Privacy Notice

DRAFT – for review by The Buyback Service Limited before publication.

This notice explains how Little Business Loans collects, uses and protects personal information when businesses apply to us for finance, when brokers use our broker portal at littlebusinessloans.co.uk (the “Portal”), and when anyone else contacts us. It also explains your rights under UK data protection law.

1. Who we are

The Buyback Service Limited, trading as Little Business Loans (“LBL”, “we”, “us”), is the data controller for the personal information described in this notice. We are registered in England and Wales under company number 08457011. Our registered office is 152 Halesowen Road, Cradley Heath, B64 5LP. We are registered with the Information Commissioner’s Office under number [ICO registration number].

If you have any questions about this notice or how we use your information, contact us at [email address] or write to us at the address above.

2. Whose information we use

• Directors, shareholders and guarantors of companies that apply to us for finance.
• Contacts at applicant companies, such as the person we speak to on the security call.
• Brokers and introducers who register for and use the Portal.
• Anyone else who contacts us.

We only lend to limited companies. Most of the information we hold relates to companies rather than individuals, but company records include personal information about the people involved.

3. What information we collect

• Identity and contact details: name, date of birth, home address and address history, email address and phone number.
• Financial information: business bank statements, which may include payments to or from individuals; company accounts; and the details on the application form.
• Credit and fraud information: information from credit reference and fraud prevention agencies, including county court judgments (CCJs), insolvency records and credit history.
• Company records: information from Companies House, such as directorships and filing history.
• Broker account information: name, brokerage, phone number, email, FCA number, login history and messages sent through the Portal.
• Loan information: loan amounts, terms, repayment information, and details of business assets taken as security.
• Technical information: IP address, browser type and login times, used to keep the Portal secure.

4. Where we get it from

• Directly from you, or from the applicant company.
• From the broker who introduced the application.
• From Companies House and other public registers.
• From credit reference agencies, such as Creditsafe.
• From fraud prevention agencies and law enforcement.

5. How we use it and our lawful basis

• Assessing applications and deciding whether to lend. This includes checking identity, creditworthiness and affordability, carrying out personal credit searches on directors, and verifying information with Companies House. Basis: our legitimate interests in lending responsibly and managing risk, and taking steps at the applicant’s request before entering into a contract.
• Preventing and detecting fraud and money laundering. Basis: legal obligation, and our legitimate interests in preventing crime.
• Setting up and managing loans, including security over business assets, sending loan documents and collecting repayments. Basis: performance of a contract, and our legitimate interests.
• Running the Portal and managing broker accounts, including login security and sending notifications about applications. Basis: performance of our agreement with brokers, and our legitimate interests.
• Keeping records and meeting legal and regulatory requirements. Basis: legal obligation.
• Dealing with complaints and legal claims. Basis: our legitimate interests, and legal obligation.

We do not use your information for marketing, and we do not sell it.

6. Automated decisions

When an application is submitted through the Portal, our systems automatically read the documents provided, check company and credit information, and compare the results against our lending criteria. This produces an initial decision: approved in principle, referred or declined.

These decisions are about the applicant company. However, they may take into account personal information about directors, such as whether a director has an active CCJ. No loan is agreed without an LBL underwriter speaking to the applicant. If you are a director affected by an automated decline, you can ask for the decision to be reviewed by a person, explain your point of view, and challenge the decision by contacting us at [email address].

7. Credit reference and fraud prevention agencies

We carry out searches on applicant companies and on their directors with credit reference agencies, including Creditsafe. The agencies give us information about the company and about directors’ credit history, including public records such as CCJs and insolvencies. Our searches on directors are soft searches. They are recorded on your credit file, but other lenders can’t see them and they do not affect your credit score.

If we suspect fraud, or that false or inaccurate information has been given, we may share details with fraud prevention agencies and law enforcement. This may result in the company or the individuals concerned being refused services by us or by others.

You can find out how Creditsafe uses personal information in its own privacy notice at creditsafe.com.

8. Who we share information with

• The broker who introduced the application. They see our decision and a short reason, but not the underlying credit information.
• Credit reference agencies, fraud prevention agencies and Companies House, as described above.
• Service providers who help us run our business, under contracts that require them to protect your information and use it only on our instructions:
  • website hosting (GoDaddy, servers in the European Union);
  • secure document storage (Amazon Web Services, servers in the United Kingdom);
  • automated document reading (Anthropic, which processes documents to extract figures for our underwriters);
  • email delivery (Brevo, based in the European Union);
  • electronic signatures for loan documents (DocuSign).
• Our professional advisers, auditors and insurers.
• Any funder of our lending, or any buyer or potential buyer of our business or loan book, under confidentiality obligations.
• Debt recovery agents, if a loan is not repaid.
• Courts, regulators, HMRC and law enforcement, where the law requires or allows it.

9. International transfers

Most of the information we hold is stored in the United Kingdom and the European Union, which the UK recognises as providing adequate protection. Some service providers, such as our automated document reading provider, may process information in the United States. Where information is transferred outside the UK, we make sure it is protected, for example by using the UK International Data Transfer Addendum, or by relying on the UK–US data bridge where the provider is certified. Contact us for more details.

10. How long we keep it

• Funded loans: 6 years after the loan is fully repaid or otherwise ends.
• Applications that do not proceed: [12 months] from the decision.
• Broker accounts: while the account is open, then 6 years after it closes.
• Fraud records: for as long as fraud prevention agencies or the law require.

[Director to confirm these periods.] We may keep information longer if it is needed for a legal claim or a regulatory investigation.

11. How we protect it

Documents are held in secure, access-controlled storage. Access to the Portal is protected by passwords and one-time login codes, and staff can only see what they need for their role. Brokers can only see the applications they submitted. Information sent to and from the Portal is encrypted in transit.

12. Cookies

The Portal only uses cookies that are strictly necessary to log you in and keep your session secure. We do not use advertising or analytics cookies. If that changes, we will update this notice and ask for your consent where required.

13. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, where we no longer need it or have no other lawful basis to keep it;
• object to us using your information on the basis of our legitimate interests;
• ask us to restrict how we use your information;
• ask for information you gave us to be transferred to another organisation, where applicable; and
• ask for a person to review an automated decision, as explained in section 6.

To use any of these rights, contact us at [email address]. We will reply within one month. Some rights do not apply in every situation, for example where we must keep records by law. If so, we will explain why.

14. Complaints

If you are unhappy with how we have used your information, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

15. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.