Website Privacy Statement

1. Who we are

AMA Financial Services Ltd (trading as Adverse Mortgage Advisors) collects, uses and is responsible for certain personal data about you. We are the data controller for that personal data under data protection regulation. Our ICO registration number is ZB048922. When we say “we”, “us” or “our” we mean AMA Financial Services Ltd. We provide intermediary services in relation to mortgage products and, where relevant, protection and general insurance products. All of our case handling is carried out by our own team.

2. The data protection principles

We must follow the data protection principles. This means your personal data must be:

• used lawfully, fairly and in a transparent way;
• collected for specified, explicit and legitimate purposes only;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date;
• kept for no longer than necessary;
• kept secure; and
• handled in a way that lets us show we comply (accountability).

Where we transfer personal data outside the UK, we also make sure it stays protected.

3. Our use of data processors

Data processors are third parties who provide parts of our service for us. We have contracts with our data processors. They can only use your personal data on our instructions, must keep it secure, must not share it with anyone other than us, and must keep it only for the period we tell them.

4. The personal data we collect and use

We collect personal data you give us by completing a proposal or fact find, over the telephone, by email, through our website or social media channels, or face to face. By giving us information about yourself you are a data subject.

If you give us information about another person, you confirm that they have given you permission to do so and that we may use it in the same way as your own data, as set out in this notice. It may help to show them this notice. If they have any concerns, they can contact us using the details in section 13.

We may collect the following personal data when you provide it to us:

• contact information;
• identity information;
• financial information, including credit history;
• employment status;
• lifestyle information;
• health information;
• information about any criminal convictions or offences;
• details of any vulnerability;
• product details; and
• details of your dependants or beneficiaries under a policy.

Information we collect from other sources

We also obtain personal data from other sources while providing our services. Where another party gives us your data, it is their responsibility to explain this to you and, where needed, to get your permission. This may include:

• from lenders and product providers: product details; and
• from identification and verification agencies: identity information and sanction check information.

5. How we use your personal data

The table below shows how we use your personal data, the lawful basis for each use and who we routinely share it with. Some recipients may be outside the UK. See section 9 for how we protect your data when this happens.

6. Special category data and criminal records data

Some personal data is more sensitive and requires additional protection under data protection legislation. This is known as special category data and includes information about your health. Information relating to criminal convictions and offences is also subject to additional protection.

We may process:

• Health information and details of any vulnerability when providing mortgage advice, where necessary to understand your individual circumstances, provide suitable advice and make reasonable adjustments.

• Health and lifestyle information when providing intermediary services in relation to protection insurance products.

• Information about criminal convictions or offences when providing intermediary services in relation to general insurance products, or when preventing, detecting and investigating financial crime.

Where we process special category data, we will ensure that we have an appropriate lawful basis under Article 6 of the UK GDPR and a relevant condition under Article 9, together with any additional requirements under the Data Protection Act 2018.

Where applicable, we may process special category information where necessary for insurance purposes, to establish, exercise or defend legal claims, or where another relevant condition under data protection legislation applies.

We will only collect and use information that is necessary for the relevant purpose and will ensure that appropriate safeguards are in place to protect it.

Where we process criminal conviction or offence information to prevent or detect financial crime, we do so in accordance with applicable legal and regulatory requirements relating to unlawful acts and dishonesty.

7. Whether you have to give us your data

We will tell you if giving us some personal data is optional, including when we ask for your consent. In all other cases you must give us your personal data so that we can provide intermediary services.

8. How long we keep your personal data

We keep your personal data for different periods depending on why we hold it:

9. Transfers of your information outside the UK

Some of our suppliers and sub-contractors, and some of the organisations we share data with, may be located outside the UK. If we transfer your personal data outside the UK, we make sure it is protected to a similar standard to the protection it has in the UK. We do this using one of these safeguards:

• the transfer is to a country, territory or organisation covered by UK adequacy regulations, including organisations certified under the UK-US data bridge;
• the transfer is covered by the UK International Data Transfer Agreement, or by the UK Addendum to the European Commission standard contractual clauses; or
• the transfer is covered by binding corporate rules approved for UK use.

You have the right to ask us for more information about any transfer outside the UK and the safeguards in place. See section 10.

10. Your rights

You have the following rights over your personal data:

• Access: to ask for a copy of the personal data we hold about you and information about how we use it.
• Rectification: to ask us to correct information that is inaccurate or incomplete. We may need to check the accuracy of the new information first.
• Erasure: to ask us to delete your personal data where we no longer need it for the purpose we collected it, where you have withdrawn consent or objected to our use, where we have used it unlawfully, or where we are legally required to delete it.
• Restriction: to ask us to limit how we use your data, for example while we check its accuracy, where our use is unlawful, but you do not want it deleted, where we no longer need it but you need it for legal claims, or while we consider an objection.
• Objection: to object to us using your data where we rely on legitimate interests, and to object to direct marketing at any time.
• Portability: to ask for personal data you gave us to be provided in a structured, commonly used, machine-readable format, or sent to another organisation, where we use it on the basis of consent, or a contract and the processing is automated.
• Withdrawing consent: where we rely on your consent, to withdraw it at any time. This does not affect the lawfulness of what we did before you withdrew it.
• Automated decisions: we do not make decisions about you based only on automated processing that have a legal or similarly significant effect. Lenders may use automated credit scoring when they assess an application. They are responsible for explaining this to you.

We may ask for proof of identity before acting on a request, so that we only share or change information where we know we are dealing with the right person. We do not charge a fee unless a request is clearly unfounded or excessive. If a fee applies, we will tell you before we go ahead.

We aim to respond to requests within one month. We may extend this by up to two further months if the request is complex or you have made several requests, and we will tell you if so. The time limit may be paused while we wait for information, we reasonably need to confirm your identity or to understand what you are asking for. When you ask for access to your data, we carry out reasonable and proportionate searches.

We may not always be able to fully meet a request, for example where it would affect the confidentiality we owe to others, where we must keep data to meet legal obligations, or where we need it to establish, exercise or defend legal claims. If so, we will explain why.

11. Keeping your personal data secure

We have appropriate security measures to prevent personal data being lost, used or accessed without authority. We limit access to people who need it for their work, and they are subject to a duty of confidentiality. We have procedures for dealing with suspected data breaches. We will tell you and the regulator about a suspected breach where we are legally required to.

12. How to complain

If you are unhappy with how we have handled your personal data or a request you made, you have the right to complain to us. You do not need to use any special wording. Tell us what happened and what you would like us to do.

You can complain to us by:

• email: info@ama-fs.co.uk; or
• post: Data Privacy Manager, AMA Financial Services Ltd, International House, International Business Park, Charfleets Road, Canvey Island SS8 0PQ.

We will acknowledge your complaint within 30 days of receiving it. We will investigate it, keep you updated and tell you the outcome without undue delay. If we need more information from you we will ask.

If you are not happy with our response, or you do not hear from us in a reasonable time, you can complain to the Information Commissioner’s Office (ICO). The ICO may expect you to have raised the complaint with us first.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone: 0303 123 1113. Website: www.ico.org.uk.

13. How to contact us

If you have any questions about this notice or the information we hold about you, or want to exercise your rights, please contact our Data Privacy Manager by email at info@ama-fs.co.uk or by post at International House, International Business Park, Charfleets Road, Canvey Island SS8 0PQ.

Glossary of terms