Privacy

DFM Data Privacy Notice 2026 · Version 2.8 · Effective 28 September 2026

The important points

• DFM is responsible for your information. Direct Financial Management UK Ltd is the data controller for the personal information it uses to provide its services.
• People make the decisions. Artificial intelligence may assist with limited checking, calculation and drafting tasks, but it does not decide advice, suitability, affordability, lender acceptance or any other regulated outcome.
• AI assistance is optional for you. You may decline the restricted AI route for your mortgage case even when it is authorised. You will receive the same mortgage service through the human/manual route without service detriment.
• Acre remains the client record. Approved records and human decisions are kept in DFM's controlled client system; an AI chat is not the client file.
• Ask us. You can request more detail, exercise your rights or raise a concern using the contact details below.

1. Who we are

Direct Financial Management UK Ltd is authorised and regulated by the Financial Conduct Authority (FCA), firm reference number 968081. We are registered in Scotland under company number SC524172.

We have not appointed a separate Data Protection Officer. Please direct privacy questions and rights requests to the data protection contact above.

2. Who this notice covers

This notice covers prospective, current and former clients and people connected with an enquiry or case. That can include a joint applicant, guarantor, donor, dependant, representative, attorney, beneficial owner, director, employee, complainant or other person whose information is relevant to the service.

If you give us another person's information, please make sure you are allowed to do so and, where appropriate, make this notice available to them.

3. Information we may use

4. Where information comes from

• you, a joint applicant or a person authorised to act for you;
• employers, accountants, solicitors, conveyancers, estate agents, surveyors, donors or other people involved in your case;
• lenders, insurers, underwriters, reinsurers, product providers and their service partners;
• credit-reference, identity-verification, fraud-prevention and financial-crime checks where used;
• introducers or referrers, where you expect or authorise the introduction;
• public, regulatory and professional sources; and
• DFM's approved case-management, communications and supplier systems.

Where we obtain your information from someone else, we provide privacy information within the period required by data-protection law unless an exception applies.

5. Why we use information and our lawful bases

When we rely on legitimate interests, we consider necessity, proportionality and your reasonable expectations. You can ask for more detail or object. Declining DFM's optional AI route is available independently of the lawful basis for the underlying mortgage service.

Special-category and criminal-offence information

For health or other special-category information, we also identify an Article 9 condition. Where detailed health information is needed for a protection application, this may be your explicit consent. In another legally authorised activity, a substantial-public-interest condition under the Data Protection Act 2018 may apply and DFM must document the condition and any required Appropriate Policy Document before processing.

Criminal-offence information is processed only under Article 10 and an applicable Data Protection Act 2018 condition. DFM's routine AI route does not intentionally process health/vulnerability material or criminal-offence information; the default is suppression or a human/manual route.

6. Who may receive information

We disclose only what is reasonably necessary for the relevant purpose. Depending on the case, recipients may include:

• lenders, insurers, underwriters, reinsurers and other product providers;
• solicitors, conveyancers, valuers, surveyors, accountants, estate agents and other professionals involved in your transaction where appropriate;
• Acre and approved sourcing, application, identity-check, communications, document-storage, IT, cyber-security and support providers;
• our compliance support/network provider and professional advisers;
• OpenAI and its disclosed subprocessors, only after you choose an authorised AI route for the case and the task remains within DFM's approved scope;
• an introducer or representative only within the authority and disclosure limits applying to that relationship; and
• the FCA, Financial Ombudsman Service, Information Commissioner's Office, courts, law-enforcement bodies or other authorities where permitted or required.

A recipient may act as DFM's processor, an independent controller or, in limited circumstances, a joint controller. We use contractual, confidentiality, access and due-diligence controls where the law requires them.

7. DFM's controlled use of artificial intelligence

DFM may use a restricted ChatGPT Business route supplied by OpenAI for an authorised factual task after your route choice is recorded. The client task uses a fresh unpersonalised Temporary Chat outside Projects. DFM does not save or convert that chat, use web access, apps or connectors, or create a shared link for the task. David McGregor is the sole authorised operator for this route unless a later written decision changes that authority.

What the assistant may do

• extract and compare factual information from documents;
• identify missing, inconsistent or unclear information for human review;
• perform approved arithmetic or factual calculations using supplied information;
• prepare structured working notes and factual drafts; and
• support quality assurance while showing the source for material findings.

Current document boundary

The restricted R27 route covers an Acre mortgage fact find, lender application, driving licence, payslips, bank statements, ESIS and Home Report, only where needed for the authorised factual task. DFM minimises each input and suppresses unnecessary identifiers, account details, signatures, third-party information and criminal-offence material. A passport, protection health/vulnerability fact find or another new class needs separate assessment and written authority.

What the assistant must not decide

• advice, suitability, affordability, eligibility, recommendation or lender/product selection;
• lender acceptance, application progression, property acceptability or identity acceptance;
• vulnerability, capacity, coercion, authenticity, fraud, suspicion, AML/EDD/SAR or source-of-funds acceptability;
• a complaint, redress, compliance outcome or any other regulated or client decision; or
• a biometric identification or facial-comparison result.

David checks material facts, calculations and findings against the original evidence before any action or Acre record update. DFM does not use this AI route to make a solely automated decision about you that has legal or similarly significant effects.

Training, storage and deletion

OpenAI states that ChatGPT Business customer content is not used to train its models by default. The restricted DFM route prohibits saving or converting the Temporary Chat or deliberately saving its files to Library. A Temporary Chat remains outside ordinary history while unsaved; OpenAI may keep a copy for up to 30 days for safety. DFM keeps a checked final result in Acre where required under the case period. After checked filing, DFM removes active duplicate email and OneDrive working copies promptly and no later than 30 calendar days, subject to a legal or regulatory hold. This working-copy period does not promise simultaneous removal of recycle, recovery, backup or provider copies.

Your choice

Before any identifiable AI use, DFM will provide the effective privacy notice and matching AI summary and record their versions, delivery channel and time, and your route choice in Acre. A decline, later withdrawal or absence of a recorded choice means the manual route is used for future optional tasks, with no reduction in mortgage service. Your choice is a service safeguard; it is not blanket consent or the Article 6 lawful basis for mortgage advice. DFM relies on legitimate interests for the limited optional AI operation, and you may object to that processing.

8. International processing

Some suppliers or recipients may process information outside the United Kingdom. Where restricted transfers occur, DFM uses a lawful transfer mechanism as required, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate due diligence and security measures.

OpenAI and its subprocessors may process information outside the UK. DFM uses the applicable provider Data Processing Addendum and UK Addendum/SCC framework for this restricted Business route, with the relevant supplier and transfer controls recorded in its governance assessment. You may ask for more information about the safeguards, subject to lawful confidentiality and security redactions.

9. How long we keep information

DFM keeps information only for as long as needed for the purpose, taking account of FCA and other legal requirements, financial-crime rules, complaint and Financial Ombudsman timeframes, contractual obligations, insurer/lender requirements and the time reasonably needed to establish, exercise or defend legal claims. A legal, complaint, regulatory or incident hold may pause normal deletion.

You may ask DFM for the period or criteria applying to a particular record. The periods above are subject to a relevant legal, complaint, regulatory or incident hold. Recycle, recovery, backup and provider copies may follow different cycles; the 30-day active working-copy maximum is not a claim that every copy is purged by then.

10. How we protect information

• access limited to people who need it, using individual accounts and appropriate authentication;
• approved business systems, secure portals and controlled storage rather than personal workarounds;
• data minimisation, redaction/suppression and separate handling of sensitive information;
• supplier due diligence, contracts and international-transfer controls where required;
• human verification of material AI output and incident/change controls; and
• secure deletion or restriction when information is no longer required or is subject to a hold.

No security measure removes all risk. DFM records and assesses suspected personal-data incidents and makes notifications where the applicable legal threshold is met.

11. Your data-protection rights

Contact DFM to exercise a right. We may verify your identity proportionately. Rights are not absolute and we will explain any lawful limitation. We normally respond within one month, subject to the extensions allowed by law.

12. Questions and complaints

Please contact DFM first so we can investigate and try to resolve a privacy concern.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. A complaint about the regulated service may also fall within DFM's complaints process and, where eligible, the Financial Ombudsman Service.

13. If information is not provided

We may be unable to assess your needs, provide advice, complete required checks, submit an application or administer the service if information necessary for the service or a legal obligation is not provided. Declining the optional DFM AI route does not prevent the mortgage service; the human/manual route remains available.

14. Changes and accessible formats

DFM reviews privacy information when processing, law, suppliers or systems materially change. We will bring a material new use to your attention before starting it where required. Ask us if you need this notice in a different format or need support to understand it.