Privacy Policy

1. Who we are

This Privacy Policy explains how Hubble Money ("we", "us", "our") collects, uses, and protects personal data when you use our website at hubblemoney.co.uk or submit an enquiry through our forms.

We are the data controller for the personal data we collect through this website. If you have any questions, you can reach us at info@hubblemoney.co.uk.

2. What data we collect

Depending on which enquiry you complete, we may collect:

• Identity data: first name, last name, age of the youngest homeowner.
• Contact data: email address, phone number, postal address, postcode.
• Property and financial data: estimated property value, mortgage balance, mortgage type, employment status, income, loan purpose, loan amount.
• Consent data: a record of when you consented to be contacted by us or our partners.
• Technical data: IP address, browser type and version, device information, referring URL.
• Marketing attribution data: UTM parameters (source, medium, campaign), Facebook click IDs (fbclid), and cookies set by our marketing partners (see our Cookie Policy).

3. Why we collect it and our lawful basis

We process your data on the following lawful bases under UK GDPR:

• Consent (Article 6(1)(a)): when you tick the contact consent box on a form, we rely on your consent to share your enquiry with regulated mortgage and equity release advisers so they can contact you about your enquiry.
• Performance of a contract (Article 6(1)(b)): to provide the lead-introduction service you have asked for.
• Legitimate interests (Article 6(1)(f)): to operate, secure, and improve our website, to measure marketing effectiveness, and to keep records required by financial services regulation.
• Legal obligation (Article 6(1)(c)): to retain records where required by UK law, including for anti-fraud and financial crime purposes.

4. Who we share your data with

We share your data only with the following categories of recipient:

• Authorised mortgage and equity release advisers: firms regulated by the Financial Conduct Authority (FCA) who will contact you about your enquiry. We share only the data needed for them to do this.
• Hosting and infrastructure providers: Vercel Inc. (United States) hosts our website; Supabase Inc. (United States; databases primarily in the EU) hosts our application database and serverless functions.
• Communication providers: Calendly LLC (United States) powers our online booking calendar; we use a transactional SMS provider to send SMS notifications related to your enquiry.
• Address lookup: Crafty Clicks Ltd (United Kingdom) provides UK postcode-based address lookup. We share the postcode you enter so it can return matching addresses.
• Marketing and analytics: Meta Platforms Inc. (Facebook) receives event data via the Meta Pixel and Conversions API to measure ad performance and prevent ad fraud. Hashed identifiers (email, phone, name, IP) are sent so Meta can attribute conversions; you can opt out of personalised advertising in your Facebook account settings.
• Workflow automation: Zapier Inc. (United States) may route lead notifications to our internal team and partner inboxes.

We do not sell your personal data. Our partners are bound by data-processing agreements and must process your data only for the purposes we have instructed.

5. International transfers

Some of the providers above are based outside the UK. Where personal data is transferred to a country that is not covered by UK adequacy regulations, we rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), supported by additional safeguards such as encryption in transit and at rest.

6. How long we keep your data

We keep enquiry data for up to 6 years after your last interaction with us, in line with FCA record-keeping expectations for financial services intermediation. Marketing attribution and cookie data is kept for up to 24 months. Technical access logs are kept for up to 90 days. After these periods, data is deleted or anonymised.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate personal data corrected.
• Have your personal data erased (the "right to be forgotten"), where applicable.
• Restrict or object to our processing of your personal data.
• Receive a copy of your personal data in a portable format.
• Withdraw consent at any time, where we rely on consent. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, email info@hubblemoney.co.uk. We will respond within one month.

8. Security

We use industry-standard technical and organisational measures to protect your personal data, including TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews. No internet transmission is ever 100% secure; if we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify you directly.

9. Cookies

Our website uses cookies and similar technologies. For details on which cookies we use and how to manage them, see our Cookie Policy.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@hubblemoney.co.uk so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated where required.