Privacy Policy

Last updated: March 2026

1. Who we are

Headmill Capital Ltd ("we", "our", "us") is a mortgage and insurance advisory business. Headmill Capital Ltd is an Appointed Representative of PRIMIS Mortgage Network, a trading name of First Complete Ltd. First Complete Ltd is authorised and regulated by the Financial Conduct Authority. You can contact us at admin@headmill.co.uk or 07751 642 512.

We are committed to protecting your personal data and handling it responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

We may collect the following categories of personal data:

  • Identity data: first name, last name
  • Contact data: email address, telephone number, postal address
  • Financial data: information about your income, expenditure, property value, and mortgage requirements that you share with us during the advice process
  • Technical data: IP address, browser type, and pages visited (collected via essential cookies)
  • Enquiry data: the content of any messages or forms you submit to us

We do not collect special category data (e.g. health, race, religion) unless you voluntarily provide it as relevant to your enquiry.

3. How we use your data

We use your personal data for the following purposes:

  • To respond to your enquiries and provide mortgage and insurance advice
  • To submit applications to lenders and insurers on your behalf
  • To fulfil our regulatory obligations under FCA rules
  • To send service-related communications relevant to your advice
  • To improve our website and services (using anonymised analytics)

We will only contact you for marketing purposes if you have given explicit consent, and you can withdraw that consent at any time.

4. Legal basis for processing

We rely on the following legal bases under UK GDPR:

  • Legitimate interests: responding to your enquiries and improving our services
  • Legal obligation: meeting our FCA regulatory requirements, including record-keeping and suitability assessments
  • Contract: processing necessary to provide the services you request
  • Consent: for any marketing communications, where required

5. Data sharing

We may share your personal data with lenders, insurance providers, and other third parties as necessary to provide our services. We may also share data with our network and compliance support providers. We do not sell your personal data to third parties.

All third parties are required to handle your data in accordance with UK GDPR and our data sharing agreements.

6. Data retention

We retain your personal data for as long as necessary to provide our services and comply with our legal and regulatory obligations. For FCA-regulated mortgage and insurance activities, records are typically retained for a minimum of six years from the end of our business relationship with you.

7. Your rights

Under UK GDPR, you have the following rights:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: ask us to correct inaccurate or incomplete data
  • Right to erasure: request deletion of your data (subject to legal and regulatory obligations)
  • Right to restrict processing: ask us to limit how we use your data
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interests
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us at admin@headmill.co.uk. We will respond within one month.

8. Cookies

We use essential cookies only to remember your preferences (such as your cookie consent choice). We do not set advertising or tracking cookies without your explicit consent.

You can control or delete cookies through your browser settings at any time. Disabling essential cookies may affect the functionality of the site.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses HTTPS encryption. However, no internet transmission is 100% secure, and you share data at your own risk.

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Continued use of our website or services after changes constitutes acceptance of the revised policy.

11. Contact & complaints

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled: ico.org.uk , or call 0303 123 1113.