Version 1.0 — Effective 1 April 2004 — Last reviewed 18 September 2026
1. Who we are
Giles Finance and Giles Finance & Consultancy Services are trading styles of Giles Finance Limited, a company registered in England and Wales under company number 17402242 (“Giles Finance“, “we“, “us“, “our“). Our head office is at 11 Wren Road, Dagenham, Essex, RM9 5YN, with branch offices in Putney, Rainham and Willenhall.
We are an independent mortgage and finance brokerage authorised and regulated by the Financial Conduct Authority (Firm Reference Number 726857). We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZB768858.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this notice.
Data protection contact: The Compliance Officer
Email: compliance@gilesfinance.co.uk
Telephone: 020 8088 2211
Post: Data Protection, Giles Finance, 11 Wren Road, Dagenham, Essex, RM9 5YN
2. Who this notice applies to
This notice explains how we collect, use, share and protect personal data about:
- Website visitors — anyone who uses www.gilesfinance.co.uk;
- Enquirers — anyone who contacts us by web form, telephone, email, WhatsApp, social media or in person;
- Clients and applicants — anyone who instructs us to arrange a mortgage, loan, bridging, development or commercial finance facility, or a related insurance product;
- Connected persons — joint applicants, guarantors, directors and shareholders of corporate borrowers, dependants and beneficiaries whose details are provided to us in the course of an application;
- Business contacts — lenders, introducers, solicitors, valuers, accountants and other professionals we deal with.
If you give us personal data about another person (for example a joint applicant or a dependant), you confirm that you are entitled to do so and that you have drawn this notice to their attention.
3. The personal data we collect
The data we collect depends on how you interact with us.
3.1 Website visitors
- Technical data: IP address, browser type and version, device type, operating system, screen resolution, referring website, pages viewed, time and date of visit, and cookie identifiers (see section 9).
- Where you consent, analytics and advertising identifiers set by Google Analytics and Google Ads.
3.2 Enquirers
- Identity and contact data: name, email address, telephone number, and the content of your message.
- Where you have consented to marketing cookies, a hashed (pseudonymised) copy of the email address and telephone number you enter into an enquiry form is shared with Google for advertising measurement (see section 9.3).
3.3 Clients, applicants and connected persons
To advise on and arrange finance we need, and lenders require, detailed information, which may include:
- Identity data: full name, previous names, date of birth, gender, nationality, marital status, National Insurance number, passport or driving licence details, photographs and biometric verification results where electronic identity verification is used.
- Contact data: current and previous addresses (typically three years’ history), email addresses and telephone numbers.
- Financial data: employment and self-employment details, income, payslips, P60s, tax calculations and accounts, bank statements, existing mortgages and loans, credit commitments, expenditure, assets, savings and investments, deposit source, and details of any County Court judgments, defaults, arrears, bankruptcy or IVAs.
- Property data: details of the property to be purchased, remortgaged or used as security, including valuations, tenancy and rental information, planning and development information.
- Corporate data: for limited-company, SPV and commercial borrowers, company details, ownership structure, directors’ and shareholders’ personal data, and business accounts.
- Special category data: in limited circumstances, health information (for example where relevant to protection insurance, a vulnerability assessment, or an application supported by benefits), and information about criminal convictions where a lender’s application requires disclosure. We only process this data where a specific legal condition applies (see section 5).
- Communications data: records of our correspondence, meeting notes, telephone call notes and, where we tell you in advance, call recordings.
3.4 Data we receive from other sources
- Credit reference agencies (Experian, Equifax, TransUnion), where we or a lender carry out a credit search with your authority.
- Fraud prevention agencies, including Cifas and National Hunter.
- Lenders, insurers and product providers, about the progress and terms of your application.
- Introducers, estate agents, solicitors, accountants and other professionals acting for you.
- Electronic identity verification, anti-money-laundering and sanctions screening providers.
- Publicly available sources, including HM Land Registry, Companies House and the electoral roll.
4. Why we use your personal data and our lawful basis
UK GDPR requires us to have a lawful basis for each purpose. We rely on the following.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to your enquiry and providing an initial consultation | Steps at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to enquiries (Art. 6(1)(f)) |
| Assessing your needs, researching the market, providing advice and recommending a product | Performance of our contract with you (Art. 6(1)(b)) |
| Submitting applications to lenders, insurers and product providers and progressing them to completion | Performance of our contract with you (Art. 6(1)(b)) |
| Verifying your identity, preventing fraud and money laundering, and sanctions screening | Compliance with legal obligations (Art. 6(1)(c)), including the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017; legitimate interest in preventing fraud (Art. 6(1)(f)) |
| Carrying out credit searches with your authority | Steps at your request before entering into a contract (Art. 6(1)(b)); legitimate interest in assessing affordability and eligibility (Art. 6(1)(f)) |
| Meeting our regulatory obligations to the FCA, including record-keeping, suitability, Consumer Duty, complaints handling and reporting | Compliance with legal obligations (Art. 6(1)(c)) |
| Assessing and supporting customers in vulnerable circumstances | Compliance with legal obligations (Art. 6(1)(c)) under FCA rules; substantial public interest (Art. 9(2)(g), DPA 2018 Sch. 1 para 8 / 20) where special category data is involved |
| Managing our relationship with you, including administration, accounting and dealing with queries or complaints | Performance of our contract (Art. 6(1)(b)); legitimate interest in running our business (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Contacting you about the end of your fixed-rate or discounted period, product reviews and services similar to those you have taken from us | Legitimate interest in servicing existing clients (Art. 6(1)(f)) — you can opt out at any time |
| Sending our newsletter and marketing to people who are not existing clients | Consent (Art. 6(1)(a)) — you can withdraw consent at any time |
| Website analytics, advertising cookies and advertising measurement (including Google Ads Enhanced Conversions) | Consent (Art. 6(1)(a)) and regulation 6 of the Privacy and Electronic Communications Regulations 2003 |
| Securing our website and systems, preventing spam and abuse | Legitimate interest in network and information security (Art. 6(1)(f)) |
Where we rely on legitimate interests we have balanced those interests against your rights and freedoms. You can ask us for details of that assessment using the contact details in section 1.
5. Special category and criminal offence data
We only process health data, other special category data or criminal offence data where one of the following applies:
- you have given your explicit consent (for example, health information for a protection insurance application);
- processing is necessary for reasons of substantial public interest under Schedule 1 of the Data Protection Act 2018, such as preventing fraud, complying with regulatory requirements, or protecting customers in vulnerable circumstances; or
- processing is necessary to establish, exercise or defend legal claims.
We keep an appropriate policy document for this processing as required by the Data Protection Act 2018.
6. Who we share your personal data with
We share personal data only where necessary for the purposes above, and only with organisations that are themselves bound by data protection law. Recipients may include:
- Lenders, banks, building societies and specialist finance providers to whom we submit your application. Each lender is a separate controller and will provide you with its own privacy notice.
- Insurers and protection product providers, where we arrange buildings, contents, life, critical illness or income protection cover.
- Credit reference agencies — Experian, Equifax and TransUnion. Their processing, including how long they keep search footprints, is described in the Credit Reference Agency Information Notice (CRAIN) at www.experian.co.uk/crain, www.equifax.co.uk/crain and www.transunion.co.uk/crain.
- Fraud prevention agencies, including Cifas and National Hunter. If fraud is detected you could be refused certain services, finance or employment. Further details of how your information will be used by these agencies are available at www.cifas.org.uk/fpn.
- Identity verification, anti-money-laundering and sanctions screening providers.
- Valuers, surveyors, solicitors and conveyancers involved in your transaction.
- Mortgage networks, clubs, packagers and sourcing-system providers that we use to research products and submit applications.
- Introducers and professional advisers who referred you to us, so that they can be told the outcome of the referral, unless you ask us not to.
- Our service providers who process data on our behalf under written contracts, including IT, cloud hosting, email, customer relationship management, document storage, e-signature, telephony, website hosting and analytics providers.
- Google, as our processor, for website analytics and advertising measurement, only where you have given cookie consent (see section 9).
- Regulators and authorities, including the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, HM Revenue & Customs, the National Crime Agency, courts and law enforcement, where we are required or permitted to do so.
- Our professional advisers, including auditors, accountants, compliance consultants and lawyers.
- Prospective buyers or successors of all or part of our business, subject to confidentiality obligations.
We do not sell personal data.
7. Where your personal data is processed
Giles Finance operates only in the United Kingdom. Your personal data is stored and processed in the United Kingdom, our staff and advisers are based in the United Kingdom, and we do not transfer client files outside the United Kingdom.
Where a technology provider we use (for example a cloud, email or website analytics provider) processes limited data on infrastructure outside the United Kingdom, we ensure that transfer is protected by a safeguard recognised under Article 45 or 46 of UK GDPR, such as a UK adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for details using the contact details in section 1.
8. How long we keep your personal data
We keep personal data only as long as necessary for the purposes for which it was collected and to meet our legal and regulatory obligations. Our standard periods are:
| Category | Retention period |
|---|---|
| Website enquiries that do not proceed to an application | 12 months from the date of your last contact with us |
| Applications that do not complete | 3 years from the date the application was withdrawn or declined |
| Regulated mortgage advice and arrangements — client files, suitability records and application documents | 6 years from completion of the mortgage or the end of our relationship with you, whichever is later, in line with FCA record-keeping requirements and the limitation period for legal claims. Records relating to lifetime mortgages, and any product where a complaint could arise after six years, are kept for longer. |
| Anti-money-laundering identity verification records | 5 years from the end of our relationship with you, as required by the Money Laundering Regulations 2017 |
| Accounting and tax records | 6 years from the end of the financial year to which they relate |
| Complaint records | 6 years from the date the complaint was closed |
| Marketing consents and opt-outs | Consent: until withdrawn. Opt-outs: indefinitely, so that we can honour them |
| Website analytics and advertising data | Google Analytics event data: up to 14 months. Cookie lifetimes are set out in our Cookie Policy |
When data is no longer required it is securely deleted or anonymised. Where we are the subject of a regulatory investigation, complaint or legal claim, we may retain data for as long as necessary to deal with that matter.
9. Cookies, analytics and advertising
9.1 Cookie consent
Our website uses cookies and similar technologies. Strictly necessary cookies are set without consent because the site cannot function without them. Statistics and marketing cookies are set only if you accept them through the cookie banner. You can change or withdraw your choices at any time via the “Manage Consent” link in the website footer. Full details of each cookie are in our Cookie Policy.
9.2 Google Analytics
If you accept statistics cookies, we use Google Analytics 4 to understand how visitors use our website, including pages viewed, links clicked (such as telephone and WhatsApp links) and forms submitted. IP addresses are not logged or stored by Google Analytics 4. Google acts as our processor under the Google Ads Data Processing Terms.
9.3 Google Ads and advertising measurement
If you accept marketing cookies, Google Ads cookies are used to measure whether visitors who arrive from our advertisements go on to contact us, and to show you relevant advertisements. In addition, when you submit an enquiry form on this website and have accepted marketing cookies, the email address and telephone number you provide are shared with Google in hashed (pseudonymised) form using Google Ads Enhanced Conversions. Google uses this solely to match your enquiry to any Google advertisement you clicked, so that we can measure the effectiveness of our advertising. Google acts as our processor for this purpose. If you decline marketing cookies, none of this data is shared with Google. Your lawful basis for this processing is consent, which you may withdraw at any time via the footer cookie settings.
9.4 Google Consent Mode
Our website implements Google Consent Mode. If you decline statistics or marketing cookies, Google tags do not set cookies or collect identifiers; they send only cookieless, aggregated signals that cannot be used to identify you.
9.5 Other Google services
Our website uses Google reCAPTCHA to protect our forms from spam and abuse, Google Maps to display our office locations, and Google Fonts. These services receive your IP address and certain browser information when the relevant page loads. Their use is subject to Google’s Privacy Policy.
9.6 Social media and messaging
Our website links to our Facebook, Instagram, YouTube and WhatsApp accounts. If you contact us through those platforms, the platform operator will process your data under its own privacy policy, and we will process the content of your message as described in this notice.
10. Marketing
If you are an existing client we may contact you by email, telephone or post about products and services similar to those you have taken from us, including reminders before your current mortgage deal ends. If you are not an existing client we will only send you marketing where you have opted in. You can opt out at any time by clicking the unsubscribe link in any email, by emailing compliance@gilesfinance.co.uk, or by telephoning 020 8088 2211. We do not pass your details to third parties for their own marketing.
11. Automated decision-making and profiling
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Lenders and credit reference agencies may use automated credit-scoring when assessing your application; where they do, they are the controller of that processing and their privacy notices explain your rights in relation to it.
12. How we keep your personal data secure
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including encrypted connections (HTTPS) on our website, access controls, secure cloud storage, staff training and confidentiality obligations. Where we send documents containing sensitive financial information we use secure portals or encrypted email wherever possible. If you send us documents by ordinary email you do so at your own risk; we recommend using the secure channels we provide.
We will notify you and the ICO without undue delay if a personal data breach occurs that is likely to result in a high risk to your rights and freedoms.
13. Your rights
Under UK GDPR you have the following rights, subject to certain conditions and exemptions:
- Access — to obtain a copy of the personal data we hold about you (a “subject access request”).
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to have your data deleted where there is no compelling reason for us to keep it. We cannot delete records we are required by law or FCA rules to retain.
- Restriction — to ask us to restrict processing in certain circumstances.
- Portability — to receive data you provided to us in a structured, machine-readable format, where processing is based on consent or contract.
- Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing.
- Withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- Automated decisions — not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.
To exercise any of these rights contact us using the details in section 1. We will respond within one month, which may be extended by up to two further months for complex requests. We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting on a request.
14. Complaints
If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint.
Complaints about our mortgage or finance advice, rather than data protection, should be made under our complaints procedure, and may ultimately be referred to the Financial Ombudsman Service.
15. Providing your personal data
Where we need to collect personal data by law, under FCA rules, or under the terms of our contract with you, and you do not provide it, we may be unable to provide advice or arrange the product you have asked for. We will tell you if this is the case.
16. Changes to this notice
We review this notice at least annually and whenever our processing changes. The current version is always published on this page with its effective date. Where a change materially affects you we will tell you directly.