credit history or status.
If you are a joint mortgage applicant we will record any information you give us about any other persons who are joined to the application.
What legal grounds will we rely on when we handle your personal information?
Under the GDPR, all firms must have a legal basis for processing personal data. There are six primary ways that this processing can be deemed to be lawful:
• Legal obligation
• Vital interests
• Public task
• Legitimate interests
Burrow does not process any ‘special category’ personal data as defined here.
We rely on the following conditions for our activities:
Burrow will act as an intermediary for the majority of its business, and in doing so does not create a direct contract with those using its service.
We will instead always ask for your consent to use the information that you provide us with. This is particularly true for:
• Where we need information to provide you with additional services or features
• Marketing: To let you know about products, services and offers, or where we think that you may directly benefit from your details being shared for a purpose relevant to your application.
Burrow may also rely on the ‘legitimate interest’ base. Under the GDPR, firms are allowed to use data in a way that the individual might reasonably expect, where this has a minimal privacy impact or where there is a compelling justification for doing so. If Burrow has not already gained your explicit consent for a data processing activity, but these conditions have been met, then we may do so if we believe that you would benefit from the action.
Complying with a legal obligation or Public Interest Task
Where required, Burrow will report fraud and other suspected crimes to the appropriate authorities, which includes suspicion of terrorist financing or money laundering.
Who with and where will we share your information?
We may share your personal information with the following third parties in order to provide our service to you:
Saffron Mortgage Finders on behalf of whom we are performing the on-boarding service, suppliers such as Customer Relationship Management systems providers that may be used by Saffron mortgage Finders, and providers of data and verification services such as identity checking.
If we have already gained your consent to do so, we will share your personal data with selected partners:
Other brokers who may be able to offer you a mortgage and other related financial and non-financial product and service providers such as insurance, conveyancing and estate agents.
If you no longer wish to share your data with any of these organisations you can withdraw your consent at any time by updating your preferences, or contacting us here: email@example.com
As a UK based company, all the personal information we process is protected by the data protection standards of the European Union. We do not send any of your personal information outside of the EU.
Your information rights
All individuals are protected by a number of rights, as described under the GDPR. Not all will apply in all circumstances.
Burrow and Saffron Mortgage Finders are Data Controllers in their own right. Data collected from you can exist within the Burrow service as well as Saffron Mortgage Finders’. In order to exercise your information rights, you would have to treat the two services as independent and contact them separately.
Where you need to contact Burrow to exercise these rights, you may do so using the email address firstname.lastname@example.org
Where you need to contact Saffron Mortgage Finders to exercise these rights, you may do so using the email address email@example.com.
• The right to be informed
- You have the right to be informed in a concise, transparent, intelligible and easily accessible way about how we use your personal information. We will explain why we need information (in particular any uses that are not obvious) at the time we collect information from you.
• The right of access
- You have the legal right to a copy of the information we hold about you. Burrow will comply with the legal obligation to respond within one month and will not charge a fee.
• The right to rectification
- This right gives you the ability to request that inaccurate personal data is corrected or completed if it is incomplete. Burrow will comply with the legal obligation to respond within one month and will not charge a fee, unless we determine the request to be manifestly unfounded or excessive.
• The right to erasure
- You have a right to have some or all of the information we hold about you erased in some circumstances. This is known as the right to be forgotten.
• The right to restrict processing
- If you have objected or complained about how we have used your information or its accuracy you may not want it to be deleted until your complaint has been resolved. In certain circumstances you can ask for your data to be restricted or not used until these issues are resolved.
• The right to data portability
- You have the right in some circumstances to have the data you have provided to us sent to you or provided to another person or business in an electronic machine readable format. Where this applies, we will download the information and send it as a CSV or PDF file.
• The right to object
- You will normally have the right to object to how we intend to use your information based on your individual circumstances. You have an absolute right to object to us using your personal information for the purpose of marketing at any time.
• Rights in relation to automated decision making and profiling.
- Burrow does not make any final decisions regarding a customer’s eligibility to a particular product. We do however use a variety of methods that will help a customer receive tailored and more accurate information as a part of our service. An example of this might be ‘profiling’ which is defined as “automated processing of personal data to evaluate certain things about an individual”. All decisions can be challenged with Saffron Mortgage Finders as appropriate.
You also have the right to lodge a complaint about any aspect of how we are handling your data with the UK Information Commissioner’s Office, which can be contacted at www.ico.org.uk.
How we will store your personal information
All information we process is encrypted in transit so that your personal and financial information is secure. For example, where you share information with us online or we forward this to other organisations online we use HTTPS. Where you create an online account with us you will need to supply a username and password. To protect your account we will encourage you to use a strong password and have implemented two factor authentications.
How long will Burrow store your information?
Burrow will store your information for up to two years from your last login or interaction with the service. At the end of those two years, you will receive a series of email alerts asking whether you would like to retain your account. If you do not respond affirmatively, your account and all the data input and uploaded within will be deleted permanently.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any material updates. We may also notify you in other ways from time to time about the processing of your personal information.