How is my data used, stored, and shared during the process?

Last updated: October 2025

The short answer

Your data is used to assess your eligibility, match you with suitable UK lenders or brokers, and facilitate introductions if you choose to proceed. We store your information securely on UK/EU-based systems, apply encryption and access controls, and retain it only for as long as needed for these purposes and to meet legal requirements. We never sell your data, and we only share it with carefully selected finance professionals and service providers needed to deliver our service, always under strict confidentiality and data protection terms.

Best Business Loans is an independent introducer, not a lender or broker, and we do not provide financial advice. Our role is to help you navigate options, connect you with relevant providers, and support you in getting a Quick Quote, Decision in Principle, or an eligibility check without unnecessary friction. We aim to comply with UK GDPR and the Data Protection Act 2018, and we follow the spirit of FCA, ASA, and Google guidelines by keeping communications clear, fair, and not misleading.

Our AI-powered matching uses the details you provide to suggest likely funding routes and providers, but it does not make binding decisions. A human can review matches on request, and any final lending decisions rest with the provider you choose to engage. You stay in control at every stage, and you can ask questions, update details, or withdraw your enquiry at any time.

What we collect and why

Data you give us

We collect information you provide when you complete a Quick Quote or contact us for support. This typically includes your name, role, business name, contact details, trading history, sector, funding purpose, and the amount you seek. We may also collect documents you upload voluntarily, such as management accounts or bank statements, solely to help assess eligibility and present relevant options.

We record communications and preferences so we can keep you updated in the way you choose. Marketing is opt-in, and you can unsubscribe at any time without affecting any ongoing eligibility checks. We also capture consent choices and the date/time of submission to maintain an audit trail.

Data we generate

Our system creates a matching profile, which includes indicative eligibility signals, high-level risk flags, and non-binding suitability scores. These signals are used to rank potential providers and refine recommendations for your business type and funding goals. We also create internal notes and activity logs to ensure service quality and continuity.

We sometimes generate anonymised or aggregated statistics to improve our matching models and to understand overall demand trends. This aggregated information cannot identify you and may be used for product development, service optimisation, and reporting. It helps us improve the accuracy and efficiency of the matching process over time.

Data we receive from others

If you engage with a lender or broker introduced by us, they may later inform us of the outcome, such as whether funding was approved. We use this feedback to validate and improve our matching logic. We do not run hard credit checks; if a credit check is needed, that will be handled by the finance provider with your explicit permission.

Our website uses essential and performance cookies to keep the site secure and help us understand usage at a high level. You can manage non-essential cookie preferences through your browser or any cookie controls we display. For more detail, please refer to our cookie notices where available.

Examples of how this helps

If you tell us you plan to refurbish your premises, our system may highlight providers that commonly support fit-out finance. If your sector is manufacturing, we prioritise lenders actively serving that segment. These signals are used only to recommend potential routes and never to make final lending decisions.

How our AI matching and lawful bases work

How the AI matching uses your data

We use your business profile, funding purpose, and high-level financial indicators to suggest the most suitable types of finance and potential providers. The AI scores options based on documented criteria like sector appetite, loan size, and typical eligibility indicators. This reduces time spent on unsuitable routes and improves your chances of speaking to relevant providers early.

Our matching is designed to be fair, explainable, and practical. It does not create outcomes with legal or similarly significant effects on you without human involvement. You can request a manual review if you believe an option has been missed, and we will reassess with a human-led sense-check.

Automated decision-making and profiling

We use profiling to help prioritise providers, but we do not issue approvals or declines. Any lending decision is made by the selected lender or broker. You may request human intervention, express your point of view, and challenge the profiling if you think it is inaccurate.

Our lawful bases for processing

• Legitimate interests: To operate and improve our service, match your enquiry to suitable options, prevent fraud, and keep our platform secure.
• Contract: To take steps at your request before connecting you with finance providers, and to manage your enquiry if you proceed.
• Consent: For certain marketing communications and for sharing your details with selected providers beyond what is necessary for your enquiry.
• Legal obligations: To meet record-keeping, audit, or compliance requirements where applicable.

What this means in practice

When you submit a Quick Quote, we process your data to assess eligibility and propose relevant introductions. We may ask for explicit consent to share details with a shortlist of providers, especially where a provider requires specific documents. You can withdraw consent at any time without affecting lawfulness before withdrawal.

If we need to use your data for a new purpose, we will explain the change and the legal basis. We only collect what we need, and we avoid special category data unless you choose to provide it. In most cases, special category data is not relevant to commercial finance matching and should not be submitted.

Where and how we store and secure your data

Hosting locations and safeguards

We store personal data on reputable cloud infrastructure within the UK and/or EEA where possible. Where international transfers are unavoidable, we implement appropriate safeguards such as the UK IDTA or EU Standard Contractual Clauses. We keep records of sub-processors and require them to maintain robust security standards.

Encryption is applied in transit and at rest for core systems. Access is limited by role, logged, and monitored to help prevent unauthorised use. We regularly review vendor certifications and security posture to maintain a strong baseline.

Security measures we apply

• Transport Layer Security (TLS) on our web properties and APIs.
• Encryption at rest within our primary databases and document storage.
• Multi-factor authentication and least-privilege access controls for staff tools.
• Audit logging, alerting, and periodic access reviews.
• Data minimisation, pseudonymisation, and deletion workflows.

We train our team on data protection and security hygiene. We also maintain incident response procedures and vendor due diligence. If we ever identify a risk or incident affecting your data, we will act promptly and in line with legal requirements.

How long we keep your data

We retain enquiry records for a period that reflects typical sales cycles and follow-ups for commercial finance, then delete or anonymise them. Documents uploaded purely for eligibility checks are removed once no longer needed for the purpose, or within a defined retention window unless a provider relationship continues. Communications and consent logs may be kept longer if required by law or for dispute resolution.

We periodically review retention schedules to ensure they stay appropriate. When retention ends, we securely delete or irreversibly anonymise data. Aggregated statistics that cannot identify you may be retained to improve our service.

International transfers

If a service provider processes data outside the UK/EEA, we use lawful transfer mechanisms and assess risk. We aim to select vendors with strong compliance records and recognised certifications. You can ask us which safeguards apply to your data at any time.

Children’s data

Our service is for business users aged 18 and over. We do not knowingly collect data from children. If you believe a minor has provided data, please contact us and we will delete it promptly.

Sharing your data, your choices, and your rights

Who we share your data with

• Lenders and brokers: We share only the details required to assess eligibility and progress your enquiry, and only with providers that are relevant to your needs.
• Technology and operational vendors: Hosting, analytics, communications, and security providers who act under data processing agreements.
• Professional advisers: Legal, regulatory, or audit advisers when strictly necessary.
• Authorities: Where required by law, to meet legal obligations or to prevent fraud.

We do not sell your data to any third party. We expect any party we introduce you to, or who supports our service, to protect your information to standards that meet or exceed UK GDPR requirements. We select partners based on suitability, professionalism, and their stated data protection practices.

What we never do

• We never run hard credit checks; those are conducted by a provider with your permission.
• We never share your data without a valid purpose, a lawful basis, and appropriate safeguards.
• We never promise approvals, guaranteed rates, or outcomes, and we do not pressure you to proceed.

Your privacy choices and rights

• Access: You can request a copy of your data.
• Rectification: You can correct inaccurate or incomplete data.
• Erasure: You can ask us to delete data when it is no longer needed.
• Restriction: You can ask us to limit processing in certain circumstances.
• Portability: You can request data in a structured, commonly used format.
• Object: You can object to processing based on legitimate interests or direct marketing.
• Withdraw consent: You can withdraw consent at any time for activities that rely on it.

How to exercise your rights

Email hello@bestbusinessloans.ai with your request and verification details. We aim to respond within one month, or explain if more time is needed for complex requests. Where we act as an introducer, we may direct you to the relevant lender or broker for data they control.

Complaints and oversight

If you are unhappy with our response, you can complain to the ICO at ico.org.uk. We are committed to resolving concerns directly and transparently. Your trust is essential to our service.

Marketing preferences

We will only send marketing where we have your consent or it is otherwise permitted by law. You can unsubscribe at any time via the link in our emails or by contacting us. Unsubscribing from marketing does not affect service emails about your enquiry.

FAQs

Do you sell my data?

No, we never sell personal data. We share it only with relevant finance providers and service partners needed to deliver our service, under strict terms. You can ask for a list of categories of recipients.

Will you run a credit check on me or my business?

No, we do not run hard credit checks. If a provider needs a credit search, they will ask your permission and explain any impact on your credit file.

Can I ask you to delete my documents?

Yes, subject to legal or regulatory retention needs, you can request deletion. We aim to remove documents that are no longer necessary for your enquiry as soon as practicable. We will confirm once the deletion is complete.

Where is my data stored?

Primarily in the UK and EEA on reputable, security-certified infrastructure. If data is transferred elsewhere, we apply lawful safeguards such as the UK IDTA or EU SCCs. You can request details of applicable safeguards.

Does your AI make final lending decisions?

No, our AI only helps shortlist suitable options. Final decisions are made by the lender or broker you choose to engage. You can request a human review of your matches at any time.

Key takeaways

• Your data is used to assess eligibility, match you to suitable providers, and support introductions if you opt in.
• We store data securely in the UK/EEA where possible, apply encryption and access controls, and review retention regularly.
• We never sell data, and we only share with relevant providers and service partners under strict contracts.
• Our AI suggests options but does not make lending decisions; a human can review matches on request.
• You control your data, with rights to access, correct, delete, restrict, object, and withdraw consent.

Important compliance information

Best Business Loans is an independent introducer and does not offer loans directly or provide financial advice. We follow the spirit of FCA, ASA, and Google policies by keeping promotions clear, fair, and not misleading, and by including appropriate qualifications. Eligibility, rates, and terms are set by providers, and approvals are not guaranteed.

Ready to check eligibility?

Submit a Quick Quote to see potential matches and to request an indicative Decision in Principle. It is free to enquire, secure, and with no obligation to proceed. Start now at bestbusinessloans.ai.