Privacy Notice — Greenfield Bridging

Who we are

Greenfield Bridging and Greenfield Mortgages are trading names of Greenfield Mortgages Ltd (company number 07636098), Greenfield Mortgages III Ltd (company number 09922574), Greenfield Mortgages (Holdings) Ltd (company number 08573091), Greenfield Mortgages (Holdings) II Ltd (company number 09922617) and Greenfield Mortgages II Ltd (company number 08574591), registered in England and Wales at Bank House, 8 Cherry Street, Birmingham B2 5AL.

In this notice, “we”, “us” and “our” mean the Greenfield company you enquire with, apply to or hold a loan with, which is responsible for your personal data as its controller.

These Greenfield companies are registered with the Information Commissioner’s Office as data controllers:

Greenfield Mortgages Ltd: ICO registration Z2735478
Greenfield Mortgages II Ltd: ICO registration ZA537850
Greenfield Mortgages III Ltd: ICO registration ZA162818
Greenfield Mortgages (Holdings) Ltd: ICO registration ZB116228

We use personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. If you have a question about this notice or how we use your data, contact us:

Telephone: 0121 233 1188
Email: info@greenfieldbridging.com
Post: The Compliance Officer, Greenfield Bridging, Bank House, 8 Cherry Street, Birmingham B2 5AL

The personal data we collect

Whether or not you become a customer, the personal data we use may include:

Your name and contact details, including your address and address history, email address and telephone numbers.
Your date of birth or age, for example to check that you are eligible to apply.
Financial details, such as income, expenditure and accounts held with other providers.
Information from credit reference and fraud prevention agencies, the electoral roll, court records of debt judgments and bankruptcies, and other publicly available sources.
Family, lifestyle or social circumstances, such as the number of dependants you have.
Employment details and status, for credit and fraud prevention purposes.
Details of the property offered as security and of how the loan will be repaid.
Records of our emails, calls and other communications with you.
Personal data about other named applicants. You must have their authority to give us their details, and share this notice with them first.

You must provide your personal data for us to process an application, unless you are already a customer and we hold your details.

When you use this website

Each form on this website collects only what it asks for, plus a small amount of information about the submission itself:

Callback forms, on most of our pages: your name, telephone number and, if you give it, email address; the page you sent it from; the date and time; and any campaign reference in the page address, such as the advert or email link you followed. We do not record your IP address from these forms.
Our quote page, greenfieldbridging.com/quotes: how much you want to borrow, what for and for how long; your first name, last name, email address and telephone number; your confirmation that we may contact you about your quotation; the page, date, time and any campaign reference; and your IP address, the internet address your device used to send the form.
Event prize draw forms, used at industry events: your first name, surname, company, email address and telephone number, the event, and whether you asked to hear from us about our products.

Almost all of this website sets no cookies. Our quote page, and the page shown after a quote request, use Google Ads cookies only if you accept them; our Cookie Policy explains what they are and how to change your mind.

If you work for us

Our staff can sign in to a private area of this website to get documents for their work. Accounts are given only to people with a Greenfield work email address. For each account we hold:

your name, work email address and whether you are an administrator;
your password in a scrambled form that cannot be turned back into the password, and, if you use one, the setup key for your authenticator app;
a record of signing in and out, failed attempts, password resets, documents opened and changes made to accounts, each with the date, time, IP address and web browser used.

We use this for our legitimate interests: to keep the area secure, to control who can see our documents, and to investigate misuse. It is held on the server that hosts this website, in the UK, and the emails that let you set a password are sent through our own email provider. Signing in sets one cookie, which is strictly necessary for the area to work and is deleted when you close your browser.

The record of activity is deleted automatically after 12 months. When you leave, your account is closed straight away, and your name and email address are deleted once no remaining record refers to them.

Where we get it from

From you, when you enquire, apply or speak to us.
From the broker, packager or other introducer who places your case with us.
From credit reference and fraud prevention agencies, and from public records.
From the valuers and solicitors acting on your loan.
From this website, as described above.

Why we use it, and our lawful basis

To perform our contract with you, or to take steps you ask for before entering into one:

To respond to your enquiry or quote request, and to call you back.
To decide whether to lend, and to manage and perform the loan.
To keep our records up to date.
To trace your whereabouts, in order to contact you about your loan and to recover debt.

For our legitimate interests, or those of others:

For good governance, accounting, and managing and auditing our business.
To search at credit reference agencies at your home address.
To monitor emails, calls, other communications and activity on your account.
To understand which of our pages and campaigns lead to enquiries, using the page and campaign reference sent with a form.
To detect and block misuse of our quote form, such as repeated spam submissions, using the IP address sent with it.
To send you marketing communications, where the law allows us to without your consent.

To comply with a legal obligation:

When you exercise your rights under data protection law.
To comply with legal and regulatory requirements.
To establish and defend legal rights.
For the prevention, detection and investigation of crime.
To verify your identity and make credit, fraud prevention and anti-money laundering checks.

With your consent:

When you ask us to disclose your personal data to other people.
To send you marketing communications where we have asked for your consent, including when you tick the box on an event prize draw form.
To use Google Ads cookies on our quote page, where you accept them.

You can withdraw your consent at any time. The consequence may be that we cannot do certain things for you.

Credit reference and fraud prevention checks

To process an application we perform credit and identity checks on you at your home address with one or more credit reference agencies. We give them your personal data and they give us information about you. A search leaves a “footprint” on your credit file, which other lenders can see and which may affect your ability to get credit elsewhere. We carry out a credit search only where you have agreed to, or asked us to, proceed with your application for credit.

While you have a relationship with us we may continue to exchange information about you with credit reference agencies, and they may share it with other organisations. Details of your application, whether or not it succeeds, will be recorded, and we may tell them about your loans and how you manage them. If you do not repay in full or on time, they will record the outstanding debt and may supply it to others performing similar checks, to trace your whereabouts and to recover debt. Records stay on file for six years after they are closed, whether settled or defaulted. A financial association link will be created between joint applicants, which remains until either of you applies to have it removed.

The personal data we collect will also be shared with fraud prevention agencies, who use it to prevent fraud and money laundering and to verify your identity. If fraud is detected you could be refused certain services, finance or employment. We may also search our own records for these purposes.

How the credit reference agencies use and share personal data is explained in their Credit Reference Agency Information Notice: experian.co.uk/crain, equifax.co.uk/crain and transunion.co.uk/crain.

Subject to data protection law, we may share your personal data with:

Companies that provide services to us, including those that host this website, carry our website enquiries to us, and provide our advertising measurement — see below.
The broker or introducer who placed your case, and the valuers and solicitors acting on your loan.
Our legal and other professional advisers.
Fraud prevention agencies, credit reference agencies and debt collection agencies, when we open your loan account and periodically during it.
Government bodies and regulators in the UK and overseas, such as HMRC, the Financial Conduct Authority and the Information Commissioner’s Office.
Courts, to comply with legal requirements and for the administration of justice.
Anyone, in an emergency or otherwise to protect your vital interests.
Others, where needed to protect the security or integrity of our business.
Other parties connected with your loan, such as guarantors and joint applicants, who will see your transactions.
A buyer or successor, if we restructure, sell our business or its assets, or merge.
Anyone else, where we have your consent or the law requires it.

The services that handle website data:

Our web host: This website’s server. When you send a form, a copy of your enquiry is written to the server first, so that it is not lost if anything goes wrong on its way to us.
Zapier, Inc.: A workflow service based in the United States, which carries each website enquiry — and, for a quote request, the IP address sent with it — from the website into our own customer relationship management (CRM) system, which is hosted in the UK.
Google LLC: Based in the United States. Google Ads measures our advertising on the quote page if you accept its cookies, and Google Sheets holds event prize draw entries.

Transfers outside the UK

Zapier and Google are based in the United States, so personal data handled by them is transferred outside the UK. Both are certified under the UK Extension to the EU–US Data Privacy Framework, which the UK Government recognises as giving adequate protection to personal data transferred to certified organisations.

Where we transfer personal data outside the UK in any other case, we rely on the UK Government’s adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

How long we keep it

Whether or not you become a customer, we keep personal data only for as long as we need it, using these criteria:

To deal with queries. For as long as needed to deal with your enquiry or application, and any questions about it — for example if your application does not proceed.
In case of claims. For as long as you might legally bring a claim against us.
For legal and regulatory reasons. After your loan has been repaid or otherwise come to an end, for as long as our legal and regulatory obligations require.

The copy of a website enquiry kept on our web server is a backup only, and is deleted automatically within 90 days of being received. A website enquiry that has not led to us contacting you is deleted from our CRM within 90 days, and event prize draw entries are deleted within 90 days of being entered.

Marketing

We may send you information about our products where you have consented, or where the law otherwise allows it. You can ask us to stop at any time by calling 0121 233 1188 or emailing info@greenfieldbridging.com, and we will not send you marketing once you have told us not to.

Your rights

Under data protection law you have the right:

To be informed about how we use your personal data.
To access your personal data and information about how we use it.
To have inaccurate personal data corrected, and incomplete data completed.
To have your personal data erased.
To restrict how we use your personal data.
To object to how we use your personal data.
To move, copy or transfer your personal data.
To withdraw your consent, where we rely on it.
Not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.

To use any of these rights, contact us using the details at the top of this notice. There is normally no charge, and we will respond within one month. Some rights apply only in certain circumstances, and we will tell you if one does not apply and why.

Complaints

If you are unhappy with how we have used your personal data, please tell us first so that we can put it right. You can also complain to the Information Commissioner’s Office.

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Changes to this notice

We update this notice when the way we use personal data changes. It was last updated on 14 September 2026.

How we use your personal data