Privacy Notice

Why does this Policy exist?

Fundable Ltd (16080114) is committed to protecting your personal data and privacy rights.

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Fundable Ltd acts as both a Data Controller and a Data Processor, depending on the activity:

• As a Data Controller – we determine the purposes and means of processing your personal data.

• As a Data Processor – we may process data on behalf of third-party organisations (e.g., finance providers), in line with their instructions and agreements.

This Privacy Notice explains how we collect, use, disclose, and safeguard your personal information in both roles.

It should be read together with any other privacy or fair processing notices we provide. It supplements, but does not override, those notices.

What does this Policy cover?

This policy outlines how we handle personal information collected directly or indirectly (e.g., via our website, phone, in person, or through third parties), including:

• What personal data we collect

• How and why we collect it

• How we use it

• Your rights and how to exercise them

For any questions, please contact us at compliance@thembn.co.uk or via the details on our Contact Us page.

When we may update this Policy

We may update this policy to reflect:

• Improvements to services or systems

• Changes in law or regulation

• Clarifications to existing wording

• Corrections to outdated or inaccurate information

How is your personal data collected?

We collect personal data through:

• Forms and applications

• Telephone and email communications

• Our website and cookies

• Credit reference and fraud prevention agencies

• Public sources (e.g., Companies House, Electoral Register)

• Third parties acting on your behalf

Providing Personal Data About Others

You must not provide us with personal data about another person without their clear and informed consent.

If you do, you confirm that the individual has:

• Authorised you to act on their behalf

• Consented to their data being provided to us

• Consented to the processing of their data

• Agreed to receive data protection notices through you

• Consented to any potential transfer of their data outside the UK/EEA (if required)

Information about others — such as financial associates — may be considered alongside your own when assessing applications or eligibility for services.

Call Recording

We may record telephone calls to:

• Enhance security

• Resolve complaints

• Support staff training and quality assurance

• Improve service standards

Cookies

Our website uses cookies and tracking technologies to understand usage and improve performance.

You can manage or delete cookies via your browser settings. More information is available at: www.allaboutcookies.org

Note: restricting cookies may impact your browsing experience.

What type of personal information do we collect?

Depending on the context, we may collect:

• Name, title, gender, and contact information

• Date of birth and National Insurance number

• Marital and residential status

• Employment and income details

• Financial, banking, and credit information

• Insurance, mortgage, and investment history

• Medical or health information (special category data)

• Marketing and communication preferences

• Data from credit reference and fraud prevention agencies

• Information provided in surveys or social media interactions

We may also collect publicly available data (e.g., court judgments, bankruptcy records).

Special Category Personal Data

Where relevant (e.g., insurance), we may collect sensitive health information. This will only be processed where necessary and with your explicit consent, in line with UK GDPR.

Such data may need to be exchanged with intermediaries (e.g., finance providers) to secure protection cover that meets customer needs.

If you fail to provide personal data

If you do not provide required data, we may be unable to deliver the services requested. We will notify you if this is the case.

How we use your personal data

We process personal data under the following lawful bases:

• Consent – where you have given permission

• Contract – to fulfil or prepare a contract

• Legal obligation – to comply with law or regulation

• Legitimate interests – to pursue business interests without overriding your rights

We may use your data to:

• Assess applications and creditworthiness

• Provide or arrange financial products and services

• Communicate with you

• Carry out compliance and regulatory checks

• Improve services

• Provide support, training, and audits

• Conduct marketing (with your consent)

• Analyse customer trends

• Visit your premises where required

Credit Reference Agencies (CRAs)

We may share your data with CRAs. They may return public and private credit history data, which funders may use to:

• Assess affordability and creditworthiness

• Confirm identity

• Prevent fraud and money laundering

• Recover debts

• Manage accounts

More information:

• Experian CRAIN

• Equifax CRAIN

Automated Processing / Decision-Making

Some funders use automated scoring. You will not be subject to decisions with legal effects solely based on automation unless:

• Necessary for a contract

• You have given explicit consent

• Safeguards are in place to protect your rights

Sharing your personal information

We may share your data with:

• Members of our corporate group

• Financial institutions or funders

• Professional advisers and legal representatives

• IT, compliance, data storage, or call centre providers

• Regulators or law enforcement (where required)

We do not sell your personal data. In the event of a business sale or restructure, your data may be shared with prospective buyers or advisors.

International Data Transfers

We do not transfer personal data outside the UK/EEA unless necessary and lawful safeguards are in place.

Data Retention

We retain data only as long as necessary for:

• Legal and contractual obligations

• Handling enquiries or complaints

• Establishing or defending legal claims

Typical retention periods:

• Enquiries: up to 3 years after contact

• Contracts: minimum 6 years post-termination

• Regulatory obligations: as required by law

Managing your marketing preferences

With consent, we may contact you with product, service, or offer updates by phone, email, post, or SMS.

You can opt out anytime by:

• Clicking “unsubscribe” in emails

• Emailing: help@fundable.uk

• Calling: 01604 969524

We may still contact you regarding essential service information.

Your rights

You have the right to:

• Be informed about use of your data

• Request a copy of your data

• Correct inaccurate data

• Request erasure (in certain circumstances)

• Restrict or object to processing

• Request data portability

• Object to direct marketing

• Avoid automated-only decisions with legal effects

To exercise these rights, contact us at:

• Post: Fundable Ltd (16080114), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE

• Email: help@fundable.uk

• Phone: 01604 969524

We may need to verify your identity before fulfilling requests.

Complaints

If you are dissatisfied with how we handle your personal data, you may complain to the UK Information Commissioner’s Office (ICO).

• ICO Registration: ZB862851

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Helpline: 0303 123 1113

• Email: casework@ico.org.uk

• Website: ico.org.uk

​