1. Why does this Policy exist?
Sorbus Finance Ltd (Company Number: 14329357) is committed to protecting your personal data and privacy rights.
For the purposes of applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Sorbus Finance Ltd acts as both a Data Controller and a Data Processor, depending on the nature of the activity:
- As a Data Controller, we determine the purposes and means of processing your personal data.
- As a Data Processor, we may process data on behalf of third-party organisations, such as finance providers, in line with their instructions and applicable agreements.
This Privacy Notice explains how we collect, use, disclose, and safeguard your personal information in both roles. If you have any questions, please contact us at hello@sorbusfinance.co.uk.
2. What does this Policy cover?
This policy outlines our handling of personal information that we collect from you directly or indirectly (such as through our website, over the phone, in person, or from third parties), including:
- What personal data we collect;
- How and why we collect it;
- How we use it; and
- Your rights and how to exercise them.
This notice should be read together with any other privacy or fair processing notices we provide on specific occasions. It supplements but does not override those other notices.
3. When We May Update This Policy
We may update this policy to reflect:
- Improvements to our services or systems;
- Changes in applicable law or regulation;
- Clarifications to existing wording; or
- The need to correct outdated or inaccurate information.
We will notify you of material changes where required by law. We encourage you to review this policy periodically.
4. How is your personal data collected?
We collect personal data through:
- Forms and applications (online and paper);
- Telephone and email communication;
- Our website and cookies;
- Credit reference and fraud prevention agencies;
- Public sources (e.g. Companies House, Electoral Register); and
- Third parties acting on your behalf.
5. Providing Personal Data About Others
You must not provide us with personal data about someone else without first obtaining their clear and informed consent. If you do provide such information, you confirm that the individual has:
- Authorised you to act on their behalf;
- Consented to the provision of their data to us;
- Consented to the processing of their data;
- Agreed to receive data protection notices through you; and
- Consented to any potential transfer of their data outside the UK/EEA, if required.
Information about others — such as financial associates — may be considered alongside your own personal data when assessing applications or eligibility for services.
6. Call Recording
We may record telephone calls for the following reasons:
- To enhance security;
- To resolve complaints;
- For staff training and quality assurance purposes; and
- To improve our service standards.
8. What type of personal information do we collect?
Depending on the context, we may collect:
- Name, title, gender, and contact information;
- Date of birth and National Insurance number;
- Marital and residential status;
- Employment and income details;
- Financial, banking, and credit information;
- Insurance, mortgage, and investment history;
- Medical or health information (special category data);
- Marketing and communication preferences;
- Data from credit reference and fraud prevention agencies; and
- Information you provide in surveys or social media interactions.
We may also collect publicly available data (e.g. court judgments, bankruptcy records).
9. Special Category Personal Data
Where relevant (e.g. in relation to insurance), we may collect sensitive health information. We only process such data where necessary and with your explicit consent, in accordance with UK GDPR.
Information on Special Category Data and Criminal Disclosures must be capable of being exchanged freely between intermediaries such as our group of companies and finance providers, to enable customers to secure the protection cover that their needs require.
If you do not provide required personal data, we may be unable to provide the services you request. We will notify you at the time if this is the case.
10. How we use your personal data
We use your personal data under the following lawful bases:
- Consent — where you have given clear permission;
- Contract — to fulfil a contract with you or take steps before entering one;
- Legal obligation — to comply with legal or regulatory duties; and
- Legitimate interests — to pursue our business interests, provided they do not override your rights.
We may use your data to:
- Assess your application and creditworthiness;
- Provide or arrange financial products and services;
- Communicate with you;
- Carry out compliance and regulatory checks;
- Improve our services;
- Provide support, training, and audits;
- Carry out marketing (with your consent); and
- Analyse customer usage trends.
11. Credit Reference Agencies (CRAs)
To assess finance applications, we may share your data with Credit Reference Agencies (CRAs). They may return public and private data about your credit history, which funders may use to assess affordability and creditworthiness, confirm your identity, and detect fraud.
For more information, visit:
12. Automated Processing
Some funders use automated scoring to make decisions. You will not be subject to decisions with legal effects solely based on automated processing unless it is necessary for entering into a contract, permitted by law, or based on your explicit consent. Where automated decision-making is used, you have the right to request human review of the decision.
14. International Data Transfers
We do not transfer your personal data outside the UK or EEA unless required to do so by law or regulation and lawful safeguards are in place. Where international transfers are necessary, we ensure they are made in accordance with UK GDPR transfer mechanisms.
15. How long do we keep your data?
We retain your data only as long as necessary for the purpose for which it was collected, including to satisfy legal, regulatory, accounting, or reporting obligations.
Typical retention periods:
- Client data relating to completed finance transactions: 6 years;
- Enquiry data where no finance agreement was entered into: 2 years;
- Marketing preferences and consent records: until withdrawn or 3 years from last interaction.
16. Managing your marketing preferences
With your consent, we may send you marketing communications about products, offers, or services by phone, email, post, or SMS. You can opt out at any time by contacting us at hello@sorbusfinance.co.uk or by following the unsubscribe link in any email we send you.
We may still contact you with important information about services you have requested or signed up for, regardless of your marketing preferences.
17. Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — ask us to correct inaccurate or incomplete data;
- Erasure — ask us to delete your data where there is no compelling reason to continue processing;
- Restriction — ask us to restrict processing of your data in certain circumstances;
- Portability — receive your data in a structured, machine-readable format;
- Object — object to processing based on legitimate interests or for direct marketing; and
- Automated decision rights — request human review of automated decisions.
To exercise any of these rights, please contact us at hello@sorbusfinance.co.uk.
18. Your right to complain
If you believe we have not handled your personal data in accordance with this policy or applicable data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at hello@sorbusfinance.co.uk.