Privacy Policy
JC Mortgages Limited
Go to:
1. About us
JC Mortgages Limited, referred to in this Data Privacy Notice as “JC Mortgages”, “we”, “us” or “our”, provides mortgage and insurance intermediary services in Ireland.
Our contact details are:
JC Mortgages Limited
24 Millrace Road
Phoenix Park Racecourse
Castleknock
Dublin 15
Ireland
Telephone: 01 810 2032
Email: info@jcmortgages.ie
Website: www.jcmortgages.ie
JC Mortgages Limited is regulated by the Central Bank of Ireland.
For the purposes of applicable data protection law, JC Mortgages Limited is the data controller of personal data that we collect and use in connection with our mortgage and insurance intermediary services, our website and the operation of our business.
2. Contact details
If you have any questions about this Data Privacy Notice, wish to exercise any of your data protection rights or have concerns about how we use your personal data, please contact:
Data Privacy Contact
JC Mortgages Limited
24 Millrace Road Apartments
Phoenix Park Racecourse
Castleknock
Dublin 15
Ireland
Telephone: 01 810 2032
Email: info@jcmortgages.ie
Person responsible for data protection matters
The person currently responsible for dealing with data protection matters within JC Mortgages is:
Name/role: John Coleman, Owner
Email: john@jcmortgages.ie
Postal address: 24 Millrace Road Apartments, Phoenix Park Racecourse, Castleknock, Dublin 15, Ireland.
3. Purpose of this Data Protection Statement
This Data Privacy Notice explains how JC Mortgages collects, obtains, uses, stores, discloses, transfers and otherwise processes personal data.
For the purposes of this statement:
“Personal data” means any information relating to an identified or identifiable living individual. A person may be identifiable directly or indirectly, including by reference to a name, identification number, online identifier, location information or factors relating to that person’s physical, economic, social or other identity.
This statement is intended to provide the information required under applicable data protection law, including the General Data Protection Regulation and the Irish Data Protection Act 2018.
It explains:
- what personal data we process;
- where we obtain it;
- why we process it;
- the legal bases on which we rely;
- who we may disclose it to;
- whether it may be transferred outside the European Economic Area;
- how long we retain it;
- the rights available to individuals; and
how to contact us or make a complaint.
4. Who this data protection statement applied to
Information about other people
Where you provide us with personal data about another person, you should:
- ensure that you are authorised or otherwise permitted to provide the information;
- tell the person that you are providing their information to us;
- direct the person to this Data Privacy Notice; and
- provide any additional notice required in the circumstances.
Providing information about another person does not remove our responsibility to provide that person with appropriate transparency information where required by law.
5. Sources of personal data
The personal data we process will depend on the service requested and your circumstances.
Category | Typical Data Points |
Identity Data | Full name, title, date of birth, marital/civil status, PPS number, nationality, passport/driving license copies, signature. |
Contact Data | Residential address, previous addresses, correspondence address, email address, telephone numbers. |
Financial Data | Gross/net income, payslips, employment contracts, bank statements, savings, borrowings/loans, credit history, assets, liabilities, source of wealth/funds |
Employment Data | Employer name/address, job title, employment status, length of service, salary certificates, self-employed accounts/tax returns. |
Household & Family Data | Number and ages of dependents, spousal details, residency/citizenship status. |
Special Category Data | Health and medical information (strictly where required for arranging life assurance, mortgage protection, or serious illness cover). |
Technical & Usage Data | IP address, browser type, operating system, pages visited, access times, and cookie identifiers.
|
6. Categories of personal data
The personal data we process will depend on the service requested and your circumstances.
Category | Typical Data Points |
Identity Data | Full name, title, date of birth, marital/civil status, PPS number, nationality, passport/driving license copies, signature. |
Contact Data | Residential address, previous addresses, correspondence address, email address, telephone numbers. |
Financial Data | Gross/net income, payslips, employment contracts, bank statements, savings, borrowings/loans, credit history, assets, liabilities, source of wealth/funds |
Employment Data | Employer name/address, job title, employment status, length of service, salary certificates, self-employed accounts/tax returns. |
Household & Family Data | Number and ages of dependents, spousal details, residency/citizenship status. |
Special Category Data | Health and medical information (strictly where required for arranging life assurance, mortgage protection, or serious illness cover). |
Technical & Usage Data | IP address, browser type, operating system, pages visited, access times, and cookie identifiers.
|
7. Our legal bases for processing personal data
We will only process personal data where we have a lawful basis.
Depending on the processing activity, we may rely on one or more of the following grounds.
7.1 Contract and steps before entering a contract
We process your Personal Data where necessary to perform our obligations under a contract with you, or to take steps at your request prior to entering into a contract (such as assisting you to secure a mortgage loan offer or suitability assessment from a product provider).
7.2 Legal obligation
We will need to process your Personal Data to comply with a legal obligation, for example the provision of mortgage advice, anti-money laundering checks, sanctions screening, record keeping, responding to the Central Bank of Ireland, Revenue, and other statutory bodies.
7.3 Legitimate interests
We may need to process your Personal Data to pursue our legitimate business interests, for example for administrative purposes, to provide information to you, to expand our business opportunities, to operate, evaluate, maintain, develop and improve our website and services or to maintain their security and protect intellectual property rights.
We will not process your Personal Data on a legitimate interest basis where the impact of the processing on your interests or fundamental rights and freedoms outweigh our legitimate interests.
You may object to any processing we undertake on this basis. If you do not want us to process your Personal Data on the basis of our legitimate interests, contact us at info@jcmortgages.ie and we will review our processing activities
7.4 Consent
For certain processing activities we may rely on your consent.
Where we are unable to collect consent for a particular processing activity, we will only process the Personal Data if we have another lawful basis for doing so.
You may withdraw your consent at any time by contacting us.
7.5 Vital interests
In exceptional circumstances, we may process personal data where necessary to protect your vital interests or the vital interests of another person.
This basis would generally only be used in an emergency where another legal basis is unavailable.
8. Our processing activities
8.1 Health and Medical Information
In certain circumstances, particularly where you ask us to arrange protection, life assurance, specified serious illness, or income protection policies, we may process special category personal data, specifically health and medical information.
Under data protection law, this data receives a higher level of protection. We will only collect and process health information where:
· It is strictly necessary to assess, source, or arrange the product or service you requested;
· A valid legal basis applies under Article 6 GDPR (such as pre-contractual steps or our legal/regulatory duties); and
· An authorised condition under Article 9 GDPR applies, which will typically be:
o Your explicit consent;
o The establishment, exercise, or defence of legal claims; or
o Another condition expressly permitted under Irish data protection law (such as the Data Protection Act 2018).
Where we rely on your explicit consent to process health data, you have the right to withdraw that consent at any time by contacting us in writing. Please note that withdrawing consent may mean we are unable to continue processing your application for certain insurance or protection products.
Where possible, we encourage or facilitate the direct submission of detailed medical information to the product provider. Any insurer or assurance company receiving your medical data acts as an independent data controller for underwriting, policy issuance, claims management, and administration. You should review the relevant product provider’s Data Privacy Notice for details on how they process your data.
8.2 Criminal-offence data
We will only process information relating to criminal convictions or offences where authorised by law and where appropriate safeguards apply.
8.3 Data minimisation
You should only provide special category or other highly sensitive information where it is relevant and necessary for the service requested.
9. Special category personal data
In certain circumstances, where necessary and lawful, we may disclose Personal Data to third parties as follows:
- mortgage lenders and other credit providers
- insurers, assurance companies and other product providers
- service providers that support our business, such as IT, cloud storage, CRM, email, document management, hosting, print/post and backup providers
- identity verification, anti-money laundering, sanctions, fraud prevention and compliance support providers
- accountants, solicitors, auditors and other professional advisers
- employers, accountants or solicitors involved in your application, where relevant
- introducers or referrers, where this is lawful and necessary
- regulators, ombudsmen, law enforcement agencies, courts and statutory bodies, including the Central Bank of Ireland, the Financial Services and Pensions Ombudsman, Revenue and An Garda Síochána, where required or permitted by law
10. Disclosure of personal data
We only use your personal data where we have a lawful basis to do so, as set out in the table below:
Purpose | Examples | Legal Basis |
To respond to your enquiry and take steps before entering into a contract with us | Discussing your requirements, collecting fact find information, obtaining quotes, assessing eligibility. | Performance of a contract or taking steps at your request before entering into a contract. |
To provide mortgage, insurance, life assurance, pension and investment intermediary services | Providing advice; assessing your requirements; assessing suitability, recommending products or services; obtaining quotations; arranging applications; administering your file; communicating with you and relevant product providers throughout the process. | Performance of a contract or taking steps at your request before entering into a contract. |
To comply with legal and regulatory obligations | Customer due diligence and identity verification; verification of identity and address; anti-money laundering and counter-terrorist financing checks; sanctions screening; verification of source of funds or source of wealth where required; fraud prevention and detection. | Compliance with a legal obligation. |
To manage and protect our business | File administration, complaints handling, systems security, fraud prevention, staff training, compliance oversight, audits and legal claims. | Legitimate interests and/or compliance with legal obligations, as applicable. |
To record and manage customer communications | Where applicable, recording, transcribing or summarising customer communications and using technology to assist with maintaining accurate customer records and administering our services. | Performance of a contract or taking steps before entering into a contract; legitimate interests in maintaining accurate customer records and administering our services |
To send direct marketing | Sending information about products or services that may be relevant to you. | Your consent where required by law, or another lawful basis permitted under applicable marketing and data protection law. |
To operate and improve our website and digital services | Website operation and security, troubleshooting, performance monitoring and analytics. | Legitimate interests for website operation and security. Consent where required for analytics, cookies or similar technologies. |
11. Security measures
We will take all steps reasonably necessary to ensure that all Personal Data is treated securely in accordance with this Data Privacy Notice and the relevant law, including the GDPR.
In particular, we have put in place appropriate technical and organisational procedures to safeguard and secure the Personal Data we process.
We monitor for and do everything we can to prevent security breaches of the Personal Data that we process.
Once we have received your Personal Data, we will use strict procedures and security features for the purpose of preventing unauthorised access and ensuring that only those who need to have access to your Personal Data can access it.
12. Transfers outside the European Economic Area
Some personal data may be accessed, supported or processed outside the European Economic Area.
Based on our current operations, this may include access or processing involving:
- IT or admin support personnel in India;
- Admin support from a freelance contractor in the Philippines;
- team members working from Brazil; and
- international service providers, including Microsoft, Monday.com and Paperform.
The location of data processing may change where a service provider changes its infrastructure, sub processors or support arrangements.
Where we rely on the Standard Contractual Clauses under Article 46.2 of the GDPR adopted by the EU Commission, we will also assess whether the laws and practices of the destination country may affect the effectiveness of the safeguard and whether supplementary measures are required.
You may contact us for further information about:
- the countries to which personal data is transferred;
- the categories of overseas recipients;
- the transfer mechanism relied upon; and
- how to obtain a copy of or information about the relevant safeguards.
Commercially sensitive or security-related information may be redacted where appropriate.
13. Cookies and similar technologies
Cookies are small text files placed on your computer or mobile device by websites that you visit, and they help us improve the products and services that we offer you. They are used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Cookies may allow a website to remember your activity over a period of time. Cookies are optional and you do not have to accept them.
Further information on the cookies we use on the website and the purpose behind their respective uses are set out in our Cookie Policy.
14. Third-party websites and platforms
Our website and communications may contain links to external platforms, including mortgage lenders, insurers, financial calculation tools, and social media platforms. These third parties operate as independent data controllers with their own Data Privacy Notice. We are not responsible for their data collection practices
15. Retention of personal data
Our general retention approach is set out below.
15.1 Regulated customer and transaction records
Where we provide, arrange or advise on a regulated financial service, relevant records will generally be retained for six years after:
- the end of the customer relationship or the last service provided;
- completion of the relevant transaction;
- discontinuance of the application.
A longer period may apply where:
- required by law or regulation;
- directed by a regulator;
- a complaint or legal claim is ongoing or reasonably anticipated;
- the record relates to a continuing product or relationship; or
- another lawful reason requires continued retention.
15.2 Prospective customers and unsuccessful applications
Where you make an enquiry or request a service but do not become a customer, we will generally retain the relevant information for up to 12 months after the last meaningful contact or discontinuance of the enquiry or application.
A different period may apply where:
- you have requested follow-up contact;
- you have consented to a longer period, (i.e., marketing consent);
- regulatory requirements apply;
- the records are required for a complaint or legal claim; or
- another lawful basis supports the retention.
15.3 Anti-money laundering records
Customer due diligence, identity-verification and transaction records will be retained for the period required under applicable anti-money laundering legislation.
Records may be retained for a longer period where permitted or required by law or where a competent authority directs them to be retained.
15.4 Complaints and disputes
Complaint and dispute records will be retained for as long as necessary to:
- investigate and resolve the matter;
- comply with regulatory requirements;
- respond to an ombudsman or regulator; and
- establish, exercise or defend legal claims.
15.5 Marketing records
Marketing information will generally be retained until:
- you withdraw consent;
- you object to direct marketing;
- the information is no longer accurate or relevant; or
- we determine that there has been no meaningful engagement for an appropriate period.
We may retain a minimal suppression record after an opt-out to ensure that further marketing is not sent contrary to your wishes.
15.6 Website and analytics information
Website logs, analytics data and cookie information will be retained according to:
- the purpose of the relevant technology;
- the configuration of the service;
- the cookie duration shown in our Cookie Policy; and
- security and legal requirements.
15.7 Secure deletion and anonymisation
At the end of the applicable retention period, personal data will be:
- securely deleted;
- securely destroyed; or
- irreversibly anonymised,
unless continued retention is required or permitted by law.
16. Your data protection rights
Your rights depend on the circumstances and the legal basis on which we process your information. A right may be subject to restrictions or exemptions under applicable law.
16.1 Right of access
You may request:
- confirmation as to whether we process your personal data;
- a copy of your personal data; and
- information about how it is processed.
The first copy will generally be provided free of charge. A reasonable fee may be charged for additional copies or where a request is manifestly unfounded or excessive, where permitted by law.
We may withhold or redact information where disclosure would adversely affect the rights and freedoms of another person or where another lawful restriction applies.
16.2 Right to rectification
You may ask us to correct inaccurate personal data or complete incomplete personal data.
We may need to verify the corrected information before changing our records.
16.3 Right to erasure
You may ask us to erase personal data in certain circumstances, including where:
- it is no longer necessary for the purpose for which it was collected;
- you withdraw consent and no other lawful basis applies;
- you successfully object to processing;
- the information has been unlawfully processed; or
- erasure is required by law.
The right to erasure does not apply in all circumstances. We may retain information where necessary:
- to comply with a legal obligation;
- for the establishment, exercise or defence of legal claims;
- for regulatory record-keeping;
- for public-interest purposes recognised by law; or
- where another lawful exemption applies.
16.4 Right to restriction
You may ask us to restrict processing where:
- you contest the accuracy of the personal data;
- the processing is unlawful and you prefer restriction to erasure;
- we no longer need the information, but you require it for a legal claim; or
- you have objected to processing and the objection is being considered.
Restricted personal data will generally only be stored unless:
- you consent to another use;
- it is required for a legal claim;
- it is required to protect another person’s rights; or
- an important public-interest reason applies.
16.5 Right to data portability
Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format.
You may also request that it be transmitted directly to another controller where technically feasible.
This right does not apply to all personal data and must not adversely affect the rights and freedoms of another person.
16.6 Right to object to legitimate-interest processing
You may object to processing based on legitimate interests.
We will stop the processing unless:
- we demonstrate compelling legitimate grounds that override your interests, rights and freedoms; or
- the processing is necessary for the establishment, exercise or defence of legal claims.
16.7 Right to object to direct marketing
You may object to direct marketing at any time.
Where you object, we will stop using your personal data for direct marketing purposes.
16.8 Right to withdraw consent
Where we rely on consent, you may withdraw it at any time.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Withdrawal of consent may mean that we cannot continue a particular optional service or activity. We will explain the consequences where relevant.
16.9 Rights relating to automated decision-making
You may have the right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects or similarly significantly affects you.
Further information is provided in section 18.
16.10 Exercising your rights
To exercise a right, contact:
Email: info@jcmortgages.ie
Telephone: 01 810 2032
Post: JC Mortgages Limited, 24 Millrace Road Apartments, Phoenix Park Racecourse, Castleknock, Dublin 15, Ireland
Please identify:
- the right you wish to exercise;
- the personal data or processing activity concerned; and
- any information that will help us locate the relevant records.
16.11. Identity verification
We may ask for information that is reasonably necessary to confirm your identity.
This is intended to ensure that personal data is not disclosed to or altered at the request of an unauthorised person.
We will not request more identity information than is reasonably necessary.
16.12 Response period
We will generally respond without undue delay and within one month of receiving a valid request.
The period may be extended by up to two further months where permitted by law, taking account of the complexity and number of requests. We will tell you if an extension is required and explain the reason.
16.13 Refusal or fee
Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may:
- charge a reasonable fee; or
- refuse to act on the request, where permitted by law.
If we refuse a request, we will explain the reason and inform you of your right to complain to the Data Protection Commission and seek a judicial remedy.
16.14 Complaint
If you have a concern about how we use your personal data, please contact us first and we will try to resolve it.
You also have the right to make a complaint to the Data Protection Commission.
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Website: www.dataprotection.ie
17. Direct marketing
We will only send direct marketing where it is lawful to do so.
Depending on the circumstances, we may rely on:
- your consent; or
- another basis permitted by applicable electronic-marketing and data protection law.
You may stop direct marketing by:
- using an unsubscribe link in an electronic communication;
- replying to the communication;
- emailing info@jcmortgages.ie; or
- contacting us by telephone or post.
18. Automated decision making and profiling
We may use technology, including automated tools and artificial intelligence-enabled systems, to assist us in processing, organising and summarising information provided by you. These tools may support administrative processes and assist our staff and advisers in reviewing information relevant to your mortgage or financial services requirements.
These tools are used to support our staff and advisers and do not replace their professional judgement. We do not make decisions about you solely by automated means where those decisions produce legal effects or similarly significant effects.
However, lenders, insurers and other product providers may use automated systems when assessing applications, pricing, underwriting, fraud risk or eligibility. Where relevant, those providers will explain that processing in their own Data Privacy Notice.
19. Amendments to this data protection statement
We may amend this Data Privacy Notice from time to time to reflect changes in:
- our services;
- our processing activities;
- our systems;
- our suppliers;
- our organisational structure;
- applicable law;
- regulatory requirements; or
- guidance from a supervisory authority.
The current version will be published on our website.
We will post any changes on the Website and when doing so will change the effective date at the top of this Data Privacy Notice.
In some cases, we may provide you with additional notice of changes to this Data Privacy Notice, such as via email. We will always provide you with any notice in advance of the changes taking effect where we consider the changes to be material.