OUR POLICIES

Privacy Policy

Retail Capital (UK) Ltd 

Trading as Recap 

1. Introduction

This privacy policy should be read together with our website Terms of Use. 

Retail Capital respects your privacy and is committed to protecting your Personal Data. This privacy policy sets out the basis on which any personal data we collect from you or about you will be processed by us

Retail Capital’s website and our services are not intended for children, and we do not knowingly collect data relating to children.  Retail Capital does not knowingly collect, use, or disclose personal information from or to children under age 16 without obtaining written, verifiable consent from a parent or legal guardian. 

2. Contact Details

Retail Capital is made up of different legal entities consisting of:

  • Retail Capital (UK) Ltd trading as Recap; and
  • Retail Capital Europe (CY) Limited. 

This privacy policy is issued on behalf of the Retail Capital, so when we mention “Retail Capital”, “we”, “us” or “our” in this privacy policy, we are referring to Retail Capital trading as Recap that is the controller and that is responsible for processing your personal data.  If you have any questions about this privacy policy, including any requests to exercise legal rights, please contact us at legal@recap.global or Address: 1st Floor Ariel House, 74a Charlotte Street, London, W1T 4QJ, United Kingdom.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

3. Changes to this privacy policy and your duty to inform us of changes

This privacy policy was last updated on 17 May 2023. It is important that the Personal Data we hold about you is accurate and current.  Please keep us informed if your Personal Data changes during your relationship with us.

4. Third-party links

Our website may contain links to and from the websites of our partner networks, advertisers, and affiliates.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.  Please check these policies before you submit any Personal Data to these websites.

5. Personal data we collect about you

We will never intentionally collect any unnecessary personal data about you, and we do not process your information other than as specified in this policy.

Personal Data means any information about an individual from which that person can be identified.  It does not include data where the identity has been removed (anonymous data).  We may collect, use, store and transfer different kinds of Personal Data about you which we may include the following: 

  • Your name, contact number, email address, date of birth, physical address, gender, passport, or other identification details, financial information, and your job title; and
  • Information about your employer or the entity that you represent, its name, postal and email addresses, telephone numbers; type of entity such as corporation, LLC, partnership, or sole proprietorship; your Employer Identification Number; the date the business was started; its bank and routing number and account number; its bank statements and its management and/or audited accounts and its physical addresses; and
  • Information that you provide by visiting our website, including, but not limited to, traffic data, location data, weblogs, and other communication data, whether this is required for our own billing purposes or otherwise, and the resources that you access (unless you register on our website, you are free to browse our website without providing us with any personal data. Please review the section below on our use of Cookies); and
  • Information about the directors, shareholders, or members where the applicant is a company, partnership, or other business, including their names, contact numbers, email addresses, dates of birth, physical addresses, gender, passport or other identification details, financial information; and
  • Financial information (including details of card or other transactions); and
  • Information obtained from credit reference agencies as described in more detail below; and
  • Information that you provide when providing feedback or when you report a problem with our website; and
  • Information that you provide when you contact us, or we contact you. We may keep a record of that correspondence and information you disclose to us.

We also collect, use, and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature.  If we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We generally do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Where we do collect any of these special categories of personal data, we will do so only where we are lawfully permitted to do so. We also do not collect any information about criminal convictions and offences.  

6. If you fail to provide personal data

Where we need to collect personal data by law or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to process your application or provide products or services to you. 

7. Legal bases for processing

We will only use your personal data when the law allows us to.  Generally, we do not rely on consent as a legal basis for processing your personal data, although you are entitled to object to the processing of your personal data where we (or any of the Third Parties identified at 15) are relying on a legitimate interest and where you feel it impacts on your fundamental rights and freedoms.  You also have the right to object where we are processing your personal data for direct marketing purposes. You can exercise your rights any time by contacting us at the addresses provided above in this policy.  We also process your personal data where we need to comply with a legal or regulatory obligation.

8. How is your personal data collected?

We use different methods to collect data from and about you including through:

  • Direct interactions. You may give us your personal data by filling in forms or by corresponding with us by phone, email or otherwise. This includes Personal Data you provide when you register to use our website, engage with learning content, purchase, or subscribe to our products and services, search for a product, participate in discussion boards or other social media functions on our website, enter a competition, promotion, or survey, and when you report a problem with our website; and
  • Automated technologies or interactions. We automatically collect technical data about your equipment, browsing actions and patterns as you use our website. We collect this Personal Data by using cookies and other similar technologies; and
  • Third parties or publicly available sources. We also work closely with third parties (including, for example, business partners, sub-contractors or processors in technical and payment services, analytics providers, search information providers, credit reference agencies) and we may receive Personal Data about you from them where they are legally allowed to share your Personal Data with us.
9. Purpose and lawful basis for processing your Personal Data

The table below sets out the different categories of your personal data that we collect, the lawful basis upon which we do so and the purpose for which we collect your personal data. 

Categories of Personal Data Source of Personal dataLawful Basis Purpose of Processing 
Email address.Our business partners e.g., Swoop Finance Limited.  Legitimate Interest. Recap may use your email address to not only offer our assistance in completing your application, but to keep you updated on the status of your application, allow you to electronically sign your contract, to send you your monthly statements and to communicate with you any updates we deem relevant to you regarding our products/services.

Business name. 

(This may not be personal data depending on the type and size of the business).

Our business partners e.g., Swoop Finance Limited.  Legitimate Interest.Recap’s products are for businesses only. The name of your business is important not only to contact you regarding the products that you express interest in, but to provide a tailored offer and support from our Funding Specialists. 
Business phone number. Our business partners e.g., Swoop Finance Limited.  Legitimate Interest. Recap may use your business phone number to not only offer our assistance in completing your application, but to contact you regarding the performance of your business’s contracts with Recap and to communicate with you any updates we deem relevant to you regarding our products/services.
Intended use of funds. Our business partners e.g., Swoop Finance Limited.  Legitimate Interest.

Recap may use this information to evaluate your application, in the process of which such information is used for the purposes of preventing fraud, money laundering and crime. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications. 

Business industry or sector.  

(This may not be personal data depending on the type and size of the business).

Our business partners e.g., Swoop Finance Limited.  Legitimate Interest. This information will allow Recap to gain a better understanding of your business and how it operates, to ensure that your application is fairly evaluated, and the products applied for by you are accurately priced and responsibly offered. Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Business financial revenues.

(This may not be personal data depending on the type and size of the business).

Our business partners e.g., Swoop Finance Limited.  Legitimate Interest. Recap uses your business’s financial revenue to assist in evaluating your application and ensure that the product offered to you is of the right amount and price. Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications. 

VAT number. 

(This may not be personal data depending on the type and size of the business).

Our business partners e.g., Swoop Finance Limited.  Legitimate Interest. Recap may use the VAT information provided by you to assist in evaluating your application and in the case such application is successful, for our invoices to you. Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Personal information of the proprietor of a sole proprietorship and partnership or in the case of a Limited company, the directors, shareholders, or persons of significant control (PSC).

This includes: 

  • Full Name.
  • Date of Birth. 
  • Home ownership status and address. 
Our business partners e.g., Swoop Finance Limited.  Legitimate Interest.

Recap uses this information in conjunction with other authorised third-party service providers to evaluate your application by undertaking checks including those relating to KYC for money laundering purposes and the prevention of fraud. In the instance that you are providing this personal information on behalf of a third party, they must be informed and directed to this Privacy Policy. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications. 

Recap may use your home address to contact you with respect to any matters regarding your application and for the purposes of the performance of the contract entered with Recap and your business or you. 

Other personal information submitted in the application including: 

  • Phone number.
  • Title. 
Our business partners e.g., Swoop Finance Limited.  Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

Recap may use your phone number to recover payments and exercise other rights we have in terms of the contract we have with your business or you. Recap may also use your phone number to answer any questions you might have on our product offerings and to manage complaints and thereby ensure quality service.

Recap may use your title to provide, manage and tailor our product offerings to you. 

Company details.Companies House. Legitimate Interest. 

Given that this information is part of the public record, Recap will make use of it to assist in the evaluating of your application by verifying that your business is correctly registered. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Bank statements. Collected directly from you.Legitimate Interest.Recap uses copies of bank statements to assist in verifying business revenues while evaluating your application. Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.
Bank account details. Collected directly from you.Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.Recap will use your bank account details to provide you with funds and collect direct payments that were agreed to in the contract. We may also require additional bank account documentation to verify not only your ownership of the account but your identity too.
Bank account and transactional data. Collected directly from you, in association with your bank and our open banking provider.Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.Recap may request that you provide access to bank account and transactional data via the Open Banking function provided by an authorised company, to connect to your bank account and retrieve real-time information for the purposes of evaluating your application by verifying your business revenues. 

Other data including: 

Identity and biometric data.

Fraud prevention agencies, such as ComplyAdvantage Limited and TrustID Limited.Processing is necessary for compliance with a legal obligation to which Recap is subject.Recap will use this information to aid in the prevention of fraud, money laundering and terrorist financing. This information will include identity and biometric data that will be encrypted and securely stored and only ever used to verify your identity through Digital Identity Document Validation Technology (IDVT).
Financial transaction details that have been processed through your card terminal(s) and/or bank account. A payment’s processor, e.g., GoCardless Ltd.Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

Recap may use this information to assist in evaluating your application and ensure that the product offered to you is of the right amount, price, and term. This information will be used to protect our interests in property and exercise the rights we have under our contract with your business or you. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Credit report and identity details.Credit Reference Agencies and Regulated Credit Bureaus, such as Experian Limited.Legitimate Interest.

Recap will use this information to ensure that the product offered is suitable to you and your business, during the process of evaluating your application. This information will also be used to verify the identities of your business’ directors, where applicable. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Landlord references. Existing business landlords. Legitimate Interest. 

Recap will use this information to assist in evaluating your application, by verifying that you have no related outstanding liabilities or other concerns that may affect our ability to offer you an advance. 

It may also be used to assist in gaining a better understanding for the evaluation of other future applications.

Publicly accessible information

 

Social media and other media coverage, business website(s), search engines and registrations, etc.Legitimate Interest. 

Recap may use this freely available information relating to your business, you or any related directors, shareholders, or PSCs to assist in evaluating your application and verifying identities. 

Recap may also use this information to assist in gaining a better understanding for the evaluation of other future applications.

Device technical data.Device used to access Recap’s website.Legitimate Interest. This information, including IP address, browser, and device type, is used to assist us in detecting and resolving issues on the website to ensure that you have the best experience possible on our website. Recap uses cookies to collect this information once you click ‘Accept All’ in the cookie pop-up window.

 

Data shared with Third Parties (see also paragraph 15)

Recap may share your data with third parties in the process of providing you with an offer, during application review and in performing the contracts entered with you.

Where it is lawful to do so: 

  • Recap will share your information with payment processors to process financial transactions on your behalf. 
  • Recap will work with Open Banking providers to access your financial data to assist in evaluating your application.
  • Recap uses cloud computing providers to process your application and store your data. 
  • Recap, by sending your full name and email address at minimum, may use mailing houses to send marketing or account information to you on our behalf. 
  • Recap will use a third-party operational fulfilment centre to process parts of your application. 
  • Recap uses a cloud-based electronic signature provider, DocuSign, to produce your unique contract. 

In every instance, the information shared with third parties is limited to that which is necessary for them to provide their services. You can find out further information from the relevant third party’s privacy notice  or by contacting us using the contact details set out in section 2 above.

Such third parties include the following: 

  • Credit Reference Agencies, as more fully explained at paragraph 16. Please see Experian Limited’s privacy policy at https://www.experian.co.uk/legal/privacy-statement for further information regarding their use of personal data. 
  • ComplyAdvantage, TrustID Limited and CRIF Realtime Limited, to carry out anti-money laundering checks. 
  • Other fraud prevention agencies such as CIFAS and, where necessary or required to do so to comply with applicable laws or directives, law enforcement agencies, government, or regulatory bodies to detect, investigate and prevent crime.
  • GoCardless Limited, to store and process your payment details according to the Direct Debit Mandate and Merchant Funding Agreement signed by you. Please see GoCardless Limited’s privacy policy at https://gocardless.com/privacy/ for further information regarding their use of personal data.
  • Debt collectors who, where necessary, will represent us in the collection of any outstanding debt.
  • AVOXI Inc., to store and process the recordings of our calls with you. 
  • Recap uses a tool provided by TrueLayer Limited (www.truelayer.com) (“TrueLayer”) that allows you to send information on your payment accounts to us and other service providers. In order to use our services, you will be asked to enter your payment account details with TrueLayer and agree to their Terms of Service. The Terms of Service set out the terms on which you agree to TrueLayer accessing information on your payment accounts for the purposes of transmitting that information to us. TrueLayer is subject to UK and EU data protection laws and is required to treat your data in accordance with those laws, as well as the Terms of Service and TrueLayer’s Privacy Policy. TrueLayer Limited is authorised by the UK Financial Conduct Authority under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 (Firm Reference Number: 901096).
  • Where Recap obtained your details from a partner, such as a referral website or financial broker, we may share information on the status of your application or any products that may be provided to you. 
10. When we may contact you

If you are an existing customer, we may contact you by telephone, SMS, e-mail or by written material with information about goods and services similar to those which were the subject of a previous sale or to deal with any requests for information or as a result of any breach of the terms of our contract with you.

The contacting of customers and relevant parties will be exercised on the following basis:

  • Where the data subject has given express consent to the processing of the personal data for one or more specific purposes to us; or
  • Where we believe that you have a legitimate interest in the communication. This will be because you:
  • Have previously utilised the services of Retail Capital UK Ltd; or
  • Have indicated an interest in the financial products provided by Retail Capital UK Ltd; or
  • May have a professional interest in Retail Capital UK Ltd and the services it provides.

The above includes (but is not limited to) a customer abandoning an application online before submission, direct marketing, the previous provision of working capital, or where the customer has requested to be added to the communications and/or newsletter campaign emails. This would have been either by opting in to receive offers from Retail Capital UK Ltd or by opting in to receive such via third party collaborative competitions.

11. Marketing 

We strive to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising.

We may use your Personal Data to form a view on what we think you may want or need, or what may be of interest to you.  This is how we decide which products, services and offers may be relevant for you.  You will receive marketing communications from us if you have requested information from us or purchased services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.

12. Opting out 

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or.  Where you opt-out of receiving these marketing messages, this will not apply to Personal Data provided to us as a result of a product/service purchase, product/service experience or other transactions.

13. Cookies and similar technologies

Our website may use cookies to store information about your site usage. A cookie is a small text file that is sent to your browser from a web server and then stored on your hard drive. Cookies enable us to recognize your computer and record information from your visits to the site, such as your preferred settings.  This saves you having to re-enter the same data each time you use the site and allows us to provide you with a more customized experience.

We may also use cookies and analytical software to collect anonymous data for internal research purposes, including without limitation:

  • To monitor site usage; and/or
  • To keep an audit trail; and/or
  • To understand visitors’ browsing habits; and/or
  • To analyse trends and demographic statistics; and/or
  • To compile statistical reports.

Most internet browsers accept cookies by default; however, you can usually change your browser settings to reject cookies if you would prefer not to receive them. If you choose not to receive our cookies, you will not be able to receive any personalized features and you may not be able to benefit from all our services.

Currently our website does not respond differently or limit practices under the terms of this privacy policy when you access our online services with a browser that uses a do not track signal or similar mechanism.

You can set your browser to refuse all or some browser cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the website may become inaccessible or not function properly. 

For more information about the cookies we use, please see our Cookie Policy.

14. Change of purpose 

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

15. Disclosure of your Personal Data

We will not sell Personal Data and no Personal Data will be disclosed to anyone except as provided in this privacy policy. We may disclose your Personal Data if required:

  • By a subpoena or court order; and
  • To comply with any law; or 

We may also share your Personal Data:

  • With other companies within the Retail Capital Group; and
  • With our service providers or processors under contract, as permitted by law; and
  • With credit reference agencies/bureaus to report account information, as permitted by law; and
  • With social media platforms when you use tools or functionality on our website provided by those platforms (such as “recommend” or “share” buttons); and
  • With marketing partners where you register for events, webinars; and
  • With public or government authorities to follow applicable law or to respond to legal process (like a subpoena). We also may share your Personal Data when there are threats to the physical safety of any person, violations of this privacy policy or other agreements, or to protect the legal rights of third parties, including our employees, users, or the public as required by law; and
  • For business transactions like a merger, or sale of our assets, or as part of the due diligence for such contemplated transactions. If a corporate transaction occurs, we will provide notification of any changes to control of your Personal Data, as well as choices you may have; and
  • With your consent. For example, with your consent, we post user testimonials that may identify you; and
  • With your employer or organization where you create an account or user role with an email address assigned to you as an employee, contractor, or member of an organization, that organization may find your account and take certain actions that may affect your account.

We may need to disclose Personal Data to our employees that require Personal Data to perform their work. These include our responsible management, human resources, accounting, audit, compliance, information technology, or other personnel. Any of our employees or personnel that handle your Personal Data will have signed non-disclosure and confidentiality agreements.

We do not allow our third-party service providers who are engaged to process your Personal Data on our behalf to use your Personal Data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

16. Credit Reference Agencies 

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs)”. When you apply for financial products from us, we may also carry out periodic searches at CRAs to manage your account.

Where the application is in the name of a company, we will carry out credit and identity checks against the directors and shareholders of the company.  Where the application is in the name of a partnership or Limited Liability Partnership, we will carry out those checks against partners or members of the applicant; where the application is a small partnership or sole trader, we will carry out credit checks on the owners/partners and any connected members of the applicant(s).

To do this, we will supply your personal information to CRAs, and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

  • Assess creditworthiness and affordability; and
  • Verify accuracy of the data you have provided to us; and
  • Prevent criminal activity, fraud, and money laundering; and
  • Manage your account; and
  • Trace and recover debts; and
  • Ensure any offers provided to you are appropriate to your circumstances.

Using information in this way is necessary for our legitimate interests of managing our credit and regulatory risk.  By submitting an application with us on behalf of a company, a partnership or Limited Liability Partnership, you warrant that you have obtained consent from each director and/or shareholder of the company, alternatively from each member or partner of the partnership or Limited Liability Partnership that you are acting for, so that we may carry out credit and identity checks at one or more CRAs.

We will continue to exchange information about you with CRAs while you have a relationship with Retail Capital. If you do not repay in full and on time, we are at liberty to report the same to the CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.  

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention and your data protection rights with the CRAs are explained in more detail in the industry-wide credit reference agency information notice (“CRAIN”).

The CRAIN is accessible from Experian’s website at www.experian.co.uk/legal/crain

17. International transfers 

We may transmit or transfer Personal Data outside the United Kingdom to be stored on servers located outside the United Kingdom where the laws protecting Personal Data may not be as stringent as the laws of the United Kingdom. 

Whenever we, or anyone we share your data with, transfer your personal data outside of the United Kingdom or European Economic Area, we impose contractual obligations approved by the UK data protection authority which give personal data the same protection it has in the UK on the recipients of that data to protect your personal data to the standard required in the European Economic Area. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

You consent to us processing your Personal Data in a foreign country whose laws regarding the processing of Personal Data may be less stringent, subject to the safeguards referred to above.

18. Data security

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality. We have put in place physical, electronic, and administrative safeguards that are designed to protect your Personal Information from loss, misuse and/or unauthorized access, disclosure, alteration, and destruction.  We will notify you and any applicable regulator of a breach where we are legally required to do so. We execute regular penetration tests using third party software in order to continually test and indicate the strength of our technical defences.

We have several layers of security measures in place to protect your information, including:

  • An up-to-date anti-virus software to protect against viruses damaging data and infrastructure,
  • Periodic review of our information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to systems; and
  • Housekeeping measures by regular backups, encryption, and network domain policy.
19. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for.

We’ll keep records of any financial transactions, and details regarding the information that you provided to us while making an application for one of our products, for a minimum of 6 years from the end of our relationship with you. We need to do this so that we can respond to any complaints or disputes.

We’ll keep the information that’s needed to provide you with the service that you’ve requested for as long as it takes us to provide the services and for 7 years from termination of the contract for provision of the services.

If you’ve asked us not to use your details for marketing purposes, we will need to keep some details to make sure our systems and processes reflect your preferences. We will implement your opt-out request as quickly as possible. However, you may receive emails for up to 30 days, or marketing by post for up to 60 days, following your opt-out request. This is because our marketing campaigns are usually prepared in advance, and it is often not feasible to remove an individual’s details after this point.

In addition, we will retain any data about you that we need in order to comply with our legal obligations (for example applicable UK tax law).

20. Your personal data rights

Under the General Data Protection Regulation you have a number of important rights free of charge. In summary, those include rights to:

  • Access to your personal data and to certain other supplementary information that this Policy is already designed to address; and
  • Require us to correct any mistakes in your information which we hold; and
  • Require the erasure of personal data concerning you in certain situations; and
  • Receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations; and
  • Object at any time to processing of personal data concerning you for direct marketing; and
  • Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you; and
  • Object in certain other situations to our continued processing of your personal data; and
  • Otherwise restrict our processing of your personal data in certain circumstances; and
  • Where consent is our lawful basis for processing your personal data, withdraw such consent; and
  • Claim compensation for damages caused by our breach of any data protection laws.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individual rights under the General Data Protection Regulation.

21. Automated decisions

As part of the processing of your personal data, decisions may be made by automated means.

We may automatically decide that you pose a fraud or money laundering risk or if our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers; or is inconsistent with your previous submissions; or you appear to have deliberately hidden your true identity.

We make automated decisions based on the information that you provide, and that we gather from third parties, as part of your application to determine your financial profile.  The outcome of these automated decisions may mean that we do not approve your application for one of our products.

These automated decisions use a statistical process based on your or your business’ historical transactions (details you have provided) and historical credit performance as a business and as an owner of a business (details you have provided and/or publicly available information). If you are an existing customer, the automated decisions will also take into account your performance of previous/current contractual obligations.