Mortgage Train Academy Ltd ("CaseFlow", "we", "us", "our") operates the CaseFlow service at getcaseflow.co.uk. We are registered in England & Wales. Our registered address is Olympus House, Olympus Park, Gloucester, GL2 4NF. We are registered with the Information Commissioner's Office under reference ZC154722.
For any data protection enquiry, contact us at info@mortgagetrainacademy.co.uk. We aim to respond within 5 working days.
CaseFlow handles personal data in two distinct capacities and this distinction matters:
If you are an end client of a broker using CaseFlow, your broker is responsible for your personal data and should be your first point of contact for any privacy questions. We can assist in our capacity as processor where required.
From broker account holders:
Entered by brokers about their clients:
Special-category health data (protection questionnaire only):
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing and administering the CaseFlow service | Account and client case data | Contract performance (Art 6(1)(b)) |
| Processing subscription payments | Account details, subscription status | Contract performance (Art 6(1)(b)) |
| Sending system emails (progress updates, account notices) | Broker and client email addresses | Contract performance / Legitimate interests |
| Security monitoring, fraud prevention, debugging | IP addresses, access logs | Legitimate interests (Art 6(1)(f)) |
| Improving and developing CaseFlow | Aggregated, anonymised usage patterns only — no individual client data | Legitimate interests (Art 6(1)(f)) |
| Processing special-category health data (protection questionnaire) | Health and lifestyle information | Explicit consent (Art 9(2)(a)) |
| Complying with legal obligations | As required by applicable law | Legal obligation (Art 6(1)(c)) |
We do not sell personal data, use it for advertising, or share it with third parties for their own marketing purposes.
We share personal data only with the following trusted sub-processors, who act strictly on our instructions under written data processing agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render Services Inc. | Application hosting and encrypted database storage | USA (SCCs / UK IDTA in place) |
| Resend Inc. | Transactional email delivery (system notifications) | USA (SCCs / UK IDTA in place) |
| Stripe Inc. | Subscription payment processing | USA / EEA (SCCs / UK IDTA in place) |
| Twilio Inc. (optional) | SMS notifications where enabled | USA (SCCs / UK IDTA in place) |
We may also disclose personal data where required by law, court order, or to protect the rights, property, or safety of CaseFlow, our users, or the public. We will notify affected parties where legally permitted to do so.
Beyond the above, we do not share, sell, rent, or trade personal data with any other third parties.
Our sub-processors may process data outside the UK and EEA. Where this occurs, we ensure an appropriate safeguard is in place — either a UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) approved by the ICO. You can request copies of the relevant transfer mechanisms by contacting us.
Brokers remain responsible for their own regulatory record-keeping obligations (for example, FCA rules on maintaining client records), which may require them to retain copies of case information independently of CaseFlow.
Despite these measures, no internet-based service can guarantee absolute security. We encourage brokers to use strong, unique passwords and to contact us immediately if they suspect any unauthorised access.
In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay. We maintain an internal breach log regardless of whether notification is required.
Depending on how and why we use your data, you may have the following rights:
If you are a client of a broker using CaseFlow, please contact your broker directly in the first instance, as they are the controller for your data. We will assist them in responding to your request in our capacity as processor.
If you are a broker or account holder, submit requests to info@mortgagetrainacademy.co.uk. We will respond within one calendar month, and will verify your identity before acting on the request.
CaseFlow does not use advertising cookies, tracking cookies, or third-party analytics cookies. We store a single session token in your browser's local storage to keep you logged in; clearing it or logging out removes it. Our payment provider Stripe may set cookies strictly necessary for secure checkout processing. Client portal pages (the progress links sent to mortgage applicants) use no cookies or storage at all.
CaseFlow is a business tool intended for use by regulated mortgage brokers and their adult clients. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently received such data, we will delete it promptly.
CaseFlow may contain links to third-party websites (for example, lender intermediary sites or the ICO). We are not responsible for the privacy practices of those sites and encourage you to read their own privacy policies.
We may update this policy from time to time. The "last updated" date at the top will reflect any changes. Where changes are material, we will notify broker account holders by email or via an in-app notice at least 14 days before they take effect. Continued use of CaseFlow after that date constitutes acceptance of the updated policy.
If you have a data protection concern that we are unable to resolve to your satisfaction, you have the right to lodge a complaint with the Information Commissioner's Office:
We would always prefer to resolve concerns directly — please contact us at info@mortgagetrainacademy.co.uk first.