Privacy Policy

1. Who We Are

Nesto Mortgages Ltd is the data controller responsible for your personal data.

• Company name: Nesto Mortgages Ltd
• Company number: 14964264
• Registered address: Grove Chambers, Basecamp, 36 Green Lane, Wilmslow, England, SK9 1LD
• ICO registration: Nesto Mortgages Ltd is registered with the Information Commissioner's Office (ICO) as a data controller
• Data protection contact: Ben Darke — ben@nesto.co.uk

2. Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Identity and contact data

• Full name
• Email address
• Phone number
• Postal address or postcode

Financial and circumstance data

• The type of financial service or product you are seeking
• General information about your financial circumstances (e.g. property value, income range, existing debts)
• Employment status
• Any adverse credit history you voluntarily disclose

Technical and usage data

• IP address
• Browser type and version
• Pages visited and time spent on our website
• Referring website or search query
• Device type and operating system

Communications data

• Messages sent to us via our contact form or by email
• Records of any correspondence between us

We do not knowingly collect special category data (e.g. health information, racial or ethnic origin) unless you voluntarily provide it in a free-text field. You should avoid providing such information unless it is directly relevant to your enquiry.

We do not collect payment card details or bank account information.

3. How We Collect Your Data

We collect data in the following ways:

• Directly from you — when you complete our matching form, contact form, or email us
• Automatically — through cookies and similar tracking technologies when you visit our website
• From third parties — we may receive data from advertising platforms (such as Meta or Google) if you arrive at our website via a paid advertisement, subject to those platforms' own privacy policies

4. How We Use Your Data

We use your personal data for the following purposes:

• To provide our matching service — processing your enquiry, identifying suitable Advisers, and facilitating an introduction
• To contact you — responding to your enquiries and communications
• To improve our service — analysing how our website is used and improving our matching process
• To comply with legal obligations — maintaining records as required by law
• For marketing purposes — where you have given us consent, we may send you information about our services. You may withdraw consent at any time
• To prevent fraud and misuse — monitoring for fraudulent or abusive use of our service

5. Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR:

• Contract performance — processing is necessary to provide the matching service you have requested
• Legitimate interests — we have a legitimate interest in operating and improving our business, provided this is not overridden by your rights and interests
• Legal obligation — where processing is required to comply with a legal obligation
• Consent — for any direct marketing communications. You may withdraw consent at any time by contacting us or clicking unsubscribe

6. Sharing Your Data

We share your personal data in the following circumstances:

With Advisers

When you submit an enquiry, we share the relevant details (name, contact information, and the nature of your financial need) with one or more FCA-regulated Advisers from our panel for the purpose of facilitating an introduction. By submitting an enquiry, you consent to this sharing. The Adviser becomes an independent data controller in respect of any data they receive from us and will process your data under their own privacy policy.

With service providers

We share data with trusted third-party service providers who assist us in operating our website and service, including:

• Website hosting and infrastructure providers
• Analytics providers (e.g. Google Analytics)
• Form and communication tools (e.g. Formspree)
• Advertising platforms (e.g. Meta, Google Ads)

All service providers are contractually required to keep your data secure and to use it only for the purposes we specify.

Legal disclosures

We may disclose your data to law enforcement or regulatory authorities where required to do so by law, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell your personal data to third parties.

7. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes for which it was collected:

• Enquiry data — retained for up to 2 years from the date of your enquiry
• Contact form submissions — retained for up to 1 year
• Marketing consent records — retained until you withdraw consent, plus 1 year thereafter
• Website analytics data — retained in accordance with the relevant platform's data retention settings (typically 14–26 months)

After the applicable retention period, data is securely deleted or anonymised.

8. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may ask us to correct inaccurate or incomplete data
• Right to erasure — you may ask us to delete your data in certain circumstances
• Right to restrict processing — you may ask us to limit how we use your data
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to our processing of your data where we rely on legitimate interests
• Right to withdraw consent — where we process data based on consent, you may withdraw it at any time

To exercise any of these rights, please contact our data protection contact: Ben Darke at ben@nesto.co.uk. We will respond within one calendar month. We may need to verify your identity before processing your request.

9. Cookies

Our website uses cookies and similar technologies to enhance your experience and to help us understand how our website is used.

Types of cookies we use

• Essential cookies — necessary for the website to function correctly. These cannot be disabled
• Analytics cookies — help us understand how visitors use our website (e.g. Google Analytics)
• Advertising cookies — used to measure the effectiveness of our advertising campaigns (e.g. Meta Pixel, Google Ads)

On your first visit, you will be asked to consent to non-essential cookies. You can withdraw consent or manage your cookie preferences at any time by adjusting your browser settings or contacting us.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, loss, or destruction. These measures include encrypted data transmission (HTTPS), restricted access to personal data, and regular review of our security practices.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

11. International Transfers

Some of our third-party service providers may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) to protect your data in accordance with UK GDPR requirements.

12. Children's Privacy

Our service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Your continued use of our website following any changes constitutes acceptance of the updated policy.

14. Contact Us & Complaints

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Data Protection Contact: Ben Darke
Nesto Mortgages Ltd
Grove Chambers, Basecamp, 36 Green Lane
Wilmslow, England, SK9 1LD
Email: ben@nesto.co.uk

If you are not satisfied with our response or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113