Legal and Privacy Policy

We will treat all your information as private and confidential (even when you are no longer a customer) in accordance with this privacy notice. Where your application has been introduced to us by a third party, for example a credit broker, we may disclose information concerning the progress of your application to them. We will store the information about you on computer and in other records and will take appropriate measures to keep your data secure. We will only use this information for the purposes registered under Data Protection law.

When we process your personal data we do so primarily with a view to entering into the loan contract or to fulfil a contract we have with you (or for the reasons set out below). Contact may be made with you by telephone (calls may be recorded for training, compliance and evidential purposes), post, email or SMS messaging to help service your account. We may do this ourselves or we may ask someone else to do it for us and we may pass information about you and your account to anyone who services your account. This may include third party insurance providers and anyone we ask to help us enforce the loan agreement. This could include solicitors, receivers, field agents or surveyors. If you chose to communicate with us or send information via a third party mobile phone application, how your personal data will be used will be set out in their own privacy policy. We will be able to access the information you provide via the app and will use this information for the reasons set out below.

We may contact you via email to invite you to review any services and products you received from us in order to collect your feedback and improve our services and products. We use an external company, Feefo to collect your feedback which means that we will share your name, email address and reference number with Feefo for this purpose. If you want to read more about how Feefo process your data, you can find their Privacy Policy here.

When we process your personal data we do this for the following reasons:

• to progress the loan enquiry;
• to enter into the loan contract;
• to record and place on the relevant public registers our interests in respect of any of your property that our loan is secured against;
• to fulfil a contract we have with you;
• when it is our legal duty to do so;
• where we have legitimate interest in doing so (and this doesn’t outweigh your own relevant interests); 
• where we have a recognised legitimate interest in doing so (safeguarding vulnerable people, national security or responding to emergencies); or
• when you have given us consent.

Data Protection law gives you the right to request the personal information that we hold about you. You have the right to be informed whether or not we are processing personal data that relates to you, and if so to be informed of what we are processing, what we use the data for, who we disclose the data to and how long we will keep it for.

Depending on the legal basis for which we are using your information, you may be entitled to object if you believe there are lawful grounds to do so.

You have a right to request deletion or removal of personal data in certain circumstances, in essence where the processing fails to meet the requirements of data protection law.

You can ask us to correct personal data we hold about you, if you are able to evidence that the data we hold is inaccurate.

You have a right to request that we restrict our use of your personal data. The Company will be required to restrict the processing of personal data in certain circumstances, for example where an individual contests the accuracy of the personal data.

You may ask us to provide you with a copy of the personal data you have provided to us in a commonly used electronic format.

We will keep your personal data for as long as you are a customer of Mercantile Trust. Once you have paid back the loan, we will keep your data for up to 12 years to enable us to deal with any questions or complaints, to demonstrate compliance with regulation or for legal reasons.

Where you have made an enquiry or application but it has not resulted in a mortgage with us, we will keep your data for 12 months.

This is retained until you request for it to be removed or for 12 months after the end of the relationship with Mercantile Trust.

We will keep information relating to any complaint(s) you have made for 6 years after the date on which your relationship with Mercantile Trust ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Where we have detected fraudulent activity, this information will be retained for 5 years from the end of the relationship with Mercantile Trust or 5 years from the date of the suspicion (whichever is later).

All telephone calls will be kept for a maximum of up to 15 years from the date of the call.

If you choose to receive marketing material from us, we may contact you by letter, phone, SMS or electronic mail to offer other products which we feel may be of interest to you. If you do not wish to be contacted by us, please write to the Data Protection Officer at the address above, or e-mail your name and address to contact@mercantiletrust.co.uk.

We may request information from you on our enquiry form. A user must provide contact information (such as name, email address, home address etc) and in some cases, financial information (such as loan amounts, outstanding credit balances etc). This information is used in consideration of your loan application and to contact you regarding your application. By submitting the enquiry form you are confirming that the information given is accurate and that you consent to its use.

We use a third party platform to deliver our Live Chat service to handle customer enquiries in real time. The software is provided by a company called Click4Assistance.

When you interact with the Live Chat interface, the following details may be recorded by the Click4Assistance live chat service:

• Any data added to the Chat window
• IP Address (An IP address is a number sequence that identifies a device (not a user) that is connected to the internet. Some IP addresses are the same each time they connect to the internet, "Static IP" and some change each time “Dynamic IP”.)
• Language
• User Agent (technical data which includes device, browser etc.)
• Referral Site, Search Engine, Search Keywords if you visited our Website from one of these types of web page
• Number of visits
• Number of pages visited
• Device/Operating System/Browser
• Country, Region, City, Longitude/Latitude,
• ISP/Domain (all based on IP lookup)
• Any data you choose to send in attachments
• Any data you choose to send on any forms (pre-chat, survey, offline etc.)

If you use the Live Chat service and you request to speak to a member of our team we may ask you for your name, telephone number and email address in order to arrange contact with our team. This is optional.

The details of your Live Chat conversation reside on Click4Assistance servers. Click4Assistance servers are based in the UK. Your data will not pass outside the UK at any point, as a result of using the Click4Assistance live chat service via our Website. Click4Assistance may use “sub-processors” (third parties) to help them in the conduct of providing their service.

Wherever and however your data is processed, Click4Assistance adheres to processes and measures necessary to adequately protect your data.

For information on how Click4Assistance secures the data that exists on the Live Chat platform, visit these pages of their website.

Your Live Chat details will also be passed to the relevant team so that they understand the nature of your enquiry. As a result, your details may be recorded within client records on our internal systems. This is so that we have a full picture of our work with you, this data is subject to our standard data retention periods (see “Your data - retention periods / how long we keep your data”).

When using the chat option our staff will never ask you for any bank account or card payment details.

We use Text Anywhere to provide SMS/text messages should we need to contact you, details of how they process personal data can be found here.

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take financial services from us we may also make periodic searches at CRAs to manage your account with us. Any periodic searches will also be conducted as ‘soft’ searches and will not impact your credit rating.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• Assess your creditworthiness and whether you can afford to take the product;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Manage your account(s);
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them the information in this notice, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your spouse or financial associate successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.equifax.co.uk/crain, www.experian.co.uk/legal/crain & www.transunion.co.uk/crain

If you are introduced to us by a broker or another intermediary, we will inform them about the progress of the loan application and whether you have been successful. 

Once funds have been released, Mercantile Trust may share limited information about how your loan performs (such as balances and payment status) with the broker or other intermediary that introduced you to us. This is only done to calculate and administer any additional commission payable to your broker / intermediary, and where there is a contractual requirement for us to do so.

Before we provide services, or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

We may use personal data that you have provided, that we have collected from you and that we may have received from third parties to prevent fraud and money laundering and to verify your identity.

Details of the personal information that will be processed may include name, date of birth, address, contact details, financial information, employment details and device identifiers including IP address.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.

Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

If you have a complaint about how we process your personal data, we have a formal complaints procedure to ensure that your complaint is handled quickly, fairly and efficiently. You can contact us using the contact information above.

If we are unable to resolve your complaint to your satisfaction you may have the right to refer your complaint to the Financial Ombudsman Service (ICO), free of charge. The ICO is an independent body responsible for making sure that organisations comply with Data Protection law. The ICO also deals with concerns raised by members of the public about the way in which organisations look after personal information. If you need to raise a concern, you can do so by using the following link:

www.ico.org.uk/concerns

• Your name and date of birth;
• Your contact information including your; address, telephone number and email address;
• Your relationship to the person on behalf of whom you are acting ;
• Your status as a third party i.e. whether you have the applicants authority to discuss their details, and/or act on their behalf in making the application or making a complaint; or
• Evidence of any formal authority to act on behalf of the applicants eg: power of attorney, grant of probate or similar;
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, and any written correspondence.

We may obtain your information from one or more of the following sources:

• You;
• The applicants / borrowers;

• To arrange the application for finance on behalf of the applicants;
• To administer the mortgage account on behalf of the borrowers
• Anti-fraud measures;
• To respond to requests from bodies such as police, national crime agency, department for work and pensions etc;
• To record and respond to complaints.

When we process your personal data, we do so on the following legal bases:

Legal obligation - In order to comply with the laws and regulations that apply to Mercantile Trust Limited, for example:

• to inform fraud prevention and/or law enforcement agencies where fraud or money laundering is identified or suspected; or
• to obtain or retain appropriate records, for example evidence of:
• suspected fraud or money laundering; and
• proof of your identity (electronic or physical);

 Legitimate interest (In the course of running our business) - including:

• to provide our service to the applicants / borrowers;
• to improve our products and services;
• to record and respond to complaints made on behalf of the applicants / borrowers;

If you are uncomfortable with us processing your data, you should not agree to act in any third party capacity, for the applicants.

We may pass some of your information to the following third parties:

• The applicants / borrowers for whom you are acting on behalf of;
• Fraud prevention agencies or other relevant authorities such as the police, national crime agency, HMRC and the department for work and pensions.

We will keep your information for as long as is required for the purpose for which you are acting as a third party and in accordance with our data retention policy described above.

We will treat all your information as private and confidential (even when you are no longer a customer) in accordance with this privacy notice. Where your application has been introduced to us by a third party, for example a credit broker, we may disclose information concerning the progress of your application to them. We will store the information about you on computer and in other records and will take appropriate measures to keep your data secure. We will only use this information for the purposes registered under Data Protection law.

When we process your personal data we do so primarily with a view to entering into the loan contract or to fulfil a contract we have with you (or for the reasons set out below). Contact may be made with you by telephone (calls may be recorded for training, compliance and evidential purposes), post, email or SMS messaging to help service your account. We may do this ourselves or we may ask someone else to do it for us and we may pass information about you and your account to anyone who services your account. This may include third party insurance providers and anyone we ask to help us enforce the loan agreement. This could include solicitors, receivers, field agents or surveyors. If you chose to communicate with us or send information via a third party mobile phone application, how your personal data will be used will be set out in their own privacy policy. We will be able to access the information you provide via the app and will use this information for the reasons set out below.

We may contact you via email to invite you to review any services and products you received from us in order to collect your feedback and improve our services and products. We use an external company, Feefo to collect your feedback which means that we will share your name, email address and reference number with Feefo for this purpose. If you want to read more about how Feefo process your data, you can find their Privacy Policy here.

To ensure that your card details remain secure, you will only be able to make online payments if you have Internet Explorer 7.0 or above installed on your PC. Internet Explorer 7.0 supports Secure Socket Layer (SSL) technology, which is an industry standard for internet payments. This means all of your personal and card details are protected using 128 bit encryption when your details are transmitted over the Internet. This makes it virtually impossible for anyone else to discover and use your details.

Check your browser encryption strength by using your mouse to hover over a padlock icon in the bottom right hand corner of your browser window (it should be a closed padlock). When you do this, it should tell you that it is SSL Secured 128 bit.

We do not store your credit/debit card details, this information is processed by our chosen Payment Merchants.

Verified by Visa and Mastercard Securecode are online security services for Visa and Mastercard cardholders.

These schemes enable you to register an additional password to your card. By doing this you will help prevent unauthorised transactions on your debit card which means that you can add security and peace of mind to on-line transactions.

When you confirm your payment, if your bank is participating, you will be asked to register for either scheme. Simply follow the online instructions.

Some banks do offer an option to sign up later but others will insist that you sign up to the scheme immediately before completing your transaction. Like chip and pin, Verified by Visa and Mastercard Securecode will soon become compulsory.

If you have any further questions, please contact your card issuer.

This Notice was last updated May 2026. We will use personal data in accordance with the version of the privacy policy in use when the information was collected.

If we decide to change our privacy policy, we will update this privacy statement and other places we deem appropriate so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.