Privacy & Cookie Policy

1. Introduction

This Privacy & Cookie Policy explains how EXCEL CAPITAL GROUP LTD (“we,” “us,” or “our”) collects, uses, and protects personal data when providing B2B lending and related financial services to UK limited companies. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We may collect:

• Business contact details (name, email, phone, job title, company information)
• Financial and credit information (banking details, credit history, financial statements)
• Identity verification data for directors or authorised representatives
• Website usage data (IP address, browser type, pages visited)
• Communication records (emails and correspondence)

3. How We Use Your Data

We use your data to:

• Assess eligibility for lending and manage credit applications
• Conduct fraud prevention and identity verification checks
• Comply with legal and regulatory obligations
• Provide and manage financial services
• Improve our services and internal operations
• Communicate with clients and applicants

4. Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs). We obtain this information via Experian is authorised and regulated by the Financial Conduct Authority.

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

In order to process your application, we will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity.

We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organizations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates.

The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html

5. Lawful Basis for Processing

We rely on:

• Contractual necessity
• Legal obligations (including AML and financial regulations)
• Legitimate interests (risk assessment and fraud prevention)
• Consent (where applicable, such as marketing communications)

6. The Source of Personal Data

Where personal data is not obtained directly from the data subject, we may collect personal data about you from:

• you directly
• employers/clients when you apply for a role or are considered for an opportunity
• referees (where relevant and permitted)
• publicly available sources (for example professional networking sites, business websites, and public records)
• credit reference agencies (CRAs) where required for consumer credit, identity, or affordability checks
• third party service providers used to support recruitment, screening, and compliance processes

7. Sharing Your Information

We may share data with:

• credit reference agencies and fraud prevention services
• regulators and legal authorities
• service providers supporting operations and compliance
• professional advisers (legal, accounting, auditing)

We do not sell personal data.

8. Data Retention

We retain data only as long as necessary for legal, regulatory, and operational purposes.

9. Data Security

We implement appropriate technical and organisational security measures to protect personal data. However, no system is completely secure.

10. Data Protection Officer

11. Your Rights

Under UK GDPR, you may have the right to:

• access your personal data
• correct inaccurate data
• request deletion (where applicable)
• restrict or object to processing
• data portability
• withdraw consent (where applicable)
• lodge a complaint with the Information Commissioner’s Office (ICO) or another supervisory authority
• complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data

Contact: Dpo@excelcapital.co.uk

12. Provision of Personal Data

Is the provision of personal data statutory or contractual?

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.

Personal data is required to:

• enter into and perform contracts with customers, suppliers, or business partners
• process orders, manage accounts, and deliver goods and services
• verify identity and prevent fraud; and
• comply with applicable legal, regulatory, accounting, and tax obligations

What are the consequences of not providing personal data?

If you choose not to provide the personal data we request:

• we may be unable to enter into a contract with you
• we may be unable to fulfil orders, supply goods, or provide services
• we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
• as a result, our services may be delayed, restricted, or declined

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

13. Non-Automated Decision Making and Profiling

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.

14. Cookies Policy

We may update this policy from time to time. Updates will be posted with a revised effective date.

15. Third-Party Services

We may use third-party tools or links. We are not responsible for their privacy practices.

16. International Transfers

Where data is transferred outside the UK, we ensure appropriate safeguards in compliance with UK data protection law.

17. Changes to This Policy

We may update this policy from time to time. Updates will be posted with a revised effective date.

18. Contact Us