This privacy notice describes how Premier Mortgage Services (PMS) collects and uses personal information about you during and after your working relationship with PMS, in accordance with the Data Protection Act 2018, also known as the UK General Data Protection Regulation (GDPR).

PMS is a ‘data controller’ for your data in the respect of this privacy agreement and your direct relationship with PMS services, any data processing carried out by PMS for your customers, as a data processor, are covered under specific PMS Terms and Conditions. This means that PMS is responsible for deciding how information about you is held and used, this includes the use of any data processors or sub-processors. PMS is required under data protection legislation to notify you of the information contained in this privacy notice.

This Privacy Notice makes you aware of how and why your personal data will be used, namely for the purposes of matching you to prospective businesses and partners who are members of our network of financial advice firms for the provision of financial advice and services.

When we mention "PMS", "we", "us" or "our" we are referring to Premier Mortgage Service Limited.

You can contact the Data Protection Officer (DPO) on dataprivacy@sbg.co.uk, or at Premier Mortgage Service Ltd, Fourth Floor, Jackson House, Sibson Rd, Sale M33 7RR.

PMS ensures it upholds the highest standards of data protection principles and adheres to the following standards across the business.

Data will be:

• Used lawfully, fairly and in a transparent way.

• Collected only for valid purposes that PMS have clearly explained to you and not used in any way that is incompatible with those purposes.

• Relevant to the purposes PMS have told you about and limited only to those purposes.

• Accurate and kept up to date.

• Kept only as long as necessary for the purposes PMS have told you about.

• Kept securely.

Further information is detailed in our Data Protection Policy and reviewed by PMS annually or when any major changes are required, through the Group DPO.

In the course of providing services to you and complying with the required legal and regulatory obligations, we may collect the following personal information:

• contact information (e.g. name, telephone number, email address and address)

• Identity information (e.g. national identity card/number, FCA number, passport, drivers licence and national insurance number)

• Financial Information

• Performance records

• Employment History

• Data about criminal convictions or offences

• Opinions and feedback

In addition to the above, the following personal data may be collected from you where PMS provide you with FCA application support services:

• financial status information, including any debts

• qualifications

• employment history

• data about criminal convictions or offences

We may also obtain personal information from other sources. Where other information is obtained from another party it is their responsibility to make sure they explain that they will be sharing personal data with PMS and, where necessary, ask permission before sharing this information.

We collect personal information directly from you, from publicly available sources, from your organisation, from professional networks and industry sources, from referrals, and through your interactions with our websites, forms, email communications, events, webinars, social media channels and other business development activities.

Where you provide information through our website contact forms, enquiry forms, registration forms, downloadable content requests, social media channels, email correspondence, telephone enquiries or other contact methods, we may use that information to respond to your enquiry, administer our services, maintain records of our interactions and, where permitted under applicable data protection and electronic marketing legislation, send you information regarding relevant products, services, events, regulatory updates and business opportunities offered by Bankhall and other companies within the Sesame Bankhall Group.

PMS processes your personal data in order to provide you details of services from PMS which may be of interest to you. This includes marketing and promotions about current and new services.

We process your personal data in order to provide you details of services which we think maybe of interest to you. This includes marketing and promotions about current and new services.

Where electronic marketing communications are sent, PMS will comply with the Privacy and Electronic Communications Regulations (PECR). You may unsubscribe from marketing communications at any time using the unsubscribe facility contained within the communication or by contacting us.

Where you provide information through our website contact forms, enquiry forms, registration forms, downloadable content requests, social media channels, email correspondence, telephone enquiries or other contact methods, we may use that information to respond to your enquiry, administer our services, maintain records of our interactions and, where permitted under applicable data protection and electronic marketing legislation, send you information regarding relevant products, services, events, regulatory updates and business opportunities offered by PMS and other companies within the Sesame Bankhall Group. You may opt out of marketing communications at any time.

Marketing communications may be sent on the basis of legitimate interests where permitted by law, including the PECR soft opt-in exemption, or on the basis of consent where consent is required.

3.1 Lawful reason for processing

The lawful basis for processing your data, under Article 6(1) of the UK GDPR is ‘Consent’, ‘Performance of a Contract’ and ‘Legitimate Interest’, this is depending on the services provided to you and how your data was collected.

The lawful basis for processing your personal information may include:

• Consent.

• Legitimate Interests.

• Steps taken at your request prior to entering into a contract.

• Compliance with legal or regulatory obligations.

Marketing communications may be sent on the basis of legitimate interests where permitted by law, including under applicable PECR provisions, or on the basis of consent where consent is required.

All lawful basis for processing are considered against every service to ensure they are in line with legal requirements and your rights.

All lawful basis for processing are considered against every service to ensure they are in line with legal requirements and your rights. If you require more information about the lawful basis for processing based on a service, please contact the SBG DPO.

3.2 How will your information be used?

We will use the personal information provided by you for the provision of services and marketing of new services in line with this privacy policy.

Any customer data provided, will be covered by the Terms and Conditions under which the service is provided. We may use your personal data:

1. As necessary to perform a contract with you for the supply of PMS support services:

a. to take steps at your request prior to entering into it;

b. to decide whether to enter into it;

c. to correspond with you;

d. to manage and perform that contract, including administering payment for our services;

e. to update records.

2. As necessary for our own legitimate interests or those of other persons and organisations, e.g.:

a. to manage legal claims (PMS have a legitimate interest in protecting the organisation from breaches of legal obligations and to defend the business from litigation. This is needed to ensure that PMS legal rights and interests are managed appropriately);

b. to issue responses to press/news stories concerning services provided by PMS and/or complaints or legal claims made by you, in order to minimise the reputational impact on the business;

c. to perform tasks in relation to our services within our group for centralised administration purposes;

d. to obtain feedback from you on the service you have received (PMS have a legitimate interest in operating the business. This includes ensuring that the service PMS provide is of a satisfactory standard);

e. to send you marketing communications;

f. to engage with third party service providers with which PMS have referral/introducer arrangements with, in order to assess your eligibility to benefit from enhanced rates and services.

3. As necessary to comply with a legal obligation, e.g.:

a. when you exercise your rights under data protection law and make requests; and

b. for compliance with legal and regulatory requirements and related disclosures.

4. Based on your consent,

a. to refer you to third party service providers with which PMS have referral/introducer arrangements with, in order that you can benefit from enhanced rates and services which may be of interest to you; and

b. to send you marketing communications where PMS have asked for your consent to do so.

You’re free at any time to change your mind and withdraw your consent. The consequence might be that PMS cannot do certain things for you or provide certain services.

In connection with marketing we may collect, store, and use the following categories of personal information about you:

• contact information (e.g. name, telephone number, email address and address)

• identity information (e.g. national identity card/number, FCA number, passport, drivers licence and national insurance number)

• bank account details

• qualifications

• employment history

• financial status information, including any debts

• data about criminal convictions or offences

Criminal record data is considered more sensitive and so is subject to additional levels of protection under data protection legislation.

We may process criminal conviction or offence information when the business provides you with FCA application support services. In addition to the lawful basis for processing this information set out above, we will be processing it based upon your consent.

We may also share your data with the following categories of recipients:

• IT hosting providers

• CRM providers

• Marketing providers

• Professional advisers

• Regulators (FCA, ICO)

• Compliance monitoring providers

• Group companies

• Approved introducers and referral partners

You’re free at any time to change your mind and withdraw your consent. The consequence might be that PMS cannot provide full access to our panels.

PMS will hold your personal data for differing periods of time depending upon the reason PMS have for processing it. The following criteria are used to determine data retention periods for your personal data:

• Retention in case of queries – We will retain your personal data for as long as PMS reasonably consider it necessary to deal with your queries (e.g. any questions you may have in relation to the services).

• Retention in case of claims – We will retain your personal data for as long as PMS reasonably consider that you might legally bring a claim against us.

• Retention in accordance with legal and regulatory requirements – We will retain your personal data after PMS have ceased providing services to you for as long as PMS are required/permitted to retain it for based upon our legal and regulatory obligations

We may share your data with approved third parties and parties within the PMS Group to ensure that you receive the best possible service. We do not sell or pass on your data for marketing purposes, it is only used for the service provision stated or for the marketing of new services within PMS or its parent Sesame Bankhall Group (SBG).

Where possible all PMS data is stored within the UK and EEA but may need to be accessed or stored in a country outside of the UK or EEA that does not provide protections in line with GDPR. In these cases PMS relies on the International Data Transfer Agreement (IDTA) to ensure adequate protections are in place in line with required legislation.

These controls are audited to ensure they are in place in lie with SBG policy and UK GDPR.

Under UK GDPR, you have the following rights:

• Right to be Informed – You have the right to be informed about the collection and use of your personal data

• Right of Access – You have the right to access and receive a copy of your personal data and other supplementary information

• Right to Rectification – You have the right to have inaccurate personal data rectified, or completed if it is incomplete

• Right to Erasure – You have the right to have personal data erased

• Right to restrict processing – You have the right to restriction or suppression of personal data

• Right to data portability – You can request a copy of data and/or to reuse this data for your own purposes across different services

• Rights relating to automated decision making including profiling – You have specific rights when automated decisions are made about you or you are profiled as part of a service. More information on this right can be sought through the Group DPO.

To exercise these rights, contact PMS using the details provided in paragraph 1. We will respond within 1 calendar month unless the request is particularly complex and then an extension with a maximum time of 3 calendar months, may be requested.

We consider security and the required technical and organisational measures required to comply with Article 5(1) of the UK GDPR meaning that it will ensure personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The business has an extensive cyber and information security framework and associate policies that ensure the technical and organisational measures are always kept up to date. This includes that of our suppliers and their responsibilities as processors and sub-processors.

PMS and the wider Sesame Bankhall group may use artificial intelligence, machine learning or automated technologies to assist with administrative activities, service delivery, information security, compliance monitoring and business operations.

Artificial intelligence and automated technologies may be used to support quality assurance, regulatory oversight, complaint investigations, operational administration, data analysis and service improvement activities. These technologies are used to assist employees and authorised personnel rather than replace human decision making. We implement contractual, technical and organisational safeguards to protect personal information processed through such systems.

Personal information will not be used to train publicly available artificial intelligence models unless specifically disclosed and permitted by applicable law.

We do not currently make decisions that have legal or similarly significant effects on individuals solely through automated processing. Should this position change, we will update this notice and provide any additional information required by applicable data protection laws.

We reserve the right to update this privacy notice at any time, and PMS will provide you with a new privacy notice when PMS make any substantial updates. PMS may also notify you in other ways from time to time about the processing of your personal information.

Any complaints or concerns can be reported in the first instance to the SBG DPO on dataprivacy@sbg.co.uk or by visiting the SBG website and using the contact details or feedback form there – www.sbg.co.uk.

If you are not happy with the way we deal with any complaints or have any further concerns or complaints, you have the right to lodge a complaint with the UK’s data protection regulator, the Information Commissioners Office (ICO), who can be contacted through their website at https://ico.org.uk/global/contact-us/ or by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF