Privacy policy

Version 1.2 – 25th October 2023

Who are we?

We are Molo Tech Ltd (“we”, “our”, “us”) and operate under the name of Molo and Molo Finance.

Please read the following information carefully. If you have any questions about your personal information please chat with us through our web chat, or by emailing us at, or by writing to us at Data Protection Officer, Molo Tech Ltd, 84 Eccleston Square, Pimlico, London SW1V 1PX.

We’re registered with the Information Commissioner’s Office under number ZA310806.


At Molo we are committed to protecting and respecting your privacy, being completely open and transparent in the way we collect or obtain your personal information and how we treat that information.

For the purposes of applicable data protection legislation, we are a data controller in respect of the information that we collect or obtain about you. This is because we determine why and how your personal information is processed.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering, and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found in this policy.


Personal data collected on our Website

We have structured our Website so that, in general, you can visit Molo on the web without identifying yourself or revealing any personal data unless you actively choose to do so. We make this Privacy Policy and notice readily available on our Website.

Our Website may use “cookies” to enhance your experience. Please see our Cookie Policy, for further information about the cookies used on our Website and your rights in respect to same.


Why we process your personal information

We process your personal information for a variety of reasons, upon different legal bases, depending on the reason for which we have collected or obtained your personal information. The main types of processing that we carry out and the legal basis for doing so are as follows:

We process your personal information in order to consider and process your application. This is necessary in order to take steps at your request before we enter into an agreement with you and is also necessary for our legitimate interests (i.e. in deciding whether or not we can offer you the product you have applied for). This type of processing is required in order for you to enter into an agreement with us. If you do not provide it, then we won’t be able to proceed with your application. In respect of fraud searches and identity verification, this processing is necessary for our legitimate interests (i.e. the prevention of fraud and money laundering) and compliance with our legal obligations.

Before we make a decision on your mortgage offer, we check your personal data against third party databases, for the purposes of preventing fraud and money laundering, and to verify your identity.

If your application is accepted, we will process your personal information in order to administer your account in a number of ways. This will include, for example, collecting loan repayments; providing you with account statements, notices, and other information such as changes to your interest rate; managing any arrears on your account; enforcing any security that we have in place; and dealing with any queries or complaints that you may have. This type of processing is necessary for the performance of our contract with you and in order to fulfil our legal obligations.

We will also process your personal information to manage our business operations, for example, our internal governance functions, which will include monitoring communications and activities in relation to your account (see further detail in relation to monitoring communications below), and for accounting and audit purposes. We have legitimate interests in doing so (i.e. it is necessary for our business and compliance purposes) and we may also have legal obligations to fulfil.

If your application is declined, we will store your personal information in accordance with our record retention procedures and to comply with our legal obligations. For further details, please refer to the section entitled “How long your personal information will be stored for” within this policy.

If we are dealing with a request you have made in order to exercise your legal and regulatory rights (including those referred to in the ‘Your rights under applicable data protection law’) below, this will be done in order to fulfil our legal obligation to respond to you.

We process your personal information for marketing purposes. This is necessary in order to fulfil our legitimate interests of providing you with information about products and services that you may be interested in.

Any consent that you give us will be as easy to withdraw as it was to give. Withdrawing your consent does not affect the lawfulness of any processing which occurred prior to the withdrawal of consent. If you do this, and if there is no alternative legal basis upon which we may process your personal information for a particular purpose, then this may affect what we can do for you.


Who your personal information may be shared with

We may share your personal information with the following third parties:

  • Anyone acting on your behalf with authority to do so, such as a debt charity, power of attorney or your professional advisors.
  • Credit reference agencies and fraud prevention agencies in order to perform credit and fraud searches and to verify your identity. This type of processing is necessary for our legitimate interests (i.e. the prevention of fraud and money laundering) and compliance with our legal obligations.
  • We and fraud prevention agencies may also enable law enforcement agencies to access and use your data to detect, investigate and prevent crime.
  • Legal and regulatory bodies, such as the Financial Conduct Authority, HMRC, the Information Commissioner’s Office (ICO), the Financial Ombudsman Service (FOS), fraud prevention agencies, our professional advisors and/or the courts when it is necessary for our legitimate interests (e.g. to obtain legal advice or for fraud prevention purposes) and/or when we have a legal obligation to do so.
  • Our conveyancing partner (for the purposes of completing the mortgage process) and our servicing partner if you choose to accept our mortgage offer.
  • Third parties who have introduced you to us (e.g. mortgage broker or comparison website) in order for them to manage their records about you, to ensure that the type of business that they refer to us is appropriate and to help us to resolve any complaint made by you and/or any dispute between you and us. This type of processing is necessary for our legitimate business interests (e.g. to help us to ensure that the intermediary or broker is fulfilling the terms of their contract with us) and in order for us to fulfil our legal obligations (e.g. our complaint-handling obligations).
  • Market research organisations who we engage to assist us in developing and improving our products and services. This type of processing is necessary for our legitimate interests (e.g. for our commercial operations).
  • Selected trusted third parties with whom we have partnered to provide you with various services which may be relevant to you (including for services / functionality unavailable to you unless this information is shared). We will always ask your permission before we share any of your information with any such trusted third party.

  • Any person or entity that is to provide, or has provided, any security of guarantee (and their professional advisors) in respect of your agreement with us and their professional advisors. This type of processing is necessary for the fulfilment of our contract with you (e.g. to enable us to recover any sums we have advanced under our agreement with you).

  • Any entity (and their professional advisors) that provides funding to us, any entity that provides us with debt or equity finance and any potential purchasers of any part of our business, such as ColCap Financial UK Limited or Rothesay Life Plc which will process your personal information in accordance with their Privacy Notices: Privacy Notice (Rothesay), Privacy Notice (ColCap). This type of processing is necessary for our legitimate interests (i.e. to enable us to fund our business).
  • As mentioned above, if you voluntarily provide us with special categories of your personal information, this will be regarded as constituting your explicit consent to us processing such information. This includes us sharing that information with third parties as necessary. For example, if you provide information relating to a complaint you have made or any financial difficulties you may be experiencing, then you will be consenting to us sharing that information with our professional advisors, any third party who introduced you to us (e.g. an intermediary or broker), administration companies or the FOS (as is relevant).

Molo will not sell, rent or lease your personal data to others. Molo will not share your personal data with third parties except in line with permitted uses, as set out in Section 3 of this Policy or as specifically consented to by you. Molo shares customer information across Molo-owned business entities and companies working on our behalf, but only as described in this Privacy Policy.

Circumstances may arise where, whether for strategic or other business reasons, Molo decides to sell, buy, merge or otherwise reorganise businesses in some countries. Such a transaction may involve the disclosure of personal data to prospective or actual purchasers or receiving it from sellers. It is Molo’s practice to seek appropriate protection for information, including personal data, in these types of transactions.

Molo may share your personal data with third parties acting on behalf of Molo, which may be located in other jurisdictions, outside of the UK and/or the EEA. We ensure that such transfers are lawful, including by ensuring that they are to jurisdictions that are considered to have equivalent privacy protections, and/or ensuring that the third parties to whom we transfer your personal data are under contract to Molo and bound by appropriate data protection clauses or other approved safeguards, as applicable in each situation.

Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.


How we collect and obtain your personal information

Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details, and device identifiers including IP address.

We may collect your personal information directly from you in a number of ways, including:

  • Help manage your account
  • when you apply for a Mortgage product on our website
  • when you provide it online or by any other method of communication, for example, on Chatbot, or when you provide it through the course of our relationship, for example, if you inform us of a change in your circumstances; and
  • technical information, including the Internet Protocol (IP) address used to connect to the internet, may be collected from you when you visit our website.

We may obtain your personal information indirectly from third parties in the following ways:

  • following an introduction to us by another third party, such as an estate agent or comparison website.

Another person provides your information to us when they apply to obtain a product from us:

  • on your behalf; or
  • that is to be held jointly with you; or
  • on behalf of a business, charity, trust or other organisation of which you are a director, shareholder, owner, trustee or beneficiary (as applicable);
  • from fraud prevention agencies, credit reference agencies, or Companies House when we carry out searches for the purposes of processing your application and/or during the course of your relationship with us; or

If you are applying to us through a third party, then they should have provided you with their own privacy notice in order to tell you (whether online or in person) how they may process your personal information. They should have also told you that credit reference and fraud prevention agency checks will be performed before we consider your application more fully and that your personal information is being shared with us for the purposes and uses set out in this privacy notice. If the third party did not tell you this, then you should let us know immediately by contacting us using the contact information set-out in the ‘Introduction’ section of this privacy notice.


Credit reference checks

In order to process your application, we will perform credit and identity checks on you with one or more Credit reference agencies. We may also make periodic searches at Credit reference agencies to manage your account with us.

To do this, we will supply your personal information to Credit reference agencies and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. Credit reference agencies will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

  • Assess your creditworthiness and whether you can afford to take the product;
  • Verify the accuracy of the data you have provided to us;
  • Manage your account(s);
  • Trace and recover debts; and
  • Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with Credit reference agencies while you have a relationship with us. We will also inform the Credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, Credit reference agencies will record the outstanding debt. This information may be supplied to other organisations by Credit reference agencies.

When Credit reference agencies receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. Credit reference agencies- will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the Credit reference agencies- to break that link.

The identities of the Credit reference agencies-, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the Credit reference agencies- are explained in more detail in the CRA information notice (CRAIN) at:


Automated decision making

In order to be as efficient and streamline as possible, we may perform automated processing (i.e. processing that is carried out without human intervention) on your personal information, to evaluate certain things about you. In particular, we may do this to analyse or predict (amongst other things) your economic situation, credit history, age, personal preferences, interests or behaviour. This could mean that automated decisions (i.e. decisions that are made without human intervention) are made about you using your personal information. For example, if you do not meet an element of our lending criteria (such as being over 18 or being a resident in the UK) any application for credit will be automatically declined. If you do meet our eligibility criteria, whether we lend will then be determined by your credit status.

We may automatically decide that you pose a fraud or money laundering risk as a result of our fraud prevention searches or if our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making; if you want to know more, please contact us using the contact information set-out in the ‘Introduction’ section of this privacy notice.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to employ you, or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us.


Your rights under applicable data protection law

Your personal information is protected under data protection law and you have a number of rights (explained below) which you can seek to exercise. Please contact us using the contact information set-out in the ‘Introduction’ section of this privacy notice if you wish to do so, or if you have any queries in relation to your rights.

If you seek to exercise your rights, we will explain to you whether or not the right applies to you; these rights do not apply in all circumstances. Please be aware that if your request is manifestly unfounded or excessive we may refuse to deal with your request or may charge a reasonable fee for dealing with it.


Your Rights


The right to be informed

We have provided this Privacy Statement to provide you with concise, transparent, intelligible and easily accessible information about how we use your personal data, including specific information depending on whether or not we have obtained your personal data directly from you.


Right to access

You have the right to access the personal information held about you and to obtain certain prescribed information about how we process it. This is more commonly known as submitting a ‘data subject access request’. We may request proof of your identity before sharing such information.


Right to rectify your personal information

If you discover that the information we hold about you is inaccurate or incomplete, you have the right to have this information corrected.

Right to be forgotten

You may ask us to delete information we hold about you in certain circumstances, this is often referred to as the ‘right to be forgotten’. This right is not absolute and only applies in certain circumstances. It may not therefore be possible for us to delete the information we hold about you, for example, if we have an ongoing relationship or are required to retain information to comply with our legal obligations to exercise or defend legal claims.

Right to restriction of processing

In some cases, you may have the right to have the processing of your personal information restricted. For example, where you contest the accuracy of your personal information, it may be restricted until the accuracy is verified, or where the processing is unlawful but you object to it being deleted and request that it is restricted instead.

Right to data portability

You have the right to receive, move, copy or transfer your personal information to a controller which is also known as ‘data portability’. You have the right to this when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means. You should note that this right is different from the right of access (see above) and the types of information you can obtain under the two separate rights may be different.

Right to object to processing

You may object to the processing of your personal information (including profiling) when it is based upon our legitimate interests. You may also object to the processing of your personal information for the purposes of direct marketing (including profiling to the extent it relates to direct marketing) and for the purposes of statistical analysis.

Rights with respect to automated decision-making and profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. You can object to your personal data being used in this way. We are permitted to use automated decision-making and profiling if the decision: (a) is necessary for entering into, or performance of, a contract between you and us; (b) is authorised by EU or a member state law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or (c) is based on your explicit consent. Where we engage in automatic decision-making or profiling in connection with a contract between us or further to your explicit consent, we implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention from us in the course decision-making process, and the opportunity to express your point of view and to contest the decision.

Children’s privacy

Molo is committed to protecting the privacy needs of children and we encourage parents and guardians to take an active role in their children’s online activities and interests. Molo does not knowingly collect information from children under the age of 16 and Molo does not target its Website or any of its services to children under the age of 16.


Keeping your personal data secure

Molo is committed to protecting the information you provide us. To prevent unauthorised access or disclosure, to maintain data accuracy, and to ensure the appropriate use of the information, Molo has in place appropriate technological and operational procedures to safeguard the information we collect. If you believe Molo has handled your personal data in a manner that does not comply with this Privacy Policy, please contact us by the means specified below at Section 10 of this Privacy Policy.

Changes to this Privacy Policy

If there are updates to the terms this Privacy Policy, we will post those changes and update the revision date in this document, so you will always know what information we collect, how we use it, and what choices you have. For material changes to this Privacy Policy, Molo will actively notify affected individuals.

How long your personal information will be stored for

We only keep your personal information for as long as it is necessary to fulfil the purposes for which it is processed (as described above). In accordance with our retention policy, we will retain your personal information for a minimum of six years from the end of our business relationship with you. Our business relationship will be deemed to be at an end on the date upon which your account is closed (which will either be when all outstanding sums under the agreement have been repaid or when we stop pursuing arrears on the account) or when your application has been declined. Please note that if your personal information is shared with third parties (as detailed above) they may have different retention policies. Fraud prevention agencies can hold your personal data for different periods of time; if you are considered to pose a fraud or money laundering risk, note that your data can be held by them for up to six years.

Keeping your information accurate

We strive to ensure that your personal information is kept up to date and accurate. If any of the personal information you have given to us or third parties changes, such as your contact details, home ownership status, employment status or marital status, please promptly inform us in accordance with the terms and conditions of your agreement with us. You will be required to provide us with any changes to your personal information under the agreement you enter into with us if your application for a mortgage product is accepted. If you fail to do so this will put you in breach of your agreement.

How we monitor your communications

Subject to applicable laws, we will monitor and record calls, emails, text messages, social media messages and other communications. We will do this for the purposes of complying with applicable laws and regulations and our own internal policies and procedures, to prevent or detect crime, to protect the security of our communications systems and procedures and for quality control and staff training purposes.

What to do if you have concerns or want to make a complaint

If you have any concerns regarding our use of your information, please notify our as soon as possible using the contact information set-out in the ‘Introduction’ section of this privacy notice. If we cannot resolve a complaint to your satisfaction you can contact the Information Commissioner’s Office at or by telephoning 0303 123 113 if the complaint relates to the way your personal information has been handled. We’re registered with the Information Commissioner’s Office under number ZA310806. Molo Tech Limited is registered in England. Registered company number: 10510180. Registered office: 84 Eccleston Square London SW1V 1PX.