Client Privacy Notice
Tru Blu Financial · Version 1.3 · Last updated: 30 September 2026
Who we are
Tru Blu Financial is a trading name of Brook Financial Services Limited, which is registered in England and Wales (company number 07311674). Registered office: The Old Courthouse, 60a London Road, Grantham, Lincolnshire, NG31 6HR.
Brook Financial Services Limited (FCA Firm Reference Number 585328) is an Appointed Representative of Mortgage Advice Bureau Limited and Mortgage Advice Bureau (Derby) Limited, which are authorised and regulated by the Financial Conduct Authority (Mortgage Advice Bureau FCA Firm Reference Number 455545).
In this notice, "we", "us" and "our" mean Tru Blu Financial and Mortgage Advice Bureau together. We are joint controllers of your personal data and we comply with data protection law in the United Kingdom, including the UK GDPR and the Data Protection Act 2018.
This notice explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and what rights you have. It sits alongside Mortgage Advice Bureau's own privacy notice.
The personal data we collect about you
Depending on the advice and services you ask us for, the personal data we collect, use, store and transfer may include:
- Identity Data — forenames, surname, any previous names, date of birth, gender, marital status, nationality, dependants, and identification documents.
- Contact Data — home address, previous addresses, email address and telephone numbers.
- Financial Data — income and expenditure, bank statements, savings and assets, debts such as loans and credit cards, employment and pension details, existing mortgage and policy details, and credit history.
- Property Data — details of the property you own, are buying or are remortgaging, including valuation and tenure information.
- Special Category Data — health and medical information (needed to arrange protection and insurance products), and, where relevant to an application, trade union or political party membership.
- Credit Reference Data — information obtained from credit reference agencies to validate your identity and address and to assess eligibility.
- Transaction Data — fees paid to us and payments relating to the products we arrange for you.
- Communications Data — emails, letters, messages, case notes, and recordings and transcripts of telephone calls, including calls answered by our AI-assisted telephone system.
- Technical, Profile and Usage Data — IP address, browser type and version, time zone and location settings, and how you use our website, forms and calculators.
- Marketing and Communications Data — your preferences for receiving marketing from us and your communication preferences.
How we collect your personal data
Most of the personal data we hold is given to us directly by you. We collect it through:
- Direct contact with your adviser — in person, by telephone (including call recordings, transcripts and voicemail), by email, by video call, by post, or through our AI-assisted telephone system.
- Fact-find questionnaires, application forms, document uploads and secure client portals.
- Automated technologies when you use our website, including contact forms, calculators and cookies.
We also receive personal data indirectly from third parties, including:
- Lenders and insurers, to assist in providing advice, arranging products and servicing your case.
- Estate agents, new home builders and solicitors involved in your transaction.
- Credit reference agencies and identity verification providers.
- Introducers and third-party mortgage enquiry websites where you have made an enquiry.
To validate your identity or address we may carry out an enquiry search with a credit reference agency. This leaves a "soft footprint" on your credit file. It is not visible to lenders and does not affect your credit score.
How and why we use your personal data
We only use your personal data where the law allows us to. The table below sets out what we do, the data involved, and the lawful basis we rely on.
| Purpose / activity | Types of data | Lawful basis |
|---|---|---|
| Initial engagement to discuss your requirements and needs | Identity, Contact | Consent; steps taken at your request prior to entering a contract |
| Sourcing products, providing indicative quotes, and processing and submitting your mortgage, secured lending or protection application | Identity, Contact, Financial, Property, Credit Reference, Transaction, Special Category | Performance of a contract with you; legal obligation; legitimate interests (recording vulnerability information and recovering debts owed to us); explicit consent or the insurance purposes condition where special category data is involved |
| Verifying your identity and meeting anti-money laundering and financial crime obligations | Identity, Contact, Financial, Credit Reference | Legal obligation; substantial public interest |
| Managing our relationship with you — portal access, service updates, case progress, annual reviews, protection reviews and re-engagement at product expiry | Identity, Contact, Profile & Usage, Marketing & Comms | Performance of a contract with you; legitimate interests (reviewing your existing arrangements, maintaining service standards and staying in touch until you are ready to proceed) |
| Handling case enquiries, and investigating and defending complaints | All categories, including Special Category | Legal obligation; legitimate interests (responding to complaints accurately); establishment, exercise or defence of legal claims |
| Carrying out an affordability check on behalf of an estate agent or new home builder | Identity, Contact, Financial, Profile & Usage | Our legitimate interests and those of the third party (confirming affordability before a sale proceeds) |
| Answering inbound calls using our AI-assisted telephone system, including recording and transcription | Identity, Contact, Communications | Legitimate interests (handling enquiries promptly and keeping an accurate record); steps taken at your request prior to entering a contract |
| Using AI-assisted tools to sort, summarise and draft correspondence, manage case administration and scheduling, and support quality checking | Identity, Contact, Financial, Communications, Special Category | Legitimate interests (efficient and accurate case administration); explicit consent where special category data is involved |
| Administering and protecting our business, website and IT systems, including troubleshooting, backup, security and fraud prevention | Identity, Contact, Technical | Legal obligation; legitimate interests (running our business securely) |
| Meeting our regulatory obligations, including file checks, audits and supervision by our network and the FCA | All categories | Legal obligation; legitimate interests (demonstrating compliance) |
We will only use your personal data for the purposes above, unless we reasonably consider that we need to use it for another compatible reason. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis for doing so.
Special category data
Health and medical information is needed to arrange life cover, critical illness cover, income protection and similar products. We process it under Article 9 of the UK GDPR, either with your explicit consent or because processing is necessary for insurance purposes. Where we rely on your consent, you can withdraw it at any time, although this may mean we can no longer arrange or service certain products for you.
The systems we use to hold your data
Your case is held electronically on Acre, the customer relationship management and product sourcing platform provided by our network. Acre acts as a processor on our behalf and under our written instructions. There is a data processing agreement in place requiring Acre to:
- Process your personal data only in accordance with written instructions.
- Maintain appropriate technical and organisational security measures, including encryption and restricted access.
- Support us in responding to your data protection rights requests.
- Assist with audits and regulatory compliance.
- Ensure any of its own sub-processors are subject to equivalent obligations.
Alongside Acre, we use a small number of other specialist suppliers to run the practical side of the business. We do not need to name each one here, but the categories are:
- Email, calendar and document storage.
- Telephony and call handling, including call recording, voicemail and our AI-assisted telephone system.
- Appointment scheduling and online booking.
- Video meeting platforms used for appointments held remotely.
- Text message services used for appointment reminders and case updates.
- Task and case administration tools used to track the progress of your case.
- Automation tools that pass information securely between the systems above so it does not have to be re-keyed.
- AI-assisted tools used to support correspondence, case administration and quality checking — see the next section.
- Electronic signature services.
- Identity verification and anti-money laundering checking.
- Website hosting, online enquiry forms and secure document upload.
Every supplier that handles your personal data is engaged under a written contract meeting the requirements of Article 28 of the UK GDPR, and processes your data only on our instructions. We keep an internal register of these suppliers recording what each one processes, where the data is held and what safeguards apply. You can ask us at any time for the current list of suppliers we use and what each one does — please use the contact details at the end of this notice.
Our use of AI-assisted tools
We use a number of AI-assisted tools to help us run a small firm efficiently. These tools may process the content of emails, telephone calls, documents and case notes relating to your enquiry or application, which can include personal and financial information you have shared with us. We use them for:
- Answering and triaging telephone calls — our AI-assisted telephone system answers inbound calls, takes your details and the reason for your call, books appointments and passes messages to us. Calls are recorded and transcribed.
- Email and correspondence management — sorting, prioritising and summarising incoming mail, and drafting replies for an adviser to review before sending.
- Case administration and scheduling — extracting information from documents you send us, preparing file notes and managing diary appointments.
- Research and quality checking — supporting an adviser in preparing and checking advice documentation.
- Our website chat assistant — answering general questions about our services and, if you choose to share them, taking your name, contact details and a short summary of what you need so an adviser can get in touch.
We apply the following safeguards to every AI-assisted tool we use:
- We have a written data processing agreement in place with each provider before any client data is processed.
- None of these providers use your data to train their underlying AI models.
- Where data is transferred outside the UK, it is covered by UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses with additional safeguards.
- All output is reviewed by a person before it is acted on or sent to you. AI tools support our advisers; they do not replace them.
- We maintain an internal AI Tools and Data Processing Register recording every tool, what data it processes, its lawful basis and its safeguards.
Website chat assistant. The chat on our website is an AI assistant, not a person, and is the one exception to human review above: its replies are generated automatically and shown to you straight away. It is limited to general information and arranging a conversation with an adviser — it cannot give mortgage, insurance or financial advice, and it will not ask for bank details, National Insurance numbers, medical information or credit report details. Please do not share them in the chat.
Your messages are sent securely to Anthropic, which provides the AI model (Claude), through our Google Workspace account. If you give the assistant your contact details, a summary of your enquiry is emailed to us, recorded in a Google spreadsheet, and passed through Zapier into ClickUp, the system we use to manage new enquiries. We rely on our legitimate interests in responding to enquiries from our website, and on steps taken at your request before entering into an agreement with us. Your conversation is kept in your browser only until you close the tab.
You can ask us at any time which tools we use and how they handle your data, using the contact details at the end of this notice.
Automated decision-making
We do not make decisions about your mortgage or protection application by automated means alone. Advice is given by a qualified human adviser, and any AI-generated output is subject to human oversight before it is used. Lenders and insurers you apply to may use automated decision-making as part of their own underwriting; where that is the case, they will explain it in their own privacy notice, and you have the right to ask them for human review of any such decision.
If you would prefer your data not to be processed by AI-assisted tools, please tell us using the contact details below and we will discuss what alternative arrangements we can make.
Who we share your personal data with
| Type of recipient | Reason |
|---|---|
| Mortgage Advice Bureau Limited and Mortgage Advice Bureau (Derby) Limited | So that our principal firm can supervise our advice, carry out file checks and quality assurance, maintain our systems, and so suitably qualified advisers can source relevant products. |
| Lenders and secured lending providers | To obtain decisions in principle, submit applications, conclude the mortgage contract and support ongoing servicing. The specific lenders approached will be disclosed to you during the advice process. |
| Insurers and protection providers | To obtain quotes, submit applications and support ongoing servicing. The specific insurers approached will be disclosed to you during the advice process. |
| Credit reference and identity verification agencies | To confirm your identity and address, meet anti-money laundering requirements and assess eligibility. |
| Financial institutions via Open Banking | To access your bank account information, with your consent, where this is used to evidence income and expenditure. |
| Specialist IT, communications and AI-assisted suppliers | To deliver our service — case management and product sourcing, email and document storage, telephony and call handling, appointment scheduling, text message updates, secure document exchange, electronic signatures and quality checking. See "The systems we use to hold your data" and "Our use of AI-assisted tools" above. |
| Solicitors and conveyancers | To confirm your identity and proof of deposit and to update them on the progress of your application. |
| Estate agents and new home builders | To confirm affordability and to update them on the progress of your application. |
| Housing associations and registered providers | Where applicable, to confirm identity and proof of deposit, provide progress updates and share a copy of the mortgage offer. |
| Regulators and authorities | To meet our legal and regulatory obligations, including with the Financial Conduct Authority, the Information Commissioner's Office, the National Crime Agency and other law enforcement bodies. |
| Professional advisers and auditors | Our accountants, compliance consultants and legal advisers, where they need access to advise us. |
| Third parties in a business transfer | If we sell, transfer or merge parts of our business, the new owners may use your personal data in the same way as set out in this notice. |
Everyone we share your data with is required to keep it secure and confidential, and to use it only for the purpose we have shared it for.
We do not sell your personal data, and we do not pass it to third parties for their own marketing purposes.
Transfers outside the United Kingdom
Your data is primarily stored in the United Kingdom or the European Economic Area. Some of our suppliers are based overseas, so using them may involve a transfer of your personal data outside the UK. Where that happens, we make sure a level of protection equivalent to UK standards is in place, using UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), the International Data Transfer Agreement, or standard contractual clauses approved under UK data protection law.
How long we keep your personal data
| Purpose of processing | Retention period |
|---|---|
| Completed mortgage or protection applications | The full mortgage or policy term plus a further 6 years; or 30 years for historic cases where the original term is not recorded |
| Withdrawn, stalled, incomplete or declined applications | 2 years from the date the latest application was started; or 6 years from submission where an application was submitted and subsequently rejected |
| Advice given but not pursued | 6 years from the date advice was given |
| Client portal accounts not proceeding to a full application | 2 years from the date of last login |
| Affordability checks not proceeding to a full application | 2 years from the decision in principle |
| Enquiry data received from third parties that does not result in an application | 2 years from the date the lead was received |
| Anti-money laundering identification records | 5 years from the end of the business relationship, in line with the Money Laundering Regulations |
| Call recordings and transcripts | 12 months from the date of the call, unless the call forms part of a client file or a complaint |
| Complaint records | 6 years from the date the complaint was closed |
| Marketing preferences and consents | Until you withdraw consent or object, plus a record of the withdrawal |
We keep personal data for as long as we need it to meet our regulatory and legal responsibilities, including the period during which you can bring a complaint. After these periods, if there is no ongoing client relationship, your personal data is securely deleted or anonymised.
Keeping your data secure
We have appropriate security measures in place to stop your personal data being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include encrypted storage and email, multi-factor authentication, access restricted to those with a business need, and regular review of the suppliers we use.
Access to your data is limited to our advisers and administrative staff, our network, and the suppliers who process data on our instructions — all of whom are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach, and we will notify you and the Information Commissioner's Office where we are legally required to do so.
Marketing communications
We may contact you about mortgage and protection products and reviews that are relevant to arrangements we have made for you, on the basis of our legitimate interests. You can choose to opt in to other marketing communications, and you can opt out at any time — by telling your adviser, emailing us, or using the unsubscribe link in any marketing email. Opting out of marketing does not stop us sending you service messages about your existing case or products.
Cookies and our website
Our website uses cookies. You can set your browser to refuse cookies or to alert you when they are set, although some parts of the site may then not work properly. Our website may also contain links to third-party sites; we are not responsible for their privacy practices, and we encourage you to read the privacy notice of every website you visit.
Your rights
Under data protection law you have the right to:
- Access — ask for a copy of the personal data we hold about you and check that we are processing it lawfully.
- Rectification — ask us to correct data that is inaccurate, or complete data that is incomplete.
- Erasure — ask us to delete your personal data where there is no good reason for us to keep processing it. We may not always be able to do this where we have a legal or regulatory duty to retain it.
- Restriction — ask us to suspend processing in certain circumstances, for example while we check the accuracy of data you have challenged.
- Objection — object to processing based on our legitimate interests, or to direct marketing at any time.
- Portability — ask us to transfer the data you gave us to you or to another organisation in a structured, commonly used, machine-readable format, where technically feasible.
- Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew it.
You do not have to pay a fee to exercise these rights. We will respond within one month of receiving your request.
Clients resident in the European Union
If you live in the European Union, you keep your rights under the EU General Data Protection Regulation. Please direct any queries to us using the contact details below and we will handle them in line with those rights.
How to contact us
If you have a question about this notice, want to exercise any of your rights, or want more detail about the AI-assisted tools we use, please contact:
Tru Blu Financial — data@tru-blu.co.uk, or write to us at 181 Coniscliffe Road, Darlington, DL3 8DE.
Mortgage Advice Bureau — please see Mortgage Advice Bureau's own privacy notice for its data protection contact details, or ask us and we will pass them on.
If you are not satisfied
If you are unhappy with how we have used your personal data, please tell us first so we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
Changes to this notice
We keep this notice under regular review. It was last updated on 21 September 2026. Previous versions are available on request.