Skip to content

Privacy policy

DRAFT: This document is a draft pending legal review and is not yet in force. It will be finalised before launch.

Who we are

This privacy notice explains how Rook Bristol ("Rook Bristol", "we", "us") collects, uses, shares and protects personal data when you visit rookbristol.com (the "Site"), apply for finance or otherwise deal with us. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Rook Bristol is the controller of your personal data. [Registered company name, number and registered office to be confirmed.]

If you have questions about this notice or how we handle your data, contact us at hello@rookbristol.com.

The personal data we collect

Depending on how you interact with us, we may collect:

  • Identity and contact data: name, job title, email address, UK mobile number, date of birth and home address and postcode for directors, partners, owners and guarantors.
  • Business data: company name, Companies House number, trading address, legal structure, turnover and ownership details. Where this relates to sole traders or partners, it is personal data.
  • Financial data: business bank statements, Open Banking data you choose to share, existing borrowing and repayment history.
  • Credit and fraud prevention data: information from credit reference agencies (such as Experian, Equifax and TransUnion) and fraud prevention agencies.
  • Identity verification data: documents or electronic checks used to confirm your identity and meet anti-money laundering obligations.
  • Technical and usage data: IP address, device and browser type, pages visited and how you arrived at the Site, collected through cookies and similar technologies (see our cookie policy).
  • Communications: records of emails, calls and messages with us, and your marketing preferences.

How we collect it

  • Directly from you, when you apply, enquire, sign up or contact us.
  • From brokers and introducers who refer you to us, with your knowledge.
  • From credit reference agencies, fraud prevention agencies, Companies House, the electoral roll and other public sources.
  • Automatically, through cookies and similar technologies when you use the Site.

How we use your data and our lawful bases

We only use personal data where UK GDPR gives us a lawful basis to do so:

  • Contract: to assess your application, take steps you ask for before entering an agreement, and to set up, administer and collect finance.
  • Legal obligation: to verify identity, prevent money laundering and fraud, keep records and respond to regulators and law enforcement.
  • Legitimate interests: to assess credit risk, prevent fraud, improve our decisioning models and services, keep the Site secure, manage relationships with brokers, and send business-to-business marketing where permitted. We balance these interests against your rights.
  • Consent: for non-essential cookies and, where required by the Privacy and Electronic Communications Regulations (PECR), for electronic marketing. You can withdraw consent at any time.

Credit reference and fraud prevention agencies

When you apply, we carry out a soft search with one or more credit reference agencies, which does not affect your credit score. If you choose to proceed with an offer, we may carry out a hard search, which will be recorded on your credit file and visible to other lenders. We may also share information with fraud prevention agencies. If fraud is detected, you could be refused certain services. The agencies' own notices, the Credit Reference Agency Information Notice (CRAIN), explain how they use data: [links to be added].

Automated decision-making

We use automated analytics to help assess applications. Where a decision that has a legal or similarly significant effect on you is made solely by automated means, you have the right to request human review, to express your point of view and to contest the decision.

Who we share your data with

  • Credit reference and fraud prevention agencies.
  • Brokers and introducers who referred you, to update them on your application.
  • Funding partners and service providers who help us run our business, such as IT, cloud hosting, identity verification, Open Banking, e-signature and payment providers, under contract and only on our instructions.
  • Professional advisers, auditors, insurers, debt collection agencies and, where relevant, purchasers of our business or loan portfolios.
  • Regulators, HMRC, law enforcement and courts, where the law requires or permits.

We do not sell your personal data.

International transfers

Some service providers may process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

How long we keep your data

We keep personal data only as long as necessary. Typically, we retain records of finance agreements for six years after the agreement ends, to meet legal and regulatory requirements. Declined or withdrawn application data is kept for a shorter period. [Retention schedule to be confirmed.]

Your rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct inaccurate or incomplete data.
  • Ask us to erase your data, where there is no overriding reason to keep it.
  • Ask us to restrict how we use your data.
  • Object to processing based on legitimate interests, and to direct marketing at any time.
  • Data portability, where processing is based on consent or contract and carried out by automated means.
  • Withdraw consent at any time, where we rely on consent.
  • Not be subject to solely automated decisions with significant effects, as described above.

To exercise any of these rights, email hello@rookbristol.com. We will respond within one month, and there is usually no charge.

Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and staff training. No transmission over the internet is completely secure, so please take care when sharing information online.

Cookies

We use cookies and similar technologies on the Site. Non-essential cookies are only set with your consent. See our cookie policy for details.

Complaints

If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The latest version will always be on this page. Last updated: [date to be confirmed].