We take your privacy seriously. This Privacy Notice explains how The Oak Tree Mortgages Partnership LLP collects, uses, stores and shares personal information, the rights you have in relation to your information, and how you can contact us about data protection.
The Oak Tree Mortgages Partnership LLP is the data controller for personal information where we determine why and how that information is processed. We process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who We Are
When we use “Oak Tree”, “we”, “us” or “our”, we mean The Oak Tree Mortgages Partnership LLP. Oak Tree Mortgages is a trading name of The Oak Tree Mortgages Partnership LLP.
Address: 2 Henley Court, High Street, Henley-in-Arden, B95 5BA
Data protection email: DPN@oaktreemortgages.com
Telephone: 0121 733 8833
Regulatory details: FCA Financial Services Register 917270 | ICO registration ZA798069
About Our Services
Our core business is providing mortgage advice and arranging mortgages. We also provide advice and arranging services for protection and general insurance products, including life assurance, critical illness cover, income protection and buildings and contents insurance.
To provide these services properly, we need to collect and use information about you and, in some circumstances, other people connected with your case.
The Information We Collect
Depending on the service you require, we may collect and use information including:
• your name, address, date of birth and contact details;
• identity and residency information;
• employment and self-employment information;
• income, expenditure, assets, liabilities and other financial information;
• bank statements, payslips, accounts, tax documents and evidence of deposit or source of funds;
• details about properties you own, wish to purchase or wish to mortgage;
• information about existing mortgages, insurance policies and other financial commitments;
• credit information and identity-verification information;
• your mortgage and protection requirements, preferences and objectives;
• health, medical and lifestyle information where relevant to protection advice or supporting you appropriately;
• information relating to vulnerability or circumstances that may affect how we should communicate with or support you;
• criminal-offence information where relevant to a lender or insurer, fraud prevention or financial-crime obligations;
• telephone calls, meeting recordings, transcripts and records of communications;
• documents and information you upload or provide to us; and
• information we create when providing our services, including case notes, research, sourcing results, recommendations and reasons for our advice.
We may also process information about other people connected with your case, such as joint applicants, dependants, family members and people providing a gifted deposit. Where you provide information about another person, you should make them aware that their information may be provided to and processed by us.
How We Collect Information
Information you provide directly
Most information is provided by you during your dealings with us, including through meetings with our advisers, the Score client portal, telephone, email, WhatsApp Business, Meta Messenger, Timely appointment and messaging services, documents, electronic forms and declarations, and mortgage or protection applications.
Information from other sources
We may also obtain information from mortgage lenders, insurers and other product providers, credit-reference and identity-verification services, estate agents and other introducers, solicitors and conveyancers, other professional advisers, and other people involved in your transaction.
For example, we currently receive referrals from Melvyn Danes Estate Agents.
Score And Our Client Records
Score is our principal customer relationship management, advice and client-portal system. We use Score for client onboarding and fact-finding, document collection and storage, identity verification, credit reporting, mortgage research and sourcing, Decisions in Principle and mortgage applications, protection fact-finding, health and vulnerability information, application forms, advice records, case notes and material communications.
Material information received through other channels, such as email, telephone, WhatsApp or Messenger, may also be recorded in Score so that we maintain an appropriate client case record.
Identity Verification And Credit Information
We use electronic identity-verification services through Score. Score currently uses Onfido as part of its identity-verification process. Information available to us may include identification documents and verification information.
Clients can also choose to obtain a credit report through Score. Score’s credit-reporting service is powered by Equifax. The client initiates the initial credit-report process and completes the applicable disclosure, consent and verification journey.
Credit information may then become available within Score to both the client and Oak Tree and may be used to support mortgage advice. Where appropriate, updated credit information may be obtained during an ongoing mortgage advice process so that we are not relying on materially out-of-date information.
Mortgage Lenders And Applications
We may provide your information to mortgage lenders to check eligibility, obtain Decisions in Principle and illustrations, submit applications, and progress and administer cases.
Where Score supports an integrated lender process, information held in the Score fact find may be used to populate lender systems. In other cases, our advisers enter information directly into the lender’s intermediary system.
Mortgage lenders are responsible for their own underwriting and lending decisions and process your information under their own privacy arrangements.
General Insurance
We may use your information to obtain or arrange buildings and contents insurance and other general insurance products. Oak Tree currently uses providers including Uinsure, Paymentshield and LV= General Insurance. Information may be submitted manually to a provider.
We also use Uinsure CX through Score. Where the relevant criteria are met, Score may automatically refer mortgage-client information to Uinsure as part of the home-insurance process.
Protection Advice And Health Information
Protection advice can require us to collect detailed health, medical and lifestyle information. The Score Health Fact Find can be completed by clients through the Score client portal and may include height and weight, smoking, alcohol and lifestyle information, medication, medical conditions, investigations and treatment, GP information and family medical history.
Where an application is made to an insurer, we may retain a copy of the application within your Score case. We may also submit health and other information through protection quotation and underwriting systems, including The Protection Platform / UnderwriteMe, or directly to an insurer.
Some insurers allow clients to provide particularly sensitive medical information directly and confidentially to them. Where information is disclosed directly to an insurer and is not provided to Oak Tree, we do not receive or hold that information.
Health information may also be processed where relevant to identifying and supporting vulnerable customers.
Vulnerability And Wellbeing
We want to provide appropriate support to customers whose personal circumstances may make them more susceptible to harm.
Where appropriate, we may record information about circumstances affecting a customer, including health, financial resilience, significant life events, and capability, understanding or confidence. We use this information to understand whether we need to adapt our service, communications or advice process.
Where appropriate, vulnerability assessments may be supported through Comentis within our Score arrangements.
Information used to identify and support vulnerability may overlap with health information collected for protection advice, but these are distinct purposes. Information collected for vulnerability purposes helps us understand whether and how we should adapt the service and support we provide.
Calls, Meetings And Recordings
We record incoming and outgoing client telephone calls, and our telephone system notifies callers that calls are recorded. We also record online client meetings, which may be conducted using Zoom or Microsoft Teams.
Recordings and transcripts may be used to maintain an accurate record of discussions, support the advice process, resolve queries or disputes, monitor service quality and provide staff training.
Video, audio and transcripts from online meetings may be stored within our Microsoft OneDrive environment and backed up to secure on-site storage at our Henley office.
For some face-to-face meetings, we may use audio recording to produce a transcript. Where we do this, we will tell you before recording.
Email And Electronic Communications
We use Hushmail email services, Score/client-portal messaging, telephone, Timely email and SMS, WhatsApp Business and Meta Messenger to communicate with clients.
Our @oaktreemortgages.com email addresses use Hushmail services, and we also use nym.hush.com email addresses for some business communications. Original emails may remain within our email systems even where relevant information or documents have also been copied into Score.
WhatsApp Business and Meta Messenger
We may use WhatsApp Business or Meta Messenger where appropriate. Clients sometimes send documents or information through these services.
Where information received in this way is relevant to your case, we normally transfer it into your Score case record and remove the temporary copy from the messaging service. These methods may be particularly helpful for clients who would otherwise find other digital systems difficult to use.
Timely
We use Timely for appointment booking and diary management. Timely may also be used for appointment reminders, email communications, SMS communications and recording marketing preferences. Messages sent through Timely may remain available as part of the Timely client record.
Marketing and communication preferences may also be recorded in Score.
Electronic Signatures
We use DocuSign to send documents for electronic signature. This may include mortgage or protection compliance documentation, declarations, authorities and other documents connected with our services.
DocuSign may process information including your name, contact details, documents, signature information and signing audit information.
Ai-Assisted Processing
Oak Tree uses organisation-managed business AI tools, including OpenAI ChatGPT Business, to assist authorised personnel with appropriate business activities and aspects of client casework.
This may include analysing meeting transcripts, triaging and reviewing documents, analysing bank statements and other financial information, drafting and workflow support, and assisting staff with understanding information contained within a client case.
This may involve identifiable client information and, where relevant and permitted, sensitive information such as health or vulnerability information.
ChatGPT Business is used to assist our staff, not to replace their professional judgement. Relevant outputs may be transferred into the client’s Score case. Staff remain responsible for reviewing information and checking its accuracy before relying upon it.
Oak Tree does not use ChatGPT to make lending or insurance underwriting decisions.
Content processed within Oak Tree’s ChatGPT Business workspace is not used by OpenAI to train its models by default.
Automated Decision-Making
Oak Tree does not currently make decisions about you based solely on automated processing where those decisions produce legal or similarly significant effects.
Technology, including Score and AI-assisted tools, may support our advisers and staff with functions such as sourcing, credit information, document analysis and application processing, but the adviser or relevant member of staff remains responsible for Oak Tree’s advice and relevant decisions.
Mortgage lenders and insurers make their own eligibility, lending and underwriting decisions and may use automated processes under their own privacy arrangements.
Introducers And Referral Partners
We may receive information about prospective clients from introducers such as estate agents.
With your agreement where required, we may also refer you to third parties who provide related services such as conveyancing, legal services, wills and surveys.
Our current referral arrangements may include organisations such as SortRefer, Broker Conveyancing, Wadsworth Solicitors and Sydney Mitchell.
These organisations are responsible for their own processing of personal information and will have their own privacy information.
Compliance, Professional Advisers And Authorities
We may share relevant personal information with organisations that assist us in meeting our legal, regulatory and professional obligations.
This may include:
• Bankhall/SBG for compliance monitoring and file reviews;
• our professional indemnity insurers and insurance broker;
• claims handlers;
• solicitors and other legal advisers;
• accountants and other professional advisers;
• the Financial Conduct Authority;
• the Financial Ombudsman Service;
• law-enforcement agencies;
• HMRC and other government bodies; and
• other regulators or competent authorities.
We may make disclosures where required or permitted by law, including for the prevention, detection or investigation of fraud, money laundering or other financial crime.
How We Use Your Information
We use personal information where necessary to:
• understand your circumstances and requirements;
• provide mortgage, protection and insurance advice;
• research suitable products and obtain quotations or illustrations;
• check eligibility, verify identity and satisfy financial-crime obligations;
• obtain credit information where requested;
• submit and progress applications;
• communicate with you and provide appropriate support where vulnerability is identified;
• maintain records of the advice and services we have provided;
• manage complaints and potential legal claims;
• meet legal and regulatory obligations;
• monitor and improve the quality of our services; and
• protect Oak Tree and our clients against fraud and other unlawful activity.
Our Lawful Bases For Processing
Data-protection law requires us to have a lawful basis for processing personal information.
Depending on the circumstances, we may process information because:
• it is necessary to take steps at your request before entering into a contract or to perform a contract;
• we have a legal or regulatory obligation;
• it is necessary for our legitimate interests or those of another party, provided those interests do not override your rights and interests; or
• you have provided consent where consent is the appropriate basis.
Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn, and it does not automatically prevent processing that we are entitled or required to undertake under a different lawful basis.
Special-Category And Criminal-Offence Information
Some information requires additional protection under data-protection law.
We only process special-category and criminal-offence information where this is necessary and proportionate for the relevant purpose and where data-protection law permits us to do so.
Special-category information may include health, medical or other sensitive information used for protection advice and insurance applications, supporting vulnerable customers, or managing legal claims.
Criminal-offence information is not routinely required in every case. It may be collected or processed where relevant to the requirements of a mortgage lender, general insurer or protection insurer, including where a provider asks questions about convictions as part of an application. It may also be processed where relevant to fraud prevention, financial-crime requirements or other applicable legal or regulatory obligations.
We maintain appropriate internal records and safeguards for this processing as required by law.
Money Laundering, Fraud And Sanctions
We are subject to legal and regulatory requirements concerning financial crime.
We may use your information to verify your identity, establish the source of funds, carry out sanctions and politically exposed person checks, prevent and detect fraud, and identify suspected money laundering or terrorist financing.
Where required, we may make reports or disclosures to the appropriate authorities. Relevant checks may include checking information against the UK Sanctions List and other appropriate financial-crime sources.
Service Communications, Marketing And Mortgage Reviews
We may contact you where necessary to provide or administer the service you have requested, including in connection with appointments, applications, existing case activity and other service-related matters.
Separately, we may use your information to tell you about Oak Tree services that may be relevant to you where the law permits.
For mortgage clients, we may contact you as the end of your current mortgage deal approaches to invite you to review your mortgage arrangements. Depending on the nature and circumstances of a communication, applicable direct-marketing rules may apply.
We currently use channels including email and SMS for relevant communications. Marketing preferences may be recorded and managed through systems including Score and Timely.
We will respect applicable marketing preferences and provide appropriate ways to opt out of marketing communications.
You have the right to object at any time to the use of your personal information for direct marketing.
You can ask us to stop using your information for direct marketing at any time by emailing DPN@oaktreemortgages.com or telephoning 0121 733 8833.
Website And Analytics
We use website analytics, including Google Analytics, to help us understand how visitors use our website and to improve our website and services.
Information collected through analytics technologies may include information about your device, browser and how you interact with our website.
Our website and cookie information should be read alongside this Privacy Notice.
How Long We Keep Your Information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected.
The appropriate period will depend on factors including:
• the nature of the advice or service provided;
• the expected duration of the mortgage, protection policy or other product;
• our ongoing relationship with you;
• applicable legal, regulatory and financial-crime obligations;
• record-keeping and fraud-prevention requirements;
• complaint-handling requirements;
• relevant legal limitation periods;
• professional-indemnity requirements; and
• whether information is required for an ongoing query, complaint, investigation or legal claim.
Some mortgage and protection records may need to be kept for a substantial period because issues relating to financial advice can arise many years after the original transaction.
We periodically review our retention requirements and may securely delete or anonymise information when there is no longer a lawful or legitimate reason to retain it.
International Transfers
Some organisations that provide services to Oak Tree may process personal information outside the United Kingdom.
Where UK data-protection law treats this as a restricted international transfer, we take steps to ensure that an appropriate transfer mechanism or safeguard is in place. Depending on the circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another mechanism permitted under UK data-protection law.
Countries and organisations involved may change as service providers update their infrastructure, subprocessors and processing arrangements.
You can contact us if you would like further information about safeguards applying to a particular transfer.
Keeping Your Information Secure
We take appropriate technical and organisational measures to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure.
Measures may include appropriate encryption and secure storage, access controls and authentication, restricting access to people who have a genuine business need to use the information, appropriate staff training, and due diligence and oversight of service providers.
We also have procedures for responding to suspected data-security incidents and will notify affected individuals and regulators where required by law.
Your Rights
Depending on the circumstances, you may have rights to:
• obtain confirmation that we process your personal information and access information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of information;
• request restriction of its use;
• object to certain processing;
• object at any time to the use of your information for direct marketing;
• receive certain information in a portable format or request transfer to another organisation;
• withdraw consent where we rely on consent; and
• exercise applicable rights relating to automated decision-making and profiling.
These rights are not absolute and may be subject to legal or regulatory exceptions.
We may need to verify your identity before acting on a request. We will normally respond within one month, although the law allows additional time in certain circumstances.
We will tell you if we cannot comply fully with a request and explain the reason where we are permitted to do so.
Contacting Us About Your Information
If you want to exercise your rights or have a question about how we use your information, contact our data-protection contact:
Email: DPN@oaktreemortgages.com
Telephone: 0121 733 8833
Post: The Oak Tree Mortgages Partnership LLP, 2 Henley Court, High Street, Henley-in-Arden, B95 5BA
Please provide enough information for us to identify you and understand your request. We may ask for evidence of identity where necessary to protect your information.
Complaints About Data Protection
If you have concerns about how we have handled your personal information, please contact us so that we have an opportunity to investigate and respond.
You also have the right to complain to the Information Commissioner’s Office (ICO). You do not have to complete Oak Tree’s internal process before exercising your right to complain to the ICO.
Information about making a complaint is available from the ICO at www.ico.org.uk.