Don't invest unless you're prepared to lose money. This is a high-risk investment. You may not be able to access your money easily and are unlikely to be protected if something goes wrong. Take 2 mins to learn more.
Menu
Don't invest unless you're prepared to lose money. This is a high-risk investment. You may not be able to access your money easily and are unlikely to be protected if something goes wrong. Take 2 mins to learn more.
1. About us
This policy explains how LandlordInvest Limited, trading as Mustard, collects, uses, shares and protects personal data, and the rights you have over it. Please read it alongside our platform terms. Section 6 explains how we use cookies.
Who we are. LandlordInvest Limited ("Mustard", "we", "us") is the controller of your personal data. We are a company registered in England and Wales (company number 09245725), registered office 3rd Floor, Great Titchfield House, 14-18 Great Titchfield Street, London, W1W 8BD. We are authorised and regulated by the Financial Conduct Authority (FRN 660926) and registered with the Information Commission’s Office (ICO) (registration number ZA099073). "Mustard" is our trading name; the regulated entity and controller is LandlordInvest Limited.
Who this policy covers. It applies to personal data we process about:
Data Protection Officer. Our Data Protection Officer is Baljit Dhingra. You can contact the DPO about this policy or about how we handle your personal data at [email protected] or by post to the address above, marked for the attention of the Data Protection Officer.
2. What we collect and where it comes from
What we collect depends on how you deal with us.
| Category | Examples | Who it applies to |
|---|---|---|
| Identity | Name, title, date of birth, nationality, National Insurance number, identity documents, photographs and liveness checks (including facial biometric data), signatures | Investors, borrowers and connected parties, agents |
| Contact | Postal address and address history, email, telephone | Everyone who deals with us |
| Financial | Bank account details, transaction history on the platform, income, assets and liabilities, source of funds and source of wealth | Investors, borrowers and connected parties |
| Investor profile | Investor categorisation (for example restricted, high net worth or sophisticated investor statements), appropriateness assessment answers, investment preferences and holdings | Investors |
| Tax | Tax residency and, for an Innovative Finance ISA, your National Insurance number and ISA application declaration. | Investors |
| Lending and security | Loan applications, business and credit history, details of property offered as security, valuations, title information, loan performance, arrears and enforcement | Borrowers and connected parties |
| Credit and verification | Credit reports, identity and address verification results, insolvency and public record information | Borrowers and connected parties; investors for identity checks |
| Screening | Results of sanctions, politically exposed person (PEP) and adverse media checks, and fraud prevention information | Investors, borrowers and connected parties |
| Circumstances | Information you tell us about your circumstances that may affect how we support you, including any vulnerability | Anyone who chooses to share it |
| Account and security | Login details, passwords and security question answers | Platform users |
| Communications | Emails, letters, live chat and social media messages, notes of calls and call recordings. | Everyone who contacts us |
| Technical and usage | IP address, device and browser type, pages viewed, how you use the platform, and email open and click data | Website and platform users, email recipients |
| Marketing preferences | Your choices about receiving marketing from us | Everyone we market to |
Where it comes from. Most information comes from you. We also collect it from:
Do you have to provide it? Much of this information is needed for us to meet legal requirements (for example identity checks under the Money Laundering Regulations 2017) or to enter into a contract with you. If you do not provide it, we may not be able to open an account, accept an investment, or consider or complete a loan. Marketing information is always optional.
3. How we use it and our lawful bases
We only use personal data where UK data protection law (the UK GDPR and the Data Protection Act 2018) gives us a lawful basis. The table shows each purpose, the basis we rely on and, where we rely on legitimate interests, what those interests are.
| Purpose | Lawful basis | Our legitimate interest (where relevant) |
|---|---|---|
| Registering you and opening and running your account | Contract; for people connected to a borrower, legitimate interests | Dealing with the people who act for, own or control our customers |
| Verifying identity, customer due diligence, sanctions and PEP screening, ongoing monitoring and reporting suspicions | Legal obligation (Money Laundering Regulations 2017, Proceeds of Crime Act 2002, Terrorism Act 2000, UK sanctions regulations) | — |
| Categorising investors and assessing whether investing is appropriate for you | Legal obligation (FCA rules) | — |
| Assessing loan applications and creditworthiness, and deciding whether to lend | Contract (steps before entering into a loan or guarantee); legitimate interests for other connected parties | Lending responsibly and protecting investors' money |
| Matching investors with loans, processing investments, repayments and withdrawals, and holding client money | Contract; legal obligation (FCA client money rules) | — |
| Sharing loan information with investors | Legal obligation (FCA disclosure rules); legitimate interests | Letting investors make informed decisions about the loans they fund |
| Administering loans, monitoring security and collecting repayments | Contract; legitimate interests | Protecting investors' and our interests in the loan and the security |
| Managing arrears, tracing, enforcing security and bringing or defending legal claims | Legitimate interests; contract | Recovering money owed to investors and enforcing our and their legal rights |
| Preventing and detecting fraud and financial crime | Legal obligation; legitimate interests | Protecting our customers, investors and business from fraud |
| Handling enquiries and complaints, and supporting customers in vulnerable circumstances | Legal obligation (FCA rules, including the Consumer Duty); legitimate interests | Giving good service and fair outcomes |
| Record keeping, regulatory and tax reporting, and audit | Legal obligation | — |
| Opening and running an Innovative Finance ISA, reporting to HMRC as an ISA manager, and processing ISA transfers | Legal obligation (Individual Savings Account Regulations 1998); contract | — |
| Sending service messages about your account, the platform and changes to our terms | Contract; legal obligation | — |
| Running, securing and improving our website and platform | Legitimate interests | Keeping our systems secure and working well |
| Developing our products, credit risk models and statistical analysis | Legitimate interests | Improving our lending decisions and services |
| Direct marketing | Consent, or legitimate interests where the law allows (see section 6) | Telling customers about similar products and services |
| Selling, restructuring or raising finance for our business | Legitimate interests | Allowing an investor, buyer or lender to assess our business |
| Measuring how visitors use our website, and which websites refer people who register (see section 6) | Consent (given through our cookie banner) | — |
| Oversight, reporting, and shared compliance and administration with BPS Purestone Limited | Legitimate interests | Running our business effectively and meeting governance and reporting needs |
| Arranging and managing loans funded jointly with other lenders, such as Bridge Invest Ltd | Contract; legitimate interests | Offering borrowers joint or larger facilities and managing the loan with the co-funder |
| Preparing for an orderly wind-down, including passing loan records to another firm if we appoint one to administer the loans | Legal obligation (FCA rules on wind-down arrangements for loan-based crowdfunding platforms); legitimate interests | Making sure investors’ loans continue to be managed and repaid if we stop trading |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You can ask us for details of that assessment, and you have the right to object (see section 9).
4. Anti-money laundering, sanctions and PEP checks
Money Laundering Regulations statement. As required by regulation 41 of the Money Laundering Regulations 2017, we tell you that any personal data we receive from you for customer due diligence and our other obligations under those Regulations will be processed only for the purposes of preventing money laundering or terrorist financing, unless processing for another purpose is permitted by law or you have agreed to it.
Information about criminal offences. Our checks may reveal information about actual or alleged criminal offences, for example through sanctions lists, adverse media or fraud databases. We process this information only where the Data Protection Act 2018 allows it, relying on the conditions in Schedule 1 for:
Special category data. Identifying whether someone is a politically exposed person (PEP), or a family member or close associate of one, can reveal political opinions. We process this only to meet our anti-money laundering obligations, relying on the same substantial public interest conditions. If you tell us about a health condition or other circumstance that makes you vulnerable, we use it only to support you and treat you fairly, relying on the condition for safeguarding the economic well-being of individuals or, where appropriate, your explicit consent.
Biometric data. To check your identity, our identity verification software compares a photo or short video of you with the photo on your identity document, and checks that you are a real person. This uses facial biometric data, which is special category data. We use it only to verify your identity and prevent fraud, relying on the substantial public interest conditions for preventing or detecting unlawful acts and for regulatory requirements relating to unlawful acts and dishonesty.
We keep an appropriate policy document that explains how we protect this information and how long we keep it.
Reporting. We may be required to report suspicions of money laundering, terrorist financing or fraud to the National Crime Agency or other authorities. The law may prevent us from telling you that we have done so.
5. Credit reference, fraud prevention and automated decisions
Credit reference agencies. To assess applications, check identity, prevent fraud and meet our legal obligations, we search credit reference agencies (CRAs). We do this through Creditsafe Business Solutions Limited (FCA FRN 742313), which uses its data partner TransUnion International UK Limited (FCA FRN 737740) to supply consumer credit and identity data.
The CRAs give us public information (including the electoral register and insolvency and court records), shared credit information, fraud prevention information and payment history. When we search, the CRA keeps a record of the search, which other organisations may see. A search for a credit application may leave a footprint on your credit file; an identity check does not affect your credit score. We only search the CRAs; we do not report information about your loan or repayments to them.
The CRAs explain how they use personal data in the Credit Reference Agency Information Notice (CRAIN). See also:
Automated decision-making. We use automated tools to support identity verification, screening, fraud checks and credit assessment. These tools may produce scores, matches or alerts. We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing: a member of our team reviews the results before we decide to decline an application or account. If you would like to know more, or to challenge a decision, contact us using the details in section 10.
6. Marketing, email tracking and cookies
Marketing. We may send you news about new loans, our products and services by email or other electronic means. We do this only where you have agreed, or where you are an existing customer and the marketing is about similar products and services, in which case we will always give you a simple way to opt out. If you have registered with a business email address, we may contact you about our services in your business capacity, again with a simple way to opt out.
You can opt out at any time by using the unsubscribe link in any marketing email, changing your preferences in your account, or contacting us. Opting out does not affect service messages about your account or investments.
Email tracking. Some of our marketing emails contain small tracking technologies that tell us whether an email was opened and which links were clicked. We use them only with your consent, which you can withdraw at any time.
Strictly necessary cookies. These keep the website and platform working and secure, for example keeping you logged in and remembering your cookie choices. They do not need your consent.
Analytics cookies (Google Analytics). With your consent, we use Google Analytics, provided by Google, to understand how people use our site, for example which pages are visited and how visitors move between them. Google Analytics sets cookies (such as _ga) that last for up to two years. Google may process this data in the United States and is certified under the UK–US data bridge (see section 7).
Referral tracking. With your consent, we use our own script to record the website that referred you to us. If you then register, we link that referring web address to your registration so we can see which websites and partners bring us customers. The script saves nothing until you accept cookies. The referring address is stored on your device in your browser’s local storage until you reset your cookie preferences or clear your browser data; once linked to your account, we keep it with your account records (see section 8).
Your choices. Apart from strictly necessary cookies, nothing is set until you accept cookies in our cookie banner. You can change or withdraw your consent at any time through the Cookie preferences link at the bottom of every page, or by deleting cookies in your browser. We do not currently use advertising or social media tracking cookies. If we start to, we will update this section and ask for your consent first.
Social media. If you interact with our pages on social media such as LinkedIn or X, the platform provider will also process your data under its own privacy policy, and may share statistics about page visits with us.
7. Who we share it with, and international transfers
We do not sell personal data. We share it only as described below.
| Recipient | Why we share |
|---|---|
| Investors on our platform | To let them assess and monitor the loans they fund, and if a loan needs to be enforced. We share loan and security details (such as the borrower's name, the property, its valuation and loan performance), not identity documents or personal contact details |
| Our security agents, LLI Security Agent Ltd & LandlordInvest Security Agent Limited | They hold security over borrowers' property on behalf of investors |
| BPS Purestone Limited | It provides shared compliance and administration services to us, and receives information for oversight and reporting. It acts as an independent controller for oversight and reporting, and as our processor where it provides administration services to us on our instructions |
| Lenders we co-fund with, including Bridge Invest Ltd | Where a loan is referred between us or funded jointly (for example where one lends on a first charge and the other on a second charge) |
| Service providers who act on our instructions | IT, hosting and platform software; identity verification and screening; email, live chat and customer relationship tools; document storage and back-up. They may only use the data to provide services to us |
| Banks and payment service providers, including The Royal Bank of Scotland plc (RBS) | To hold client money and make payments |
| Credit reference agencies | See section 5 |
| Professional advisers and other parties to a loan | Solicitors, valuers, surveyors, receivers (including LPA receivers), insolvency practitioners, tracing and debt recovery agents, auditors, insurers and our other professional advisers |
| Your broker, introducer or other agent | Where they act for you |
| Regulators, law enforcement and public bodies | The FCA, HMRC, the National Crime Agency, the police, courts, the ICO and the Financial Ombudsman Service, where the law requires or allows it |
| Other ISA managers | To transfer an Innovative Finance ISA to or from another provider when you ask us to |
| A firm we appoint to administer loans | If we stop trading and appoint another firm to keep administering loans for investors under our wind-down arrangements |
| A buyer, investor or lender | If we sell, transfer or raise finance against all or part of our business or loan book, or a successor if we become insolvent |
| Anyone else | Where you ask us to, or agree |
Service providers acting on our instructions are bound by contracts that require them to keep your data secure and use it only as we direct. Most of the other recipients above are independent controllers, responsible for their own use of your data under their own privacy notices.
International transfers. We store your data in the United Kingdom. If you ask us to send money to, or receive money from, a bank account outside the UK, we make the payment through our bank, The Royal Bank of Scotland plc (RBS), and the payment details needed to process it (such as your name, account details and the payment reference) will be sent to the overseas bank and any intermediary banks. These transfers are necessary to make the payment you have asked for under our contract with you. Some of our service providers, such as Google (which provides our website analytics) and our document storage provider, may also process data outside the UK, including in the European Economic Area and the United States. When this happens we make sure the data is protected by one of the safeguards UK law requires:
You can ask us for a copy of the safeguards that apply.
8. How long we keep it
We keep personal data only for as long as we need it for the purposes in this policy, or as the law requires. When the period ends, we securely delete it or anonymise it.
| Record | How long we keep it |
|---|---|
| Customer due diligence and transaction records | 5 years after our business relationship ends (Money Laundering Regulations 2017, regulation 40) |
| Investor account and investment records | 6 years after your account closes |
| Loan, repayment and security records | 6 years after the loan is repaid or closed |
| Deeds, legal charges and guarantees signed as deeds | 12 years after the loan is repaid or closed |
| Applications that are declined or withdrawn | 5 years after the decision |
| Complaints | 6 years after the complaint is resolved |
| Records relevant to a dispute, enforcement or legal claim | Until it is finally resolved, then 6 years |
| Call recordings | 5 years |
| Website enquiries that do not lead to an account or application | 12 months |
| Marketing preferences | Until you opt out; we then keep a suppression record so we do not contact you again |
| Technical and usage logs | 12 months |
| Cookies | As set out in section 6 (Google Analytics cookies last up to two years) |
We may keep data for longer if a regulator or court requires us to, or if we need it for a legal claim or investigation.
9. Your rights and how to complain
You have the following rights over your personal data. Some apply only in certain circumstances.
| Right | What it means |
|---|---|
| Access | To get a copy of your personal data and information about how we use it (a "subject access request") |
| Rectification | To have inaccurate data corrected and incomplete data completed |
| Erasure | To have your data deleted where there is no good reason for us to keep it. We may need to keep some records to meet legal obligations, such as the Money Laundering Regulations |
| Restriction | To ask us to limit how we use your data, for example while we check its accuracy |
| Portability | To receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we rely on contract or consent and process it by automated means |
| Objection | To object to processing based on our legitimate interests. You can always object to direct marketing, and we will stop |
| Automated decisions | If a significant decision about you is made solely by automated means, to be told about it, give your view, have a person review it, and challenge it |
| Withdraw consent | Where we rely on consent, to withdraw it at any time. This does not affect processing before you withdrew it |
How to use your rights. Contact our Data Protection Officer at [email protected] or by post (see section 1). You can also ask anyone at Mustard and we will pass your request on. We do not normally charge a fee. We may need to confirm your identity, or your authority if you act for someone else (for example a solicitor or an attorney under a power of attorney). We will respond within one month, and will tell you if we need up to two further months for a complex request. Some rights are limited by law; for example, we cannot tell you about a report we have made to the authorities on suspicion of financial crime.
Complaining to us. If you are unhappy with how we have handled your personal data, please tell us first. You can complain to the Data Protection Officer by email to [email protected], by post, or by any other means. We will:
Complaining to the ICO. You can also complain to the Information Commission’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. The ICO will usually expect you to have raised your complaint with us first.
10. Other important information
Information about other people. If you give us information about someone else (for example a director, shareholder, beneficial owner or guarantor of a borrower), please make sure they know you are doing so and point them to this policy. Where we collect personal data about someone from another source, we will give them this information within one month, or when we first contact them if sooner, unless an exemption applies. We send this policy directly to guarantors and security providers.
Security. We use technical and organisational measures to protect personal data, including encryption, access controls, multi-factor authentication and staff training. Only people who need the data for their role can access it. If we suffer a personal data breach that is likely to put you at high risk, we will tell you without undue delay. Please help us by keeping your login details secret and contacting us straight away at [email protected] if you think your account has been compromised.
Children. Our services are not for anyone under 18, and we do not knowingly collect their data.
Other websites. Our websites may link to other sites. This policy does not cover them; please read their own privacy notices.
Changes to this policy. We review this policy at least once a year. If we make a significant change, we will tell you by email or on the platform before it takes effect. The date at the end shows when it was last updated.
Contact us. Data Protection Officer, LandlordInvest Limited (trading as Mustard), 3rd Floor, Great Titchfield House, 14-18 Great Titchfield Street, London, W1W 8BD. Email: [email protected].
Last updated: 26 October 2026