Y3S
Privacy Policy

SPECIALIST MORTGAGE GROUP

Group Privacy Notice

Covering: Specialist Mortgage Group • Y3S Loans • ChaseBlue Loans • Y3S Bridging & Commercial • B2B Financial • Finance That Flows

Last updated: July 2026

1. Important Information and Who We Are

Purpose of this Privacy Notice

Specialist Mortgage Group Limited (“SMG”) respects your privacy and is committed to protecting your personal data. This privacy notice explains how we collect and process your personal data when you visit any of our websites or use any of our services, and tells you about your privacy rights and how the law protects you.

Data Protection laws – specifically the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 – impose obligations on us as a Data Controller when we collect, hold, amend, share, use or erase personal data. Under those obligations we must process your personal data fairly, lawfully and in a transparent manner.

This privacy notice applies to personal data collected through your use of our websites, supply of our services, purchase of products, sign-up to our newsletter, or participation in competitions or marketing communications. It covers all brands and trading styles operated by the SMG Group.

Our website, services and products are not intended for children. We do not knowingly collect data relating to children unless it is relevant to a mortgage or equity release application, in which case we will notify you at the relevant time.

The SMG Group – Controller

SMG is the parent company of a group of authorised and regulated businesses. This privacy notice is issued on behalf of the entire SMG Group. When we mention “SMG”, “we”, “us” or “our”, we are referring to the relevant company in the SMG Group responsible for processing your data. We will let you know which entity is the data controller when you purchase a product or service from us.

The SMG Group comprises the following legal entities:

Specialist Mortgage Group Limited

• Company Number: 06743601
• Registered office: 9-10 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ
• Websites: www.specialistmortgagegroup.co.uk

B2B Loans and Mortgages Ltd trading as Y3S Loans, B2B Financial and Finance That Flows

• Company Number: 05752425
• Registered office: 9-10 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ
• FCA Firm Reference Number: 671163 (Credit Brokers)
• Websites: www.y3sloans.com, www.financethatflows.com

Savemoneycompare.com Ltd trading as Y3S Bridging & Commercial and FTO Bridging Loans

• Company Number: 07384994
• Registered office: 9 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ
• FCA Firm Reference Number: 729455 (Credit Brokers)

ChaseBlue Loans Ltd

• Company Number: 06219078
• Registered office: 37 Atlantic Business Park, Hayes Lane, Sully, CF64 5XU
• FCA Firm Reference Number: 713894 (Credit Brokers)
• Websites: www.chaseblueloans.co.uk

Certain types of loans are not regulated, for example loans for business purposes or certain buy-to-let loans.

Contact Details

For all data protection queries relating to any brand or entity within the SMG Group, please contact:

Specialist Mortgage Group Limited

9-10 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ

Telephone: 0800 014 7797

Email: barney@y3sgroup.com

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Third-Party Links

Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. It does not include anonymised data.

We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender
• Contact Data: billing address, delivery address, email address and telephone numbers
• Financial Data: income, expenditure, bank account and payment card details
• Transaction Data: details about payments to and from you and other details of products and services purchased from us
• Employment Data: details of your employment status and employer
• Technical Data: IP address, login data, browser type and version, time zone and location, browser plug-in types and versions, operating system and platform, and other technology on devices used to access our websites
• Profile Data: username and password, purchases or orders made by you, interests, preferences, feedback and survey responses
• Usage Data: information about how you use our websites, products and services
• Marketing and Communications Data: your preferences in receiving marketing from us and third parties, and your communication preferences

We also collect and use Aggregated Data (e.g. statistical or demographic data) for any purpose. Aggregated Data is not considered personal data in law as it does not directly or indirectly reveal your identity.

We collect Special Categories of Personal Data (specifically health and genetic data) only where required for equity release applications. We will notify you and seek your explicit consent before collecting such data. We do not collect information about criminal convictions or offences.

3. How Is Your Personal Data Collected?

We collect data through:

• Direct interactions: when you apply for products or services, create an account, subscribe to publications, request marketing, enter competitions, or provide feedback
• Automated technologies: cookies, server logs and similar technologies that automatically collect Technical Data as you interact with our websites (see Section 10 and our Cookie Policy)
• Third parties and public sources: analytics providers (e.g. Google), advertising networks (e.g. Barcadia Media), lenders and financial institutions, mortgage brokers, credit reference agencies, the Land Registry, Companies House, NIVO Hub ID & Messaging platform, and the Electoral Register

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly we will use it where:

• We need to perform a contract we are about to enter into or have entered into with you
• It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• We need to comply with a legal or regulatory obligation

We do not generally rely on consent as a legal basis for processing, other than for third-party direct marketing via email or text. You may withdraw consent to marketing at any time by contacting us or using the unsubscribe link in any marketing email.

Purposes for which we use your data include: registering you as a customer; processing and delivering your order; managing our relationship with you; enabling you to participate in competitions or surveys; administering and protecting our business and websites; delivering relevant content and advertising; data analytics; and making suggestions and recommendations about goods or services that may interest you.

5. Disclosures of Your Personal Data

We may share your personal data with:

• Other companies within the SMG Group acting as joint controllers or processors, based in the UK, providing IT and system administration services and leadership reporting
• Service providers based in the UK providing IT and system administration services
• Professional advisers including lawyers, bankers, auditors and insurers based in the UK
• HM Revenue & Customs, regulators and other UK authorities where reporting is required
• Marketing campaign companies, subject to appropriate international transfer safeguards as described in Section 6
• Credit reference agencies, the Land Registry, employers, accountants, valuers, solicitors, IT suppliers, and lenders, as required during your application process
• Third parties to whom we may choose to sell, transfer or merge parts of our business or assets. Any new owners will use your personal data in accordance with this notice.

We require all third parties to respect the security of your personal data and treat it in accordance with the law. We do not allow third-party service providers to use your personal data for their own purposes.

6. International Transfers

We will share your personal data within the SMG Group. In doing so, we do not routinely transfer your data outside the United Kingdom (UK).

Some of our third-party service providers – such as analytics platforms and marketing tools – may be based outside the UK. In these cases, we ensure an equivalent degree of protection is afforded to your data by relying on one or more of the following safeguards:

• Adequacy regulations: we transfer data only to countries that the UK Government has determined provide an adequate level of data protection. For further details, see the ICO’s guidance on adequacy.
• Standard Contractual Clauses (SCCs) / International Data Transfer Agreements (IDTAs): where we use service providers in countries not covered by an adequacy decision, we use contracts approved by the ICO or the European Commission that give personal data the same protection it has in the UK. For details, see the ICO’s guidance on SCCs and IDTAs.
• UK-US Data Bridge: where we use providers based in the United States that are certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge), we may transfer data to them on that basis. This framework replaced the former EU-US Privacy Shield, which was invalidated in 2020.

Please contact us if you want further information on the specific transfer mechanism used for any particular service provider.

7. Data Security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal data is limited to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

8. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.

By law we are required to keep basic information about customers (including Contact, Identity, Financial and Transaction Data) for six years after you cease being a customer, for tax purposes.

In some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your Legal Rights

Under UK GDPR, you have the right to:

• Request access to your personal data (a “data subject access request”) – to receive a copy of the data we hold about you and check we are processing it lawfully
• Request correction of inaccurate or incomplete data we hold about you
• Request erasure of your personal data where there is no good reason for us to continue processing it
• Object to processing where we rely on legitimate interests, or where we process your data for direct marketing purposes
• Request restriction of processing in certain circumstances (e.g. where you contest its accuracy)
• Request transfer of your personal data to you or a third party in a structured, machine-readable format
• Withdraw consent at any time where we rely on consent as the legal basis for processing

You will not generally have to pay a fee to exercise these rights, although we may charge a reasonable fee for requests that are clearly unfounded, repetitive or excessive.

To exercise any of the above rights, please contact us using the details in Section 1. We aim to respond to all legitimate requests within one month. For complex or multiple requests this may take longer; we will notify you and keep you updated.

You also have the right to lodge a complaint with the ICO at any time: www.ico.org.uk.

10. Cookies

Our websites use cookies and similar tracking technologies to distinguish between users, analyse website traffic and enhance user experience. We use:

• Necessary cookies: essential for core website functionality such as page navigation and secure form access. The site cannot function properly without these.
• Session cookies: to help you move between pages without re-entering information.
• Analytical cookies: to recognise your device when you return and help us understand how visitors use our sites.
• Marketing cookies: to store information about users and their behaviour to help deliver more relevant advertising.

You can set your browser to refuse all or some cookies, or to alert you when cookies are set or accessed. Declining cookies may affect how well parts of our websites function.

For more information please see our Cookie Policy:

https://www.specialistmortgagegroup.co.uk/cookie-policy.html

11. Children’s Privacy

Our websites, services and products are not intended for children under the age of 16. We do not knowingly collect personal data from children except where it is relevant to a mortgage or equity release application, in which case we will notify you and obtain consent at the relevant time.

12. Changes to This Privacy Notice

We may update this notice from time to time. Material changes will be communicated to you directly where possible. The date of the most recent update is shown at the top of this document. Please contact us to view any previous versions.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

13. Contact Us

If you have any questions about this privacy notice or wish to exercise your data rights, please contact us at any of the following:

Specialist Mortgage Group Limited (and all group companies)

9-10 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ

Telephone: 0800 014 7797

Email: barney@y3sgroup.com

Web: www.specialistmortgagegroup.co.uk

14. Glossary

Lawful Bases

Legitimate Interest: the interest of our business in conducting and managing our business to enable us to give you the best service and most secure experience. We consider and balance any potential impact on you before we process your personal data for our legitimate interests.

Performance of Contract: processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation: processing your personal data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.

Third Parties

Internal Third Parties: other companies in the SMG Group acting as joint controllers or processors, based in the UK, providing IT and system administration services.

External Third Parties include:

• Service providers based in the UK providing IT and system administration services
• Professional advisers including lawyers, bankers, auditors and insurers based in the UK
• HM Revenue & Customs, regulators and other UK authorities
• Marketing campaign companies, subject to appropriate international transfer safeguards as described in Section 6
• Credit reference agencies, the Land Registry, employers, accountants, valuers, solicitors, IT suppliers, and lenders, as relevant to your application