GDPR & Data Protection

1. Our Data Protection Status

HomeSafeHeaven is an independent matching service and acts as a Data Controller for the personal information you provide to us through our website and matching service. We are not a direct lender and do not make credit decisions.

When we connect you with lending partners, they act as independent Data Controllers for the information you provide to them. Their own privacy policies will apply to how they handle your data.

For the purposes of UK data protection law, our registered address is:

2. UK GDPR Compliance

We respect the privacy rights of all individuals in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The following provisions apply to all data subjects whose personal data we process.

2.1 Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity (Article 6(1)(b)): To provide our matching service and facilitate connections with lending partners
• Legal Obligation (Article 6(1)(c)): To comply with applicable laws, including anti-money laundering and fraud prevention requirements
• Legitimate Interests (Article 6(1)(f)): To improve our services, prevent fraud, ensure security, and conduct business operations
• Consent (Article 6(1)(a)): For marketing communications and optional data processing activities

2.2 Your UK GDPR Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right to be Informed: You have the right to know how we use your data (this policy fulfills that right)
• Right to Access (Subject Access Request): Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure (Right to be Forgotten): Request deletion of your data in certain circumstances
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another service in a structured format
• Right to Object: Object to processing based on legitimate interests, including direct marketing
• Rights Related to Automated Decision Making: Be informed about and object to automated decisions

To exercise any of these rights, please contact us at privacy@HomeSafeHeaven.com. We will respond within one month of receiving your request.

2.3 Data Protection Impact Assessments (DPIA)

We conduct Data Protection Impact Assessments for any high-risk processing activities to evaluate risks to data subjects and implement appropriate safeguards before processing begins.

2.4 Data Processing Agreements

We have Data Processing Agreements (DPAs) in place with all third-party service providers who process personal data on our behalf, ensuring they comply with UK GDPR requirements.

3. Data Protection Act 2018 (DPA 2018)

We comply with the Data Protection Act 2018, which supplements UK GDPR and provides additional provisions for:

• Law enforcement processing
• Intelligence services processing
• Processing of special category data
• Child protection and educational records

The DPA 2018 also establishes the powers of the Information Commissioner's Office (ICO) as the UK's independent data protection regulator.

4. Privacy and Electronic Communications Regulations (PECR)

We comply with PECR, which governs:

• Electronic Marketing: We only send marketing communications with your explicit consent, and you can unsubscribe at any time
• Cookies and Similar Technologies: We obtain your consent before placing non-essential cookies
• Security of Public Electronic Communications Services: We implement appropriate security measures
• Traffic and Location Data: We handle this data in accordance with regulations

For more details about our use of cookies, please see our Cookie Policy.

5. Data Security Standards

5.1 Encryption & Transmission Security

All data transmitted between your browser and our servers is encrypted using SSL/TLS protocols (HTTPS). Data stored on our servers is encrypted at rest using industry-standard encryption (AES-256).

5.2 Access Controls

Access to personal data is restricted to authorised personnel only, based on role-based access controls. Multi-factor authentication is required for access to sensitive data and administrative systems.

5.3 Data Breach Response

In the event of a personal data breach, we have procedures in place to:

• Immediately investigate and contain the breach
• Notify affected individuals where there is a high risk to their rights and freedoms
• Report the breach to the Information Commissioner's Office (ICO) within 72 hours where required
• Document the breach and implement corrective measures to prevent recurrence

6. Data Retention and Disposal

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Our retention periods are:

• Enquiry Data: Up to 6 years from last contact (to maintain records of service)
• Loan Application Data: Up to 7 years after loan completion (for legal and regulatory purposes)
• Marketing Data: Until you withdraw consent
• Cookie Data: As specified in our Cookie Policy
• Website Usage Data: 12 months (anonymized thereafter)

At the end of the retention period, data is securely destroyed using certified methods, including secure deletion and shredding of physical records.

7. Cross-Border Data Transfers

Your personal data may be transferred to and stored in countries outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Transfers to countries with adequacy decisions from the UK government
• Standard Contractual Clauses (SCCs) approved by the ICO
• Binding Corporate Rules (BCRs) for group companies
• Other appropriate safeguards as required by UK GDPR

8. Information Commissioner's Office (ICO)

The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection. You have the right to lodge a complaint with the ICO if you believe your data protection rights have been violated.

We encourage you to contact us first to address any concerns before contacting the ICO.

9. Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to oversee our data protection compliance and handle data subject requests.

10. Third-Party Compliance

We work with trusted third-party service providers who assist us in operating our business, including:

• IT and cloud service providers
• Data verification and credit reference agencies
• Customer support platforms
• Analytics and marketing services (with consent)
• Lending partners (who act as independent Data Controllers)

All third-party service providers who process personal data on our behalf are contractually obligated to comply with UK data protection laws and maintain appropriate security measures.

11. Children's Data

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

12. Automated Decision Making

We do not use automated decision-making processes that significantly affect you. Our matching service involves human review of your enquiry before connecting you with lending partners. However, lending partners may use automated systems to assess loan applications, and their privacy policies will explain these practices.

13. Policy Updates and Transparency

We regularly review and update our data protection policies to reflect changes in law, technology, or our business practices. Updates are posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

Material changes to how we process your data will be communicated directly where required by law.

14. Contact for Data Protection Inquiries

For questions about this policy, how we handle your data, or to exercise your data protection rights, please contact:

15. Right to Complain

If you are not satisfied with our response to a data protection concern, you have the right to complain to the Information Commissioner's Office (ICO):

Certification

HomeSafeHeaven certifies that the information on this page is accurate and complete as of March 2026. We are committed to the highest standards of data protection and regulatory compliance in the United Kingdom.