CompareTheLend — Privacy Policy

DRAFT for review — not yet legal advice. This is a working draft prepared to get you ~90% of the way there. Because CompareTheLend processes financial data and uses automated processing to support underwriting decisions, you should have a solicitor or data-protection specialist review it before it goes live — particularly Sections 6 (automated processing), 7 (sharing) and 9 (retention). Fill every [BRACKETED] placeholder before publishing. Placeholders to complete (from your company registration + ICO registration): - [CompareTheLend Ltd] — your registered legal name - [company number] — Companies House number - [registered office address] - [ICO registration number] — from your ICO data-protection fee registration - [privacy@comparethelend.com] — your data-request contact address (set this alias up in Cloudflare Email Routing) - [effective date]

Last updated: [effective date]

1. Who we are

This Privacy Policy explains how [CompareTheLend Ltd] ("CompareTheLend", "we", "us", "our") collects, uses, shares and protects personal data when you use our website at comparethelend.com and the services available through it (the "Service").

For the purposes of UK data protection law, [CompareTheLend Ltd] is the controller of the personal data described in this policy.

• Registered office: [registered office address]
• Company number: [company number]
• ICO registration number: [ICO registration number]
• Contact for privacy matters: [privacy@comparethelend.com]

We are governed by the retained EU General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

2. The short version

CompareTheLend helps UK businesses compare finance options and receive indicative funding decisions. To do that, we collect information about your business and its finances — including bank statement data you upload — and use it to produce an indicative assessment and to present offers from lenders on our panel. We only share your details with a lender when you choose to request an offer from them. We never sell your data. You have rights over your data, and you can contact us at [privacy@comparethelend.com] at any time.

3. The personal data we collect

Most of the data we handle is about your business, but some of it — for example the details of directors and authorised contacts — is personal data about individuals. We collect:

Account and identity data — your name, business email address, the business you represent, and a hashed version of your password (we never store passwords in readable form).

Business and application data — company name and number, entity type, trading history, the amount and purpose of the funding you are seeking, and the declarations you make during an application.

Financial data — the bank statements you upload, the transaction and balance information within them, and the metrics and indicative risk assessment we derive from them. This is the core of the Service and is treated as confidential.

Contact and directorship data — names, roles, email addresses and phone numbers of the directors or authorised representatives of the business.

Broker referral data — where an introducing broker refers you to us, we record which broker introduced you.

Technical and usage data — IP address, device and browser information, and information about how you use the Service, collected through server logs and essential cookies (see Section 11).

4. How we collect it

We collect personal data:

• Directly from you — when you create an account, complete an application, upload statements, or contact us.
• From an introducing broker — where a broker submits or refers your enquiry to us on your behalf.
• Automatically — through cookies and server logs when you use the website (see Section 11).

5. How and why we use your data

We use your personal data for the following purposes, each with a lawful basis under UK GDPR:

Where we rely on consent (for example, to share your data with a specific lender), you can withdraw it at any time — although this will not affect any sharing that has already taken place, and may mean we can no longer progress an application.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights; you can ask us for more detail about that assessment.

6. Automated processing and underwriting

This section is important. CompareTheLend uses automated processing to read your bank statements and produce an indicative risk assessment and pricing. You should understand:

• The indicative assessment is not a lending decision and not an offer of finance. It is a preliminary, illustrative view based on the information available.
• The assessment does not, by itself, produce a decision that has a legal or similarly significant effect on you. A qualified underwriter reviews applications, and any actual decision to offer or decline finance is made separately by a lender, under that lender's own processes.
• You have the right to request human involvement in, to express your point of view on, and to contest, any assessment we produce. Contact us at [privacy@comparethelend.com].

Reviewer note: Automated decision-making with legal or significant effect is restricted under UK GDPR (Article 22) and addressed in the Data (Use and Access) Act 2025. The clause above is drafted on the basis that your assessment is indicative and human-reviewed, and that the binding decision sits with the lender. Have your adviser confirm this reflects how the Service actually operates before you publish.

7. Who we share your data with

We do not sell your personal data. We share it only as follows:

Lenders you select. When you request offers, we share the relevant application and financial data with the specific lenders on our panel that you have chosen. Those lenders act as independent controllers of the data once they receive it, and their use of it is governed by their own privacy policies.

Your introducing broker. Where a broker referred you to us, we may share application status and outcome information with that broker so they can support your enquiry.

Our service providers (processors). We use trusted third parties to run the Service, under contracts that require them to protect your data and act only on our instructions — including our hosting and database providers, our email provider, and the service that processes uploaded statements.

Legal and regulatory recipients. We may disclose data where required by law, regulation, court order, or to establish, exercise or defend legal claims, or to prevent fraud.

8. International transfers

Some of our service providers are located outside the UK, including in the United States. Where we transfer personal data outside the UK, we ensure it is protected by an appropriate safeguard recognised under UK data protection law — such as UK "adequacy" regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards in place.

9. How long we keep your data

We keep personal data only for as long as we need it:

• Application and financial data: retained for up to [6] years after your last activity, to meet legal, accounting and fraud-prevention obligations, then securely deleted or anonymised.
• Account data: retained while your account is active and for a reasonable period afterwards.
• Technical and log data: retained for a short period for security and diagnostics.

Reviewer note: the 6-year default reflects common UK limitation and accounting-record periods; confirm the right retention periods for your business with your adviser.

10. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data in certain circumstances;
• ask us to restrict or object to our processing;
• request portability of data you provided to us;
• withdraw consent where we rely on it; and
• complain to the Information Commissioner's Office (see below).

To exercise any of these, contact [privacy@comparethelend.com]. We will respond within the statutory time limit (usually one month). There is normally no charge.

11. Cookies

We use a small number of essential cookies that are necessary for the Service to work — for example, to keep you signed in securely. These do not require consent. If we later introduce analytics or non-essential cookies, we will ask for your consent first and update this policy and our cookie information, in line with the Privacy and Electronic Communications Regulations (PECR).

12. How we protect your data

We take the security of your data seriously. Measures include encryption of data in transit, storage of passwords only in hashed form, access controls limiting who can see your data, and use of reputable infrastructure providers. No system can be guaranteed completely secure, but we work to protect your information and to detect and address issues promptly.

13. Children

The Service is intended for use by businesses and the individuals who represent them. It is not directed at, and we do not knowingly collect data from, anyone under 18.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. Please check this page periodically.

15. How to contact us or complain

For any privacy question or to exercise your rights, contact us at [privacy@comparethelend.com].

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address your concerns before you approach the ICO, so please consider contacting us first.