Privacy policy

The short version

• We only ask for what we need to answer your question or arrange your mortgage.
• We never sell your information to anyone.
• We share it with lenders, insurers and our compliance network — only where it is needed to do the job you asked us to do.
• You can ask us at any time for a copy of what we hold, or ask us to delete it.

Who we are

MD Financial Group is a trading style of [entity name], a mortgage and protection firm based in Edinburgh and authorised and regulated by the FCA (firm reference number [TBC]). In data-protection language, we are the “data controller” for the information described here. We are registered with the Information Commissioner’s Office under registration number [TBC].

Registered address: [TBC], Edinburgh, Scotland. If you have a question about your information, email hello@mdfinancialgroup.co.uk or write to us at that address, marked for the attention of the data protection contact.

What we collect

It depends on how far you go with us.

If you only send us a question, we collect your name, the way you asked us to reply (your email address or your phone number), and whatever you wrote in the message.

If you book a call with us, our booking calendar also records the time you chose and the name and email address you gave it.

If you ask us to arrange a mortgage or insurance, we will also need:

• your date of birth, address history and nationality;
• your immigration status — visa type, share code or residence permit — because it decides which lenders can help you;
• your income, employment, spending and existing borrowing;
• your bank statements, payslips and identity documents;
• information about your credit history;
• details of the property you are buying.

For insurance, we may also need information about your health, and about family members you want to cover. That counts as “special category” information, so we only use it with your explicit permission and only to arrange the cover you asked for.

Why we use it, and what allows us to

• To answer your enquiry and give you advice — because you asked us to, and because doing so is a step towards a contract between us.
• To submit your case to a lender or insurer — to perform that contract.
• To meet our legal duties — the FCA’s rules, anti-money-laundering checks and identity verification.
• To keep records of the advice we gave — our legitimate interest in defending ourselves if a complaint is made years later, and an FCA requirement.
• To tell you when your rate is ending — our legitimate interest in looking after existing clients. You can tell us to stop at any time.
• Health and family information for insurance — only with your explicit consent.

Who we share it with

Only where it is needed:

• Lenders and insurers we approach on your behalf.
• Credit reference and fraud-prevention agencies, which will record the search.
• Your solicitor or estate agent, where you have asked us to deal with them.
• Our compliance network and our regulator, who audit the advice we give.
• Resend, which delivers the enquiry you send from this website to our own inbox. It handles the message in transit and does not use it for anything else.
• Calendly, if you book a call. It holds the appointment, the name and the email address you give it, and sets its own cookies in the booking window.
• Vercel, which hosts this website and keeps short-lived technical logs of requests to it.
• Our other suppliers — the firms that host our email and the system we keep client records in. They act on our instructions and cannot use your information for anything else.

We do not sell your information, and we do not pass it to anyone for their own marketing.

Where your information is kept

Your information is stored in the UK or the European Economic Area wherever possible. Some of the suppliers named above, including Calendly, are based in the United States; where information reaches them we make sure the transfer is covered by UK-approved safeguards, such as the International Data Transfer Agreement.

How long we keep it

If you only asked a question and nothing came of it, we delete your enquiry after 12 months. If we gave you advice, we keep the file for at least six years after our relationship ends — the FCA expects us to be able to show what we recommended and why. Insurance files are kept longer where the cover itself lasts longer.

Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that is wrong;
• delete it, where we are not required to keep it;
• stop or limit how we use it;
• send it to another firm in a portable format;
• stop sending you anything at all.

Where we rely on your consent, you can withdraw it at any time — that does not undo anything we did before you withdrew it. Ask by emailing hello@mdfinancialgroup.co.uk. It is free, and we will reply within one month.

Cookies and this website

The page itself uses only what it needs to work. If you open the booking calendar, Calendly sets its own cookies inside that window — it does not load at all unless you send us an enquiry first. We do not use advertising cookies that follow you around other websites. [Cookie banner and the final list of cookies to be confirmed before launch.]

If you are unhappy

Tell us first — email hello@mdfinancialgroup.co.uk and we will look into it. If you are still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Complaints about the mortgage advice itself go to the Financial Ombudsman Service.

Changes to this policy

If we change how we use your information, we will update this page and change the date below. This version: [TBC].