Draft for professional review
This page was prepared as a draft and must be reviewed and approved by a suitably qualified adviser, with all bracketed placeholders completed, before the website goes live.
1. Who we are
This website, www.financebusinessdebt.co.uk, is operated by [[COMPANY_LEGAL_NAME]], trading as Finance Business Debt. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, [[COMPANY_LEGAL_NAME]] is the data controller of the personal data described in this policy.
- Registered office: Newcastle Upon Tyne
- Email: [email protected]
- ICO registration number: [[ICO_REGISTRATION_NUMBER]]
We have not appointed a statutory data protection officer because the scale and nature of our processing do not require one. Questions about this policy or about how we handle your data should be sent to the email address above, marked "Data protection".
2. What personal data we collect
Information you give us through the enquiry form
When you complete the enquiry form on our contact page, we collect the fields you enter:
- Your name
- Your business name
- Your email address
- Your telephone number (optional)
- Your business type (limited company, LLP, partnership, sole trader or other)
- The approximate band of your existing business debt
- The type of support you are interested in
- Any additional information you choose to type into the free-text box
- Your confirmation that you have read this policy and agree to us responding to your enquiry
Please do not enter more detail than is needed. In particular, there is no need to include account numbers, passwords, health information or details about third parties in the free-text box.
Information you give us by other means
If you email or telephone us, we will hold the content of that correspondence, including your contact details and any documents you send, so that we can deal with your enquiry.
Technical data
Our hosting provider's servers record standard technical information when a page is requested, such as your IP address, browser type and version, the date and time of the request and the page requested. This information is used to keep the site secure and to diagnose faults. It is not combined with the enquiry form data to build a profile of you.
Cookies and similar technologies
The website does not currently set any cookies of its own and does not use analytics or advertising cookies. Full details, including the single third-party request the site makes for web fonts, are in our cookie policy. If we introduce analytics, this policy and the cookie policy will be updated first and consent will be requested where the law requires it.
3. Lawful bases for processing
UK GDPR requires us to have a lawful basis for each use of your personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and following it up with you | Consent (Article 6(1)(a)), given when you tick the box on the enquiry form. You may withdraw consent at any time. |
| Introducing you to a third-party finance provider or adviser at your request | Steps taken at your request before entering into a contract (Article 6(1)(b)) and your explicit agreement to the introduction. |
| Keeping the website secure, preventing misuse and diagnosing faults | Our legitimate interests (Article 6(1)(f)) in running a safe and reliable website. We have considered the impact on you and judge it minimal. |
| Keeping records of enquiries, introductions and complaints | Our legitimate interests in being able to evidence what was said and done, and, where applicable, legal obligation (Article 6(1)(c)). |
| Dealing with complaints and legal claims | Legal obligation and our legitimate interests in defending our position. |
4. How we use your data
We use the data you provide to:
- Understand your business, its existing finance and what you are trying to achieve
- Respond to your enquiry by email or telephone and explain which options may be relevant
- Where you ask us to, pass your details to a third-party finance provider or specialist adviser so that they can contact you
- Keep a record of what we discussed and of any introduction made
- Handle any complaint you make and meet our record-keeping obligations
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. We do not sell personal data. We will not send you marketing emails unless you have separately agreed to receive them, and any such email will include a simple way to opt out.
5. Who we share your data with
Finance providers and advisers
We share your details with a third-party finance provider or adviser only when you have agreed to that introduction. Before an introduction proceeds we will tell you who the recipient is. Once your details have been passed on, that organisation becomes a data controller in its own right and its privacy notice governs what it does with your information. We encourage you to read it.
Service providers (processors)
We use a small number of suppliers who process data on our behalf and under our instructions. Each is bound by a written contract that meets the requirements of Article 28 UK GDPR.
| Service | Provider | What they process |
|---|---|---|
| Enquiry form processing | Formspree, Inc. (United States). Submissions are also copied by email to [email protected]. | The contents of the enquiry form, transmitted securely to us |
| Website hosting | [To be confirmed] | Server logs including IP addresses and requested pages |
| [To be confirmed] | Correspondence between you and us |
Other disclosures
We may also disclose personal data where the law requires it, for example to a regulator, a court or law enforcement, or where it is necessary to establish, exercise or defend legal claims. If the business is sold or restructured, data may be transferred to the new owner on the same terms as this policy.
6. International transfers
We aim to keep your personal data within the United Kingdom. Some of the service providers listed above may store or access data in other countries. Where that happens, we will make sure an appropriate safeguard is in place, such as a UK adequacy regulation for the destination country, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
[To be confirmed: the location of each processor's servers and the transfer mechanism relied on for any processing outside the UK.]
7. How long we keep your data
We keep personal data only for as long as it is needed for the purpose it was collected for. The proposed periods are:
| Data | Proposed retention period |
|---|---|
| Enquiries where no introduction proceeds | 12 months after our last contact with you, then deleted |
| Enquiries where an introduction proceeds | 6 years after the introduction, to evidence what was agreed and to meet any regulatory record-keeping requirement |
| Complaint records | 6 years after the complaint is closed |
| Server logs | Up to 90 days, unless retained longer to investigate a security incident |
[To be confirmed: these periods are proposals and must be approved by the reviewer, taking into account any regulatory obligations that apply to the firm's actual operating model.]
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you and receive a copy
- Rectification of data that is inaccurate or incomplete
- Erasure of your data in certain circumstances, for example where you withdraw consent and we have no other lawful basis to keep it
- Restriction of processing while a dispute about accuracy or lawful basis is resolved
- Data portability, which allows you to receive data you gave us in a structured, machine-readable format where processing is based on consent or contract
- Object to processing based on our legitimate interests, and to any direct marketing
- Withdraw consent at any time where consent is the basis we rely on, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, email [email protected] or write to Newcastle Upon Tyne. We may need to confirm your identity before acting on a request. We will respond within one month, and we will tell you if we need longer because the request is complex. There is normally no charge.
9. Complaints to the Information Commissioner
If you are unhappy with how we have handled your personal data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- Website: https://ico.org.uk/
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Security
We take reasonable technical and organisational steps to protect personal data from loss, misuse and unauthorised access. The website is served over HTTPS, enquiry form data is transmitted to us securely, and access to enquiry records is limited to the people who need it. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we will tell you and, where required, the ICO without undue delay if a breach puts your rights at risk.
11. Children
This website is intended for people running or representing UK businesses. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
12. Links to other websites
Our pages link to external sites such as GOV.UK, the Financial Conduct Authority and Business Debtline. Those sites have their own privacy policies and we are not responsible for their content or practices.
13. Changes to this policy
We review this policy whenever our processing changes and at least once a year. The date at the top of the page shows when it was last updated. Material changes, such as the introduction of analytics or a new category of recipient, will be made to this page before the change takes effect.
Related pages: Cookie Policy, Website Terms and Conditions, Regulatory Information, Complaints Procedure.