BrightMCR
Order a report

Privacy notice

This notice explains how we collect and use personal data when you use brightmcr.co.uk and when we prepare a Mortgage Capacity Report. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

Data controller

BrightMCR is a trading style of Bright Money Independent Ltd, registered in England & Wales (company number 07801150). Registered office: C/O Abacus Accountants, Coleridge House, 5-7A Park Street, Slough, England, SL1 1PE. Trading address: Suite 2a, Kille House, Chinnor Road, Thame, Oxfordshire, OX9 3NU. Bright Money Independent Ltd is registered as a data controller with the Information Commissioner's Office (registration number Z3577188). For any data protection question, contact us at mcr@bmimoney.co.uk or by post at our Thame trading address.

What we collect

  • Identity and contact data — your name, email address and telephone number, and (where relevant) your solicitor's name and firm.
  • Financial data — income, employment status, benefits, maintenance, credit commitments, debts, deposit and available equity.
  • Household and circumstances data — number and ages of dependent children, housing situation, and any circumstances relevant to your borrowing capacity.
  • Case data — the order reference, your report, correspondence with you and with your solicitor, and adviser notes.
  • Website data — if you accept analytics cookies, aggregate usage data about pages viewed on this site. See our cookie notice.

Some of this information is special category or financially sensitive in nature (for example health-related circumstances you choose to disclose). We ask you not to send us more information than is needed for the report.

Lawful basis

  • Performance of a contract — to prepare and deliver the Mortgage Capacity Report you have ordered, and to take steps at your request before entering that contract.
  • Legal obligation — to meet our record-keeping, anti-money-laundering, tax and regulatory obligations.
  • Legitimate interests — to run and secure our business, respond to enquiries, deal with complaints and defend legal claims. We balance these against your rights.
  • Consent — for analytics cookies, and for any optional marketing. You can withdraw consent at any time. Where special category data is involved, we rely on your explicit consent or on the establishment, exercise or defence of legal claims.

Who we share it with

We share your data only where necessary: with your solicitor or the court where you have asked us to send the report to them; with our service providers acting on our instructions (Airtable for case records, Resend for transactional email, Google Analytics for consent-based website analytics, and our IT and hosting providers); with Sesame Ltd, our regulatory network, where required for compliance oversight; and with regulators, auditors or law enforcement where the law requires it. We do not sell your data and we do not share it with advertisers.

Some of these providers process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or by the International Data Transfer Addendum to the EU Standard Contractual Clauses.

Analytics and cookies

Google Analytics 4 (measurement ID G-477FYTHKWB) runs on this site only if you accept analytics in the cookie banner. Analytics storage is set to denied by default and nothing loads from Google before you accept. We never send Google your name, email address, financial details, form entries or order reference — only aggregate page and device information, with IP addresses anonymised. Your choice is stored in your browser under brightmcr-cookie-consent-v1. You can change or withdraw it at any time using the "Cookie preferences" link in the footer, or the button below; withdrawing stops collection and deletes the Google Analytics cookies.

Retention

  • Completed reports and case records — kept for six years from the date the report is delivered, reflecting the limitation period for legal claims and our regulatory record-keeping obligations. They are then deleted or anonymised.
  • Orders that are never completed — deleted within 12 months of the last contact.
  • General enquiries and contact form messages — deleted within 12 months.
  • Complaint records — kept for six years from the date the complaint is closed.
  • Analytics data — retained by Google for 14 months from your last visit.
  • Your cookie choice — stored in your own browser until you clear it; it is not held on our systems.

Security

Case data is held in access-controlled systems, transmitted over encrypted connections (HTTPS), and reachable only by the advisers who need it to prepare your report. Our adviser tools are password protected and are not publicly accessible.

Automated decision-making

Our calculators produce indicative figures automatically, but every Mortgage Capacity Report is reviewed, adjusted and signed by a qualified adviser. No decision with legal or similarly significant effect is made about you by automated means alone.

Your rights

You have the right to be informed, and to request access to your data, rectification of inaccurate data, erasure, restriction of processing, portability, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting processing already carried out. To exercise any right, email mcr@bmimoney.co.uk. We respond within one month. Some rights are limited where we must keep records to meet a legal obligation or to defend legal claims.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.