Last updated: 28 October 2026
OnTheLadder (“OTL”, “we”, “us” or “our”) is a mortgage lead-generation and introduction service operated by Ben Smith as a sole trader.
We are committed to protecting personal information and handling it responsibly, transparently and securely in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as applicable.
This policy describes our approach to data protection and the principles that govern how we handle personal information.
It should be read alongside our Privacy Policy, which explains in more detail what personal information we collect, why we use it, who receives it and how long we retain it.
Data controller: Ben Smith, trading as OnTheLadder
Email: hello@ontheladder.net
Website: https://www.ontheladder.net
As the data controller, we determine the purposes for which personal information is processed and the means by which that processing takes place.
We are responsible for ensuring that our processing complies with applicable data protection law. Using third-party software providers does not remove our responsibility for personal information processed on our behalf.
We will take reasonable steps to ensure that anyone authorised to access personal information understands their responsibilities and handles that information appropriately.
Our handling of personal information is governed by the following principles.
We will process personal information lawfully, fairly and transparently. We will explain how and why we use personal information and identify the applicable lawful basis for each processing purpose.
We will collect personal information for specified, explicit and legitimate purposes. We will not use it for an incompatible purpose without establishing a lawful basis and providing any additional information required by law.
We will collect only the personal information reasonably necessary for the relevant purpose.
For example, we will seek information relevant to handling a mortgage enquiry and making an introduction, rather than collecting additional financial or personal details without a justified need.
We will take reasonable steps to ensure personal information is accurate and, where necessary, kept up to date.
Where an individual identifies inaccurate information, we will assess the request and correct the information where appropriate.
We will retain personal information only for as long as necessary for its purpose, taking account of applicable legal obligations and legitimate business requirements.
We will implement and periodically review a retention schedule covering enquiries, completed introductions, complaints, technical records and other relevant information.
We will implement appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.
We will maintain appropriate records and evidence to demonstrate our compliance with applicable data protection requirements.
This includes documenting relevant processing purposes, lawful bases, recipients, retention periods, security measures and decisions affecting how personal information is handled.
Depending on the enquiry and how our website is used, we may process:
Contact details, including names, telephone numbers and email addresses.
Postcodes and relevant location information.
Mortgage enquiry information, including the type of assistance requested.
Relevant financial and property information submitted through our forms.
Information collected during enquiry verification and subsequent communications.
Website usage, technical and advertising measurement information.
Records of privacy preferences, consent choices and requests to exercise data protection rights.
We will seek to limit the information collected to what is necessary for the relevant purpose.
Further information is provided in our Privacy Policy.
We will identify an appropriate lawful basis before processing personal information.
Depending on the purpose, this may include:
Legitimate interests: for activities such as administering enquiries, verifying submissions, maintaining service quality and operating our business, where our interests are not overridden by individuals’ rights and freedoms.
Steps at an individual’s request before entering into a contract: where processing is necessary for that purpose and the legal conditions are met.
Consent: where an individual has given valid consent for a specific purpose and consent is the appropriate legal basis.
Legal obligation: where processing is necessary to comply with a legal requirement.
We will document the applicable lawful bases and, where we rely on legitimate interests, the interests pursued and the assessment supporting that decision.
We will not treat consent as interchangeable with other lawful bases or assume that submitting a mortgage enquiry constitutes consent to unrelated marketing.
OTL operates an exclusive mortgage lead-introduction service.
When a consumer submits an enquiry, we use relevant information to allocate it to one mortgage adviser. We share the information necessary for that adviser to respond to the enquiry.
We receive payment or another commercial benefit from the adviser in connection with the introduction.
We will explain this commercial arrangement and the intended sharing of information in our consumer-facing privacy information. We will provide any additional disclosures required by law before the introduction takes place.
The adviser will generally act as a separate data controller for their subsequent use of the information. They are responsible for complying with their own data protection obligations.
We will not automatically distribute an enquiry to multiple advisers if the intended exclusive allocation cannot be completed.
We use third-party services to operate our website, manage enquiries, store information and communicate with consumers.
Our current provider list includes:
NameHero: website hosting and related infrastructure.
Lovable: platform used to build or maintain our custom CRM.
Supabase: database, storage and related infrastructure.
Resend: email delivery.
Meta: advertising and, where enabled, advertising measurement and lead-generation services.
The precise role of each provider depends on the service and processing involved. Some may process personal information on our behalf, while others may process information for their own purposes.
Where a provider acts as our data processor, we will take reasonable steps to ensure it provides sufficient guarantees of appropriate data protection and security. We will put the required written contractual arrangements in place, including the terms required by Article 28 UK GDPR where applicable.
We will review relevant provider terms, subprocessors, security arrangements and international transfers. We will also maintain appropriate records of our providers and the personal information they may process.
We will implement technical and organisational measures appropriate to the nature of the personal information we process and the risks involved.
Depending on the system and risk, these measures may include:
Restricting access to authorised users.
Using appropriate authentication and account security.
Limiting access to personal information according to business need.
Maintaining suitable backup and recovery arrangements.
Keeping relevant software and systems appropriately maintained.
Reviewing third-party provider security and contractual safeguards.
Taking reasonable steps to prevent unauthorised disclosure or misuse.
We will periodically review our security arrangements and address identified weaknesses where appropriate.
No security measure can guarantee complete protection against every threat. We will respond to suspected security incidents in accordance with our incident-management procedures and applicable law.
A personal data breach may involve accidental loss, destruction, alteration, unauthorised disclosure of or access to personal information.
If we become aware of a suspected breach, we will:
Take reasonable steps to contain the incident and prevent further unauthorised access or disclosure.
Assess the nature, scope and potential consequences of the incident.
Record the incident and the action taken.
Determine whether notification to the Information Commissioner’s Office (ICO) is legally required.
Notify affected individuals without undue delay where the law requires it.
Take appropriate steps to reduce the likelihood of recurrence.
Where a breach is reportable to the ICO, we will notify it without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by UK GDPR.
We will ensure that relevant service providers understand how and when to notify us of a suspected breach affecting our information.
We will implement a retention schedule that defines how long different categories of personal information may be kept and what happens when that period ends.
Our proposed retention periods are:
Incomplete or unsubmitted enquiries: up to 30 days, unless a documented reason justifies longer retention.
Unconverted enquiries: up to 90 days after the last meaningful contact, unless a documented reason justifies longer retention.
Completed introductions: normally up to 24 months after the introduction.
Complaints and disputes: for as long as reasonably necessary to resolve the matter and meet applicable legal requirements.
Financial and accounting records: for the applicable statutory period.
Marketing suppression records: for as long as necessary to respect objections and prevent unwanted communications.
Technical and analytics records: according to their purpose and the applicable system settings.
These are proposed operating periods, not universal statutory retention periods. We will implement and periodically review them, document justified exceptions and securely delete or anonymise information when it is no longer required.
We will take reasonable steps to address copies held by our service providers, subject to technical limitations, applicable contractual arrangements and lawful retention requirements.
We will identify whether personal information is transferred to or accessed by organisations outside the United Kingdom.
Where a restricted international transfer takes place, we will ensure that an appropriate legal transfer mechanism is in place, such as UK adequacy regulations, approved contractual safeguards or another lawful mechanism.
We will complete any applicable assessments and maintain the documentation required by law.
We recognise the rights individuals may have under applicable data protection law, including the rights to:
Access personal information.
Correct inaccurate information.
Request erasure in certain circumstances.
Request restriction of processing.
Object to certain processing, including processing based on legitimate interests.
Object to direct marketing at any time.
Withdraw consent where processing is based on consent.
Receive certain information in a portable format where the legal conditions apply.
Requests can be submitted to hello@ontheladder.net.
We will assess each request, verify identity where appropriate and respond within the applicable legal timeframe. We will not charge a fee unless the law permits it.
Where a request cannot be fulfilled in full, we will explain the relevant reason where legally required.
We distinguish between communications necessary to administer a submitted enquiry and marketing communications.
We may contact a consumer to verify their enquiry, clarify submitted information or administer the intended introduction.
We will comply with applicable requirements governing electronic marketing, telephone marketing and tracking technologies. Where consent is required, we will obtain valid consent before carrying out the relevant activity.
We will respect marketing objections and maintain appropriate records to prevent communications contrary to an individual’s preferences.
Submitting a mortgage enquiry does not automatically constitute consent to unrelated marketing from OTL or other organisations.
We will assess the cookies and similar technologies used on our website and apply the consent and transparency requirements that are relevant to each technology.
Where consent is required for non-essential analytics, advertising or tracking technologies, we will obtain it before the relevant technology is used.
Our cookie controls and Cookie Policy should accurately reflect the technologies enabled on the website.
We will consider privacy and data protection when introducing or changing systems, forms, advertising integrations, data-sharing processes and other activities involving personal information.
We will seek to:
Collect only the information necessary for each purpose.
Limit access to people and systems that need the information.
Use appropriate privacy and security settings by default.
Avoid unnecessary duplication of personal information.
Review how information is transferred between systems and providers.
Assess privacy risks before introducing materially different processing.
Where a proposed activity is likely to result in a high risk to individuals’ rights and freedoms, we will assess whether a Data Protection Impact Assessment is required and complete one before the relevant processing begins where legally necessary.
We will maintain proportionate records of our personal data processing activities.
These records may include:
The purposes for which information is processed.
The categories of individuals and personal information involved.
The categories of recipients.
Relevant international transfers and safeguards.
Retention periods.
Security measures.
Lawful-basis assessments.
Consent and marketing preference records, where applicable.
Personal data breaches and the actions taken.
Relevant supplier agreements and compliance reviews.
We will review these records when our services, providers or processing activities change.
Anyone authorised to access personal information on behalf of OTL must handle it confidentially and only for authorised purposes.
Access must be limited to what is necessary to perform the relevant task. Personal information must not be disclosed, copied, downloaded or used for unrelated purposes without appropriate authority.
We will take reasonable steps to ensure that anyone who has access to personal information understands and follows these requirements.
If you have concerns about how we handle your personal information, contact hello@ontheladder.net so that we can investigate.
You also have the right to complain to the Information Commissioner’s Office:
We will cooperate with lawful regulatory requests and take appropriate action where an issue with our data protection practices is identified.
We will review this policy periodically and when significant changes occur to our services, technology, providers or legal obligations.
The latest version will be published on our website with its updated date.
This policy should be read alongside our Privacy Policy:
For questions about this policy or our handling of personal information, contact hello@ontheladder.net.
