Privacy policy
Here’s everything you need to know about our website’s privacy policy. Please take a moment to read it. If you have any questions, email us at help@muttuomortgages.com.
Who we are
We are Muttuo Mortgages, an online mortgage broker. Muttuo Mortgages trades under the name of Fitch & Fitch Ltd, which is an appointed representative of JLM Mortgage Network Ltd, authorised and regulated by the Financial Conduct Authority (FCA), registration numbers 955014 and 300629. You can find more details at www.fca.org.uk.
Muttuo Mortgages operates this website. As a controller, Fitch & Fitch Ltd (“Fitch & Fitch”, “we”, “us”, “our”) complies with all relevant data protection and privacy legislation in force from time to time, including the UK General Data Protection Regulation, the EU General Data Protection Regulation (where applicable) (together, the “GDPR”), and the Data Protection Act 2018 (“DPA18”). This privacy notice explains how we process your personal data.
Fitch & Fitch may designate registered professionals to provide our services to you. During the business relationship, the registered professional acts as a joint controller of the personal data processed.
Under the UK GDPR, we are required to notify the Information Commissioner’s Office (“ICO”) of our use of personal data. You can view our current controller registration on the ICO website here:
https://ico.org.uk/ESDWebPages/Entry/ZB147011
We place great importance on ensuring the quality, confidentiality, integrity, and availability of the data we hold, and on meeting our data protection obligations when processing personal data. Fitch & Fitch is committed to safeguarding the security of your personal data. We employ a range of technical and organisational measures to protect your personal data from unauthorised access, use, or disclosure.
We collect personal data about a range of people:
- Visitors to our websites
- People who contact us (enquirers)
- Customers (including customers of the businesses operating under us)
- Contractors and suppliers
If you are applying or have applied to work with us, please consult our job applicant privacy notice.
What personal information we process
We process personal information to act as an intermediary in financial transactions, usually advising customers and applying for property finance, such as mortgages, on their behalf. The same applies to advising on and arranging insurance policies.
To understand how any personal information other than that provided to us through this website is processed, you will need to refer to any personal communications you receive from us, review any privacy documents provided when entering into a contract with us, or contact us to ask about your personal circumstances.
Website enquiries
When you contact us, we request some personal details. You are under no obligation to provide this information. However, providing it helps us provide the information or services you request, or to notify you of any further details needed to facilitate that service.
If we wish to use your information for any purpose other than those stated above, we will contact you.
At a minimum, we will retain your name and phone number for the purposes set out above. If you do not become a customer, your information will be deleted in accordance with our retention policy.
Visitors to our website
We use Google Analytics on our website (www.muttuomortgages.com) to collect statistics that help us provide visitors with the best experience. IP addresses are recorded to understand how users interact with our site. Our website uses cookies, which are small pieces of information stored on a visitor’s computer and sent back to the website each time the visitor returns.
We use cookies to identify and track visitors and their website access preferences. Visitors can manage which cookies are stored in their browser by adjusting their cookie settings via the cookie controller button in the bottom-left corner of our website.
Virtual adviser
We use the details you provide to illustrate indicative costs and confirm where they should be sent. Mortgage products are sourced via Twenty7Tec. Once you receive your indicative terms, you can decide whether you want to be contacted by one of our Muttuo advisers. They will discuss your eligibility for the mortgage product and confirm how you would like to proceed. We will not contact you without your prior consent.
Our customers’ views
We would like to hear your opinions on the service you received from us and any improvements you believe are necessary. We use Trustpilot as a data processor to gather customer feedback on our behalf and to support our marketing efforts. If you agree to assist us, we will share your name and email address with Trustpilot so they can send you a review invitation and verify that you are a genuine customer of Muttuo Mortgages.
Regulatory functions and reporting
As a regulated firm, we are required to retain and provide information to the FCA on a regular basis. We must also share regulatory data with our principal firm, JLM Mortgage Network Ltd. Most of this information is provided to us under the Financial Services and Markets Act 2000. JLM Protection Ltd may contact you regarding your protection arrangements as part of the group’s regulatory functions.
Purposes & bases for using your personal data
We will use your personal data only when permitted by law.
Most commonly, we will use your personal information for the following purposes and lawful bases:
Purpose
We carry out due diligence on our customers and conduct risk assessments. This includes standard affordability checks for the mortgage and insurance products we recommend to you.
Lawful basis for processing
Necessary to comply with the legal obligations to which we are subject.
Our legitimate business interest to assess the risk associated with providing you with our services.
When processing sensitive personal data, we do so with your explicit consent.
Purpose
Legal and regulatory compliance involves responding to law enforcement requests. This includes using biometric facial recognition to confirm your identity, conducting checks and monitoring transactions to prevent and detect crime, and complying with laws related to money laundering and fraud. It also involves sharing information with law enforcement and regulatory authorities about suspected financial crimes, fraud, and threats.
Lawful basis for processing
Necessary to adhere to the legal obligations we are subject to.
When handling sensitive personal data, we do so only with your explicit consent.
Purpose
Providing you with our mortgage and insurance advisory and administrative services, including any services we offer to private customers.
Lawful basis for processing
Necessary for the execution of the contract agreement to which you are a party.
Purpose
Maintaining a record of and monitoring customers who consider themselves to be, or are regarded as, vulnerable.
Lawful basis for processing
Necessary to comply with FCA guidance on the fair treatment of vulnerable customers.
Purpose
When processing sensitive personal data, we do so with your explicit consent, which you may withdraw at any time.
Lawful basis for processing
It is essential to follow FCA guidance on the fair treatment of vulnerable customers. When handling sensitive personal data, we do so only with your explicit consent, which you may withdraw at any time.
Purpose
Managing and developing our relationship with you includes providing account management, seeking your feedback, and inviting you to take part in customer satisfaction surveys.
Lawful basis for processing
Our legitimate business interests are to strengthen our relationship, gather your feedback, assess your level of customer satisfaction, and enhance our services.
Purpose
Sending you marketing information about our related products and services, our news and events. This includes sending you our news emails, details about our additional services, relevant information that may interest you, and invitations to our events.
Lawful basis for processing
Our legitimate business interest is to send you marketing and promotional materials occasionally. This includes providing no-obligation quotes for loan protection insurance.
Where we have received your consent to send marketing, we rely on that consent as the lawful basis.
You can stop receiving marketing communications at any time by objecting or withdrawing your consent. You can do this by contacting us at compliance@fitchandfitch.co.uk or by clicking the unsubscribe link in any marketing email from us.
Purpose
Internal management, administrative and organisational purposes. This includes maintaining internal records and performing other administrative tasks.
Lawful basis for processing
Our legitimate business interest is to process your personal data in order to manage and enhance our business processes.
Purpose
Statistics and other data analysis. This includes creating forecasts and business plans, enhancing our services, and developing new ones.
Lawful basis for processing
Our legitimate business interest in processing your personal data is to develop and improve our business through aggregated, anonymised reporting and analysis.
Purpose
Sharing data within our group, including customer records and due diligence results, with our Appointed Representative entities.
Lawful basis for processing
Our legitimate business interest is to identify and develop shared customers across our network of advisers and to utilise existing due diligence and risk assessment information when providing services to our customers.
Purpose
Sharing data with third parties, including those who handle personal data on our behalf.
Lawful basis for processing
Our legitimate business interest in sharing your data with trusted third parties who provide us with services relevant to delivering our services to you, including professional advisers, screening service providers, and IT service providers.
Contractual
We process your personal information to provide mortgage and protection advice. In this instance, the process is straightforward: you ask us for mortgage advice, and we provide it. We would not be able to offer this advice or arrange your mortgage without this information.
Legitimate Interest
We will process your personal information only when our interest in doing so is not outweighed by your privacy rights or interests. This means we can use your personal data in ways you would reasonably expect and that have minimal impact on your privacy, or when there is a strong reason for the processing.
When it comes to staying in touch, we rely on legitimate interests because we only contact existing customers or people who have contacted us directly and expect us to do so. Each communication offers an easy-to-use opt-out.
Legal Compliance
We may need to process your data to comply with our legal obligations as a Financial Conduct Authority (FCA)-regulated business. For example, we might need to verify your identity, comply with anti-money laundering laws, and cooperate with law enforcement, in legal proceedings, or with regulatory bodies.
Sharing your information
We occasionally need to share personal information with other organisations. When necessary, we must comply with all aspects of the UK GDPR.
What follows is a description of the types of organisations with which we may need to share some of the personal information we process for one or more reasons. When a joint application is made, we are unable to restrict data sharing between applicants.
Fitch and Fitch Ltd will only collect the necessary information to provide you with marketing and consulting services. We do not sell or broker your personal data.
Where necessary or legally required, we share information with:
Associates and representatives of the individual whose personal data we process include, but are not limited to, estate agents (if you were introduced by one of our agent partners), solicitors, accountants, and other professionals. It also covers financial organisations, the Financial Conduct Authority (FCA), the Financial Ombudsmen Service (FOS), law enforcement and prosecuting authorities, credit reference agencies, debt collection and tracing agencies, other companies within the same group, our service providers, courts and tribunals, researchers, consultants, advisory services, our professional advisers, and His Majesty’s Revenue & Customs (HMRC).
Further disclosure
We may occasionally share your personal information with third parties solely to perform tasks on our behalf, such as a data destruction provider. We always ensure these parties agree to handle this information following our instructions and in compliance with this Privacy Notice and the UK GDPR.
How we protect your data
Fitch and Fitch Ltd take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and that it is accessed only by our employees in the performance of their duties. When we engage third parties to process personal data on our behalf, they do so under written instructions, are bound by a duty of confidentiality, and must implement appropriate technical and organisational measures to safeguard the data.
Registered individuals
When engaged in a business relationship with Fitch and Fitch Ltd, both the Registered Individual and Fitch and Fitch Ltd act as joint controllers of the customer data they handle. During this relationship, all requests related to data subject rights or incidents affecting personal data security will be managed jointly by Fitch, Fitch Ltd, and the Registered Individual in a transparent manner, with their respective data protection compliance responsibilities agreed at the time of the request or incident. Upon termination of our business relationship, both Fitch and Fitch Ltd and the Registered Individual, as independent controllers, assume full control of customer personal data and related data protection compliance obligations.
How long we retain personal data
To ensure we fulfil our legal, regulatory, and customer obligations, we will retain customer information for the periods specified below.
An introductory enquiry from someone with whom we have only had limited interaction is kept for 90 days.
Any survey information collected from enquirers or customers is retained for 18 months. Any mortgage enquiry, application, and completion are retained indefinitely. Any enquiry, application, and policy completion for life or critical illness insurance products are also retained indefinitely.
International transfers
It is unlikely that we will ever share your personal data outside the UK or the European Economic Area (the EU member states plus Norway, Iceland, and Liechtenstein) (“EEA”). However, if it becomes necessary to do so to provide our services to you, we will only share it with organisations in countries that have a European Commission (“EC”) adequacy decision, approved by the UK ICO, or with organisations that are based on EC Standard Contractual Clauses, also approved by the UK ICO, which, when reinforced with additional supplementary measures, contractually obliges the recipient to process and protect your personal data to the standards expected within the UK and EEA.
Your rights
At any point while Fitch and Fitch Ltd are in possession of or processing your personal data, all data subjects have the following rights:
Right of access: You have the right to request a copy of the information we hold about you.
Right of rectification: You have the right to correct any inaccurate or incomplete information we hold about you.
Right to be forgotten: In certain circumstances, you can ask us to erase the information we hold about you from our records.
Right to restriction of processing: Where certain conditions apply, you have the right to restrict the processing of your personal data.
Right of portability: You have the right to have the information we hold about you transferred to another organisation.
Right to object: You have the right to object to certain types of processing, such as direct marketing.
Right to object to automated processing, including profiling: You have the right not to be subject to the legal effects of automated processing or profiling.
You have the right to access your personal information (subject to certain exemptions). If you wish to find out what information we hold about you, please contact us using the details below.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If we refuse your access request, we will provide a reason, which you have the right to legally challenge.
Automated decision making
We do not make customer or supplier decisions based solely on automated decision-making.
Contact us
This privacy policy notice does not provide a comprehensive overview of all aspects of the collection and use of personal information. However, we are happy to provide any additional information or clarification you need. If you have any questions or complaints, please contact us at:
Data Protection Manager
Fitch and Fitch Ltd,
340 The Crescent
Severalls Business Park
Colchester
Essex
CO4 9AD
Telephone 020 7859 4098 or email privacy@fitchandfitch.co.uk
What if I am still not satisfied?
If you are not satisfied with Fitch and Fitch Ltd’s response to your enquiry, you can complain to the Information Commissioner’s Office (ICO), the regulator for data protection in the United Kingdom: https://ico.org.uk/for-the-public/
Changes to this privacy notice
We update this notice regularly to reflect changes to relevant laws and regulations, our processing practices, and the products and services we provide. When updates occur, we will revise our notice at www.muttuomortgages.com/privacy-policy. Please review this notice regularly to stay informed of any changes.
Last updated: 1st June 2026