Privacy
What we do with your information.
A mortgage application involves more personal information than almost anything else you will do. This notice sets out what is collected, why, who sees it and what you can require of us.
It covers both this website and the advice service. They work quite differently, and the difference is explained below.
Who is responsible
The data controller.
Us
A Star Mortgage Services Ltd is registered in England and Wales, company number 13128540. Registered office: 21 Allington Street, Leicester LE4 6AE. Trading as A Star Mortgage Services, we are the controller for the personal data described in this notice.
We are registered with the Information Commissioner's Office as a data controller.
How to contact us about data protection
Write to The Directors, 21 Allington Street, Leicester LE4 6AE, or email info@astarmortgages.uk with "Data protection" in the subject line.
The firm is small enough that it has no separate data protection officer, and is not required to appoint one. Requests are handled by the directors.
This website
What the site itself collects.
Less than most. It is worth stating precisely, because the answer is unusual.
The contact form
Nothing you type is transmitted while you are filling the form in. It stays in your browser until you press the button, and if you fill the form in and close the tab, we never had it.
Pressing the button does two things. It emails your enquiry to an adviser, through our email provider Resend, so that it reaches us whether or not you go on to complete the second step. It also writes the same enquiry out as a message and hands it to WhatsApp, where you send it yourself.
The email carries only what you put in the form: your name, your email address, what you are enquiring about, and whichever of the optional fields you chose to fill in. Your IP address is seen by our host in the ordinary course of serving the request and is used briefly to limit how often the form can be submitted from one connection; it is not written into the email and is not retained beyond that. Enquiries are held in the adviser's mailbox and are not added to any marketing list.
The calculator
The mortgage calculator runs in your browser. The figures you enter are not transmitted anywhere and are not retained after you leave the page.
Server logs
Our hosting provider, Vercel, keeps standard technical logs of requests made to the site — including IP address, the page requested, and browser information — for security and operational purposes. These are held under the provider's own retention policy for a limited period and are not used by us to build a profile of you.
Images
Photography on this site is served from a third-party image host. Requesting a page therefore causes your browser to request images, which discloses your IP address to that host in the ordinary way that loading any image does.
The advice service
What an application involves.
What is collected
Identity and contact details; date of birth and nationality; employment and income details; details of your outgoings, credit commitments and bank transactions; details of the property; details of your deposit and its source; and information about your household, including dependants.
Where relevant to the advice, we may also process information about your health or family circumstances. That is special category data, and it is processed only where it is necessary for the advice you have asked for, or with your explicit consent.
Why, and on what legal basis
To assess what you can borrow, to recommend a product, and to submit and progress an application — which is processing necessary to take steps at your request before entering into a contract, and to perform that contract.
To meet legal obligations, including anti-money-laundering identity verification, and record-keeping required by financial services regulation.
For our legitimate interests in operating and improving the service, in maintaining records of advice given, and in defending claims — balanced against your interests, and only where that balance permits it.
Who it is shared with
Lenders, to obtain decisions and submit applications. Credit reference agencies, who will record searches made about you. Insurers and providers, where you have asked for protection advice. Conveyancers and valuers involved in your transaction. Our regulator and, where required, law enforcement or tax authorities.
Our own service providers — such as the software we use to manage cases — process data on our instructions under written contracts and may not use it for their own purposes.
We do not sell your personal data, and we do not pass it to third parties for their own marketing.
Automated decision-making
Lenders and credit reference agencies use automated processing to score applications and to detect fraud. Those decisions are made by them rather than by us, and you have the right to ask that lender for an explanation and for human review.
How long it is kept
Records of advice and the information supporting it are retained for at least three years after the advice was given, which is the minimum our regulator's mortgage rules require, and longer where a complaint or claim could still be brought. Records kept for anti-money-laundering purposes are retained for the period the law requires — ordinarily five years from the end of the relationship.
Where it is held
Within the United Kingdom or the European Economic Area. Where a provider processes data outside those areas, we require an appropriate safeguard recognised under UK data protection law to be in place.
Your rights
What you can require of us.
The rights you hold
Under UK data protection law you have the rights below. Some are qualified, and where an exemption applies we will tell you which one and why.
- To be told what personal data we hold about you, and to receive a copy of it.
- To have inaccurate data corrected, and incomplete data completed.
- To have data erased, where we no longer have a lawful reason to keep it.
- To restrict processing while an issue is being resolved.
- To receive data you gave us in a portable form, and to have it transmitted to another controller where technically feasible.
- To object to processing carried out on the basis of our legitimate interests, and to object at any time to direct marketing.
- To withdraw consent, where consent is the basis on which we are processing.
How to exercise them
Contact us using the details above. We will respond within one month, which can be extended for complex requests — we will tell you if that happens and why. There is no charge unless a request is manifestly unfounded or excessive.
Complaining to the regulator
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first so we have a chance to put it right, but you are not required to.
Keep reading
Related pages.
Next step
Questions about your data?
Ask, and you will get a specific answer rather than a link back to this page.
- No credit check
- No cost
- No commitment