JammJar Privacy Policy
1. Introduction
JammJar Ltd ("JammJar", "we", "us" or "our") is committed to protecting personal data and respecting the privacy of individuals whose information is processed through our services.
JammJar provides a cloud-based technology and AI-enabled CRM platform to businesses operating within the mortgage and financial services industry.
JammJar does not act as the data controller for customer or consumer personal data processed through the JammJar platform. JammJar processes this data only as a data processor or sub-processor and only on the documented instructions of the relevant customer.
The organisation that collected your information, such as your mortgage broker, mortgage adviser, financial services provider or another organisation using JammJar, determines why and how your personal data is processed.
• JammJar's role when processing personal data on behalf of customers;
• how we protect personal data processed through our platform;
• the limited circumstances in which JammJar acts as a controller for its own business operations; and • your rights in relation to personal data.
2. Who we are
JammJar Ltd is a company registered in England and Wales.
Company name: JammJar Ltd
Company number: 15294462
Registered office: 71-75 Shelton Street, London, WC2H 9JQ
Website: jammjar.com
Privacy enquiries: data@jammjar.com
JammJar provides technology to mortgage brokers, advisers, networks and other financial services organisations.
3. Our role when processing customer data
When personal data is entered, uploaded, imported, generated, recorded or otherwise processed through the JammJar platform on behalf of a customer, JammJar acts only as a data processor or sub-processor.
JammJar does not determine the purposes for which this information is processed.
JammJar Ltd - Privacy Policy Page 1
• what personal data is collected;
• why it is collected;
• the lawful basis for processing;
• how the information is used;
• how long the information should be retained; and
• which services and functionality within JammJar are used to process it.
JammJar processes this information only on documented instructions, as necessary to provide the contracted JammJar services, to maintain the security, availability and operation of those services, and where otherwise required by applicable law.
Our processing responsibilities are governed by contracts and appropriate data-processing agreements with our customers.
4. Personal data processed through JammJar
The nature of the JammJar platform means our customers may use it to process personal data relating to mortgage applicants, prospective applicants, existing customers and other individuals.
• names and contact details;
• dates of birth and address history;
• household and identification information;
• property and mortgage information;
• financial circumstances, employment, income, expenditure and commitments;
• bank, credit-related, insurance and protection information;
• fact-find and mortgage application information;
• supporting and identification documents;
• correspondence, emails and messages;
• telephone calls, call recordings and transcripts;
• meeting information, case notes, application history and audit records; and
• other information required by the organisation providing the relevant mortgage or financial service.
Depending on the circumstances, information processed through the platform may include special category personal data or other sensitive information.
JammJar does not independently decide to collect this information. The nature and extent of personal data processed through JammJar is determined by the organisation using the platform.
5. Why JammJar processes customer data
JammJar processes customer data solely to provide services to our customers and in accordance with their documented instructions.
• host and store customer information;
• provide CRM functionality and manage mortgage cases and workflows;
JammJar Ltd - Privacy Policy Page 2
• process documents and provide search functionality;
• provide communications functionality and transcribe communications;
• generate summaries and support compliance processes;
• provide audit trails, reporting and analytics;
• integrate with services selected by customers;
• provide AI-assisted functionality; and
• maintain, secure and support the platform.
The relevant controller is responsible for establishing the lawful basis for processing personal data. JammJar does not establish a separate lawful basis for customer data processed solely in our capacity as a processor or sub-processor.
6. AI and automated processing
JammJar uses artificial intelligence and automated technologies to provide functionality to its customers.
• extracting and classifying information from documents;
• analysing and summarising information;
• transcribing and analysing communications;
• identifying potentially missing or inconsistent information;
• assisting with file reviews and compliance processes;
• generating suggested content and retrieving information;
• assisting with administrative activities; and
• providing AI-assisted interaction with information held within the platform.
Where these functions involve customer personal data, JammJar processes that information solely as a processor or sub-processor on behalf of the relevant customer.
JammJar does not use customer personal data to train public or general-purpose artificial intelligence models.
Where third-party AI or machine-learning services are used to provide functionality, those providers process information under contractual arrangements designed to protect customer information and restrict its use.
JammJar does not independently use customer personal data to create advertising profiles, market to individuals or develop unrelated products or services.
JammJar's platform is designed to support human users and business processes. JammJar does not itself make solely automated decisions concerning mortgage approval, mortgage advice, lending, insurance eligibility or other regulated financial services decisions that produce legal or similarly significant effects for individuals. Responsibility for such decisions remains with the relevant regulated organisation.
7. Sharing customer data and sub-processors
JammJar may use carefully selected service providers to operate and provide elements of the JammJar platform. Where those providers process customer personal data on our behalf, they act as sub-processors within the JammJar service delivery chain.
JammJar Ltd - Privacy Policy Page 3
• cloud infrastructure and hosting;
• database and storage services;
• artificial intelligence and document-processing services;
• speech recognition and transcription;
• communications, email, messaging and telephony services;
• identity verification;
• application monitoring and security services; and
• other infrastructure necessary to provide functionality selected by our customers.
JammJar requires appropriate contractual and data-protection safeguards from sub-processors that process customer personal data.
JammJar remains responsible for its obligations to its customers in relation to its appointed sub-processors in accordance with applicable data protection law and our contractual commitments.
JammJar does not sell customer personal data or provide it to third parties for their own advertising or marketing purposes.
8. International data transfers
JammJar is a UK-based service and seeks to process and store customer data within the United Kingdom where this forms part of our contractual service commitments.
Some technology providers used to provide specific functionality may operate internationally. Where use of a service results in personal data being transferred outside the United Kingdom, JammJar implements an appropriate lawful transfer mechanism where required.
• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another mechanism recognised under UK data protection law.
Additional technical, contractual or organisational safeguards may also be applied where appropriate.
9. Security of customer data
Protecting customer information is a core part of the design and operation of JammJar. We maintain technical and organisational measures designed to protect personal data against unauthorised access or disclosure, accidental loss, destruction, alteration and other unlawful processing.
• encryption in transit and at rest;
• access and authentication controls;
• role-based access and customer data segregation;
• audit logging and security monitoring;
• vulnerability management;
• backup and recovery arrangements;
JammJar Ltd - Privacy Policy Page 4
• incident-management procedures;
• secure software-development practices;
• supplier security assessments; and
• controls limiting access to authorised personnel.
Access to customer personal data by JammJar personnel is limited to circumstances where it is necessary to provide, maintain, secure or support the service.
10. Retention and deletion of customer data
JammJar does not independently determine how long customer personal data should be retained. Retention of customer data is determined by the relevant customer or controller and our contractual arrangements with that customer.
When a JammJar customer relationship ends, customer data will be returned, retained or securely deleted in accordance with the customer's documented instructions, our contractual obligations, applicable legal requirements and JammJar's documented data-retention and deletion procedures.
Backups and technical copies may remain for a limited period following deletion where necessary for security, resilience and disaster recovery before being automatically overwritten or securely deleted.
11. Data protection requests relating to customer data
If your personal information is held within JammJar because you are dealing with a mortgage broker, mortgage adviser, financial services organisation or another JammJar customer, you should direct data protection requests to the organisation with which you have the relationship.
• access your information;
• correct your information;
• delete information;
• restrict or object to processing;
• obtain portable copies of information; or
• exercise other rights available under data protection law.
The relevant controller is responsible for determining and responding to these requests. Where JammJar receives such a request directly, we will not independently determine the outcome. Where appropriate, we will refer the request to the relevant customer or controller and provide reasonable assistance.
12. JammJar as a data controller
Although JammJar acts only as a processor or sub-processor in relation to personal data processed through the JammJar platform on behalf of customers, there are limited circumstances in which JammJar must act as a data controller for its own business operations.
• visit our website;
• contact JammJar directly or request information or demonstrations;
• work for existing or prospective customers;
JammJar Ltd - Privacy Policy Page 5
• work for suppliers or business partners;
• enter into contracts with us; or
• otherwise interact directly with JammJar as a business.
In these circumstances, JammJar may process limited information including name, job title, organisation, business email address, business telephone number, correspondence, meeting information, account administration information and technical information relating to use of our website.
This information is entirely separate from customer and consumer information processed through the JammJar platform.
13. How we use JammJar business contact data
Where JammJar acts as controller for its own corporate activities, we may use personal data to respond to enquiries, provide requested information, arrange demonstrations, establish and manage customer relationships, administer contracts, manage suppliers and partners, provide support, operate and secure our website, protect against fraud and security threats, comply with legal obligations, establish or defend legal claims, and communicate with relevant business contacts where permitted by law.
Depending on the circumstances, we rely on legitimate interests, performance of a contract or steps taken before entering a contract, compliance with legal obligations, or consent where required.
14. Website information and cookies
When you visit jammjar.com, certain technical information may be collected automatically, including IP address, browser and device information, operating system, pages visited, referring website, dates and times of access, and website security and diagnostic information.
Our website may use cookies and similar technologies. Cookies necessary for the operation and security of the website may be used without consent where permitted by law. Where cookies or similar technologies require consent, they will only be used after the appropriate consent has been obtained.
Further details about cookies used by our website are available through our cookie controls and/or Cookie Policy.
15. Marketing
JammJar may contact relevant business contacts regarding our products, services, events and developments where permitted by applicable law. Where consent is required, we will obtain it before sending marketing communications.
You can opt out of marketing communications at any time by using the unsubscribe mechanism provided in relevant communications or by contacting us.
We will not use personal data processed on behalf of JammJar customers to market JammJar services directly to their consumers. JammJar does not sell customer or consumer personal data for marketing purposes.
JammJar Ltd - Privacy Policy Page 6
16. Your rights where JammJar is the controller
Where JammJar acts as the controller of your personal data, UK data protection law may provide you with rights including access, rectification, deletion in certain circumstances, restriction, objection, data portability in certain circumstances, withdrawal of consent where applicable, and rights relating to certain forms of automated decision-making.
These rights are subject to conditions and exemptions contained in applicable data protection law.
To exercise a right concerning personal data for which JammJar is the controller, contact: data@jammjar.com
If the request relates to data held within JammJar on behalf of one of our customers, we will explain that the request needs to be handled by the relevant controller and, where appropriate, assist that organisation.
17. Complaints
If you have concerns about JammJar's handling of personal data for which JammJar is responsible, please contact us first so that we can investigate.
Email: data@jammjar.com
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
If your concern relates to the way a mortgage broker, adviser, network or other JammJar customer has collected or used your information, you should normally raise the concern with that organisation in the first instance.
18. Children's data
JammJar does not provide consumer services directly to children. Personal data relating to children may nevertheless be processed through the JammJar platform where a customer determines that the information is necessary for the provision of mortgage, financial or related services.
Where this occurs, JammJar processes the information solely as a processor or sub-processor and does not independently determine why that information is collected or how it is used.
19. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, business operations, applicable laws or regulations, or the way we process personal data.
The latest version will be published at jammjar.com. The date shown at the beginning of this Privacy Policy indicates when it was last updated.
20. Contact us
For questions about this Privacy Policy or JammJar's data protection practices, please contact:
JammJar Ltd
71-75 Shelton Street
JammJar Ltd - Privacy Policy Page 7
London
WC2H 9JQ
United Kingdom
Email: data@jammjar.com
Company number: 15294462
If your enquiry concerns personal information held by a mortgage broker, adviser or other organisation using JammJar, please contact that organisation directly. JammJar will assist the relevant controller where required under our contractual and legal obligations.
JammJar Ltd - Privacy Policy Page 8
