Privacy Notice

Mederi Mortgages is a trading name of Mederi Financial Limited, a company registered in England and Wales (company number 13026358). In this notice "we", "us" and "our" refer to Mederi Financial Limited.

Mederi Financial Limited, trading as Mederi Mortgages, is an Appointed Representative of Quilter Financial Planning Limited, which is authorised and regulated by the Financial Conduct Authority. For the personal data we collect through this website and in the course of providing advice, we act as data controller; Quilter Financial Planning Limited may also process certain data as a joint or independent controller for regulatory and oversight purposes.

For any data-protection enquiry — including requests to access, correct, delete or restrict your data, or to withdraw consent — please contact us via the details on our contact page. A dedicated privacy contact will be published here shortly; in the meantime any enquiry sent through the contact form will be routed to the appropriate person.

• Identity & contact data — name, email, mobile, postcode area.
• Professional data — your profession, employer/training stage, the products you'd like help with.
• Financial & advice data — once you become a client, the information required to give regulated advice (income, expenditure, credit history, property details, dependants and so on).
• Technical data — IP address, browser/user-agent and basic device information needed for security and to deliver the site.
• Marketing preferences — your opt-in/opt-out choices.

• To respond to your enquiry and provide advice — performance of a contract / taking steps at your request prior to entering a contract (UK GDPR Art. 6(1)(b)).
• To meet our regulatory and legal obligations — including FCA recordkeeping, anti-money-laundering and tax requirements (Art. 6(1)(c)). Where this involves special-category data such as health information for protection advice, we rely on Art. 9(2)(g) (substantial public interest — regulatory requirements).
• For our legitimate interests — running and improving our business, protecting the site from fraud and abuse, and contacting existing clients about their existing products (Art. 6(1)(f)).
• With your consent — for optional marketing communications and non-essential cookies (Art. 6(1)(a)). You can withdraw consent at any time.

We only share personal data where necessary:

• Lenders, insurers and providers when we submit an application on your behalf.
• Our compliance, IT, hosting, email and CRM providers (acting as our processors under written contracts).
• Regulators, law-enforcement and other authorities where we are legally required to do so.

We do not sell personal data and we do not use it for automated decision-making that produces legal or similarly significant effects.

We keep personal data within the UK or European Economic Area wherever possible. If a provider transfers data outside the UK/EEA we ensure an appropriate safeguard is in place (such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum).

• Website enquiries that do not become clients — up to 24 months, then deleted or anonymised.
• Client files — for the duration of the relationship and then for the minimum period required by the FCA (currently a minimum of 3 years from the end of the relationship for mortgages, 5 years for protection, and indefinitely for pension transfers where applicable).
• Anti-money-laundering records — 5 years after the end of the business relationship.
• Accounting and tax records — at least 6 years.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have data erased where we no longer need it (subject to our legal/regulatory retention obligations).
• Restrict or object to certain processing.
• Request portability of data you provided to us.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Personal data is held in access-controlled systems hosted in the UK/EEA. Access is restricted to authorised Mederi staff and processors on a need-to-know basis. Data in transit is protected with TLS and data at rest is encrypted by our hosting provider. We keep an audit log of administrative changes to client records.

See our Cookie Policy for the categories of cookies we use and how to change your preferences at any time.

If we make material changes we'll update the date at the top of this page and, where appropriate, contact you directly.