Why does this policy exist?

GCR Finance Ltd, company number is 15137603, is committed to protecting your personal data and privacy rights.

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, GCR Finance Limited acts as both a Data Controller and a Data Processor, depending on the nature of the activity:

As a Data Controller, we determine the purposes and means of processing your personal data.

As a Data Processor, we may process data on behalf of third-party organisations, such as finance providers, in line with their instructions and applicable agreements.

This Privacy Notice explains how we collect, use, disclose, and safeguard your personal information in both roles.

This notice should be read together with any other privacy or fair processing notices we provide on specific occasions. It supplements but does not override those other notices.

What does this policy cover?

This policy outlines our handling of personal information that we collect from you directly or indirectly (such as through our website, over the phone, in person, or from third parties), including:

What personal data we collect;

How and why we collect it;

How we use it;

Your rights and how to exercise them.

If you have any questions, please contact us at compliance@thembn.co.uk or via the details on our Contact Us page.

When we may update this policy

We may update this policy to reflect:

Improvements to our services or systems;

Changes in applicable law or regulation;

Clarifications to existing wording;

The need to correct outdated or inaccurate information.

How is your personal data collected?

We collect personal data through:

Forms and applications;
Telephone and email communication;

Our website and cookies;
Credit reference and fraud prevention agencies;
Public sources (e.g., Companies House, Electoral Register);
Third parties acting on your behalf.

Providing personal data about others

You must not provide us with personal data about someone else without first obtaining their clear and informed consent. If you do provide such information, you confirm that the individual has:

Authorised you to act on their behalf;

Consented to the provision of their data to the Company;

Consented to the processing of their data;

Agreed to receive data protection notices through you;

Consented to any potential transfer of their data outside the UK/EEA, if required.

Information about others—such as financial associates—may be considered alongside your own personal data when assessing applications or eligibility for services.

Call recording

We may record telephone calls for the following reasons:

To enhance security;

To resolve complaints;

For staff training and quality assurance purposes;

To improve our service standards.

Cookies

Our website uses cookies and tracking technologies to understand usage and improve performance.

You can manage or delete cookies via your browser settings. For more information, visit www.allaboutcookies.org

Please note that restricting cookies may impact your browsing experience.

What type of personal information do we collect?

Depending on the context, we may collect:

Name, title, gender, and contact information;
Date of birth and National Insurance number;
Marital and residential status;
Employment and income details;

Financial, banking, and credit information;
Insurance, mortgage, and investment history;
Medical or health information (special category data);
Marketing and communication preferences;
Data from credit reference and fraud prevention agencies;
Information you provide in surveys or social media interactions.

We may also collect publicly available data (e.g. court judgments, bankruptcy records).

Special category personal data

Where relevant (e.g., in relation to insurance), we may collect sensitive health information. We only process such data where necessary and with your explicit consent, in accordance with UK GDPR.

Information on Special Category Data and Criminal Disclosures must be capable of being exchanged freely between intermediaries such as finance providers, to enable customers to secure the important protection cover that their needs require.

If you fail to provide personal data

If you do not provide required personal data, we may be unable to provide the services you request. We will notify you at the time if this is the case.

How we use your personal data

We use your personal data under the following lawful bases:

Consent – where you have given clear permission.

Contract – to fulfil a contract with you or take steps before entering one.

Legal obligation – to comply with legal or regulatory duties.

Legitimate interests – to pursue our business interests, provided they do not override your rights.

We may use your data to:

Assess your application and creditworthiness;

Provide or arrange financial products and services;

Communicate with you;

Carry out compliance and regulatory checks;

Improve our services;

Provide support, training, and audits;

Carry out marketing, with your consent;

Analyse customer usage trends;

Visit your premises (as needed for our services).

This list is not intended to be exhaustive and may be updated from time to time as business needs and legal requirements dictate. Some of the personal information that we maintain will be kept in
paper files, while other personal information will be included in computerised files and electronic databases.

Credit Reference Agencies (CRAs)

To assess finance applications, we may share your data with CRAs. They may return public and private data about your credit history, which funders may use to:

Manage your account(s). For more information, visit: https://www.experian.co.uk/legal/crain/ https://www.equifax.co.uk/crain/

Assess affordability and creditworthiness;

Confirm your identity;

Prevent fraud and money laundering;

Recover debts;

Manage your account(s).

For more information, visit:

https://www.experian.co.uk/legal/crain

https://www.equifax.co.uk/crain/

Does the Company share my personal information with third parties?

We may share your data with:

Members of our corporate group;

Financial institutions or funders;

Professional advisers or legal representatives;

IT, compliance, data storage, or call centre service providers;

Regulators or law enforcement where legally required. We do not sell your personal data. In the event of a sale or restructure of our business, your data may be shared with prospective buyers or advisors.

International data transfers

We do not transfer your personal data outside the UK or EEA unless required and lawful safeguards are in place.

How long do we keep your personal information for?

We retain your data only as long as necessary for:

Legal and contractual obligations;
Handling enquiries or complaints;
Establishing, exercising, or defending legal claims.

Typical retention periods:

Enquiries – up to 3 years after contact.
Contracts – minimum 6 years post-termination.
Regulatory obligations – as required by law.

Managing your marketing preferences

With your consent, we may send you marketing communications about products, offers, or services by phone, email, post, or SMS. You can opt out at any time by:

Clicking “unsubscribe” in marketing emails;
Emailing us at greg@gcrfinance.co.uk
Phone No. 01933 829006

We may still contact you with important information about services you’ve requested or signed up for.

Your rights to access your personal information

You have the right to:

Be informed about the use of your personal data;
Request a copy of your personal data;
Request correction of inaccurate data;
Request erasure of data (in certain circumstances);
Restrict or object to processing;
Request data portability;
Object to direct marketing;
Not be subject to automated decisions without meaningful human involvement.

To exercise your rights, contact us at:

21 Chapel Close

Rushden

Northamptonshire

NN10 0FH

greg@gcrfinance.co.uk

01933 829006

Your right to complain to the data privacy supervisory authority

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), our ICO registration number ICO number ZB597925

Information Commissioner’s Office Wycliffe House
Water Lane
Wilmslow

Cheshire SK9 5AF

Helpline: 0303 123 1113
Email: casework@ico.org.uk
Website: https://ico.org.uk/global/contact-us/

Privacy Policy