Advance Funds Network Privacy Policy

We understand how important your privacy is, and we are committed to protecting your personal information and keeping it safe and secure at all times.

This Privacy Policy explains how Advance Funds Network Limited (“AFN,” “we,” “us,” or “our”) collects, uses, shares, and pr
otects your personal and business data when you use our website(s), submit an enquiry or application, or otherwise interact with us as a commercial finance introducer.

Please read this policy together with our Terms and Conditions and any other documents referred to in it.

Where you apply on behalf of a business, “you” also includes that business’s principals, directors, shareholders, employees, guarantors, and any other individual connected with the application whose data you provide to us.

This notice explains how we use personal information when you visit our website, make an enquiry or application, or otherwise deal with us. It does not ask you to consent to all of the processing described below. Where we rely on consent for a specific activity, we will ask for it separately.

We may update this Privacy Policy from time to time; material changes will be flagged on this page with a revised “Last updated” date.

Our website may contain links to third-party websites, including lender websites, that are not covered by this Privacy Policy. We recommend you review the privacy policies of any third-party sites you visit.

Under UK data protection law, you have a formal right to raise a data protection concern or complaint directly with us (see “How to complain” below). We ask that you give us the opportunity to address your concern first—see Section 18. You also retain the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection (ico.org.uk).

Contents

1. Who we are
2. Our status as an introducer
3. Personal and business data we collect
4. How we collect your information
5. What communications we will send you
6. How we use your information (lawful basis)
7. How our lender partners use your personal and business data
8. Who else we share your data with
9. Automated decision-making
10. If you fail to provide personal data
11. International data transfers
12. Marketing
13. How long we keep your information
14. Security of your information
15. Credit checks and credit reference agencies
16. Cookies
17. Your rights
18. How to complain (Statutory complaints process — Section 164A DPA 2018)
19. Changes to this policy
20. Contact us

1. Who we are

We are Advance Funds Network Limited, a company registered in England and Wales under company number 17298045, with our registered address at Paternoster House, 65 St. Paul’s Churchyard, London EC4M 8AB, United Kingdom. We are registered with the Information Commissioner’s Office under registration number ZC182755.

Advance Funds Network Limited is responsible for the personal information it collects and controls for the purposes described in this notice. We may share personal information with our affiliated group companies in the United States and Canada as described under ‘International transfers’ below. References to “AFN” or the “AFN Group” mean Advance Funds Network Limited together with its US and Canadian affiliates.

For data protection matters enquiries and complaints:

• Email: [email protected]
• By Post: Data Protection, Advance Funds Network Limited, Paternoster House, 65 St. Paul’s Churchyard, London EC4M 8AB

2. Our status as an introducer

Advance Funds Network Limited acts as a commercial finance introducer. We use your personal information to assess your enquiry and introduce you to finance providers that may be able to assist. The finance provider is responsible for its own lending and credit decisions.

3. Personal and business data we collect

To assess your funding requirements and match your business with appropriate lenders, we collect:

• Application & financial data: full name, title, business email address, phone numbers, residential address, date of birth, residential status, business ownership percentages, National Insurance number (where required by a lender), company financial turnover, bank statements, and connected Open Banking / Open Accounting data.
• Technical & browsing data: IP address, approximate geographic location, browser type, device identifiers, referring URLs, date/time stamps, and website interaction data collected via cookies and similar technologies (see Section 16).
• Verification & public-source data: information from Companies House, credit reference agencies (e.g. Experian, Equifax, TransUnion), identity-verification providers, and public registers.

4. How we collect your information

• a. When you use our website — browsing activity including IP address, approximate location, browser/device type, referring site, pages visited, and timestamps (via cookies — see Section 16).
• b. When you complete an enquiry or application — funding amount/purpose/timing; business name, trading address, sector, and time trading; turnover and financials; your name, title, DOB, email, phone; residential address/status; business structure and registration details; details of owners/directors/partners/guarantors (including NI number where a lender requires it); bank statements or Open Banking/Open Accounting connection; any documents you upload. We may also collect your IP address and device information at the point of application for fraud prevention.
• c. When you contact us by email, phone, or live chat — your name, email, phone number, and anything else you share. Calls may be recorded for training, quality, and regulatory purposes.
• d. From third parties or public sources — Companies House; credit reference agencies; Open Banking/Open Accounting providers you connect; marketing/referral partners who introduce you to us; publicly available sources used to verify business information.
• e. Open Banking and Open Accounting — if you connect your bank account or accounting software via a secure third-party provider, you confirm the credentials used are your own and that you are authorised to connect the account. We use this data solely to support your application and, with consent, share it with your selected lender(s). The bank or accounting provider remains responsible for the accuracy and security of information held in its own systems. We remain responsible for protecting personal information that we receive and use.
• f. Cookies — see Section 16 and our separate Cookie Policy.

5. What communications we will send you

Once you submit an enquiry, we may contact you by phone, email, and/or text to verify your details, update you on your application status, inform you of a lender’s decision or alternative options, or request further information a lender needs. Where you have opted in, we may also send marketing communications about our services or those of our partners. Every marketing message includes a clear opt-out, and you can stop this at any time (Section 17).

6. How we use your information (lawful basis)

Under UK GDPR, we rely on:

• Performance of a contract — to take steps at your request before entering an agreement (including for instance a soft credit check), and to act as your introducer, including passing your details to relevant lenders.
• Legitimate interests — improving our services and website, fraud prevention, managing our relationship with you, and marketing, provided this doesn’t override your rights.
• Legal obligation — where we must process or disclose data to comply with the law or a regulator/law enforcement request.
• Consent — we rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to our marketing communications.

Purposes for which we will use your personal data

1. To register you as a new customer and process your funding enquiry:
   • Type of data: Identity, Contact, Profile.
   • Legal basis: Performance of a contract with you (to evaluate your requirements and take pre-contractual steps at your request).
   • Retention: Retained for 6 years following the conclusion of the customer relationship or introduction, aligned with statutory limitation periods.
2. To process and deliver our introducer service (assessing eligibility, introducing to panel lenders, and managing commissions):
   • Type of data: Identity, Contact, Financial, Transaction, Marketing and Communications.
   • Legal basis: Performance of a contract with you; and Necessary for our legitimate interests (to provide commercial finance brokerage services, verify lender transactions, and recover debts/commissions).
   • Retention: Retained for 6 years following application completion or closure.
3. To manage our relationship with you (notifying changes, handling complaints, and communicating status updates):
   • Type of data: Identity, Contact, Profile, Marketing and Communications.
   • Legal basis: Performance of a contract with you; Necessary to comply with a legal obligation; and Necessary for our legitimate interests.
   • Retention: Retained for 6 years from the date of the last communication.
4. To administer and protect our business and website (troubleshooting, network security, IT support, and hosting):
   • Type of data: Identity, Contact, Technical.
   • Legal basis: Necessary for our legitimate interests; and Necessary to comply with a legal obligation.
   • Retention: Technical server logs are retained for 12 to 24 months, unless required longer for an ongoing investigation.
5. To deliver relevant website content and advertisements and measure advertising effectiveness:
   • Type of data: Identity, Contact, Profile, Usage, Marketing and Communications, Technical.
   • Legal basis: Consent (via Osano consent platform); and Necessary for our legitimate interests.
   • Retention: Analytics and advertising cookie identifiers are retained for up to 14 months.
6. To use data analytics to improve our website, products/services, and customer experiences:
   • Type of data: Technical, Usage.
   • Legal basis: Necessary for our legitimate interests.
   • Retention: Retained in aggregated or pseudonymous form for up to 14 months.
7. To send relevant marketing communications and make personalised recommendations:
   • Type of data: Identity, Contact, Technical, Usage, Profile, Marketing and Communications.
   • Legal basis: Consent (prior active opt-in); OR Necessary for our legitimate interests (B2B commercial marketing with clear opt-out).
   • Retention: Retained until you opt out; inactive marketing records are purged after 24 months of non-engagement.
8. To carry out market research and customer surveys:
   • Type of data: Identity, Contact, Profile, Usage, Marketing and Communications.
   • Legal basis: Necessary for our legitimate interests.
   • Retention: Retained for 2 years.

7. How our lender partners use your personal and business data

We may receive a commission from a lender if you take out finance following our introduction. Depending on the nature of the transaction and the services provided, we may also charge you a consulting or service fee. Where a fee applies, this will be disclosed and agreed with you separately.

We share your data with the lender(s) we consider suitable for your requirements from our panel of commercial finance providers. They assess your application, which may include soft credit/eligibility searches (no impact on your credit score) and, at full application stage, a hard credit check that can appear on your credit file.

We only work with lenders who have appropriate data-protection measures in place. We do not permit lending partners to use your data for their own independent marketing without your consent, and we never sell your data.

8. Who else we share your data with

• Service providers supporting our operations — website hosting, IT support, application/CRM platforms, identity verification, fraud prevention, analytics, marketing, and cookie-consent management tools (currently Osano) — acting under contracts appropriate to their role.
• Credit reference and fraud-prevention agencies.
• AFN Group affiliates in the United States and Canada, where we operate shared systems (e.g. CRM) — see Section 11 on international transfers.
• Regulators, law enforcement, or government authorities where legally required, or to protect our rights/property/safety, or to investigate fraud.
• A buyer or successor, if we sell, merge, or reorganise our business.

We will never sell your personal data, and will not disclose it to unrelated third parties for their own marketing without your consent.

9. Automated decision-making

We may use automated processes to match your enquiry with lenders more likely to assist, based on criteria such as time trading, turnover, business type, or requested loan amount. This routes your enquiry efficiently and does not, by itself, produce a final lending decision — final credit and funding decisions are always made by the lender.

Where a decision has a legal or similarly significant effect on you, you can request human review, express your view, and get an explanation, except where the decision is necessary to enter a contract with you, is authorised by law, or is based on your explicit consent.

10. If you fail to provide personal data

You can browse parts of our website without providing personal data, but we cannot process a funding enquiry or introduce you to a lender without the information described above.

11. International data transfers

We share personal information with our group affiliates located outside the United Kingdom:

• Advance Funds Network LLC in the United States, which provides centralized CRM, application management support, IT infrastructure, and group administration. To provide appropriate safeguards under Article 46 of the UK GDPR, we transfer this data pursuant to the UK International Data Transfer Agreement (IDTA) and maintain a documented Transfer Risk Assessment (TRA) to ensure standards of protection equivalent to the UK GDPR.
• Advance Funds Network (Canada) in Canada, which provides operational, administrative, and technical support. Canada is recognized under the UK’s statutory adequacy regulations as providing an adequate level of protection for personal data subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), supplemented by intra-group contractual safeguards.

Where other third-party cloud service providers process data outside the UK or EEA, we ensure that appropriate safeguards (such as the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses) are in place.

12. Marketing

We only use your information for marketing where you have opted in, or where otherwise permitted by law (e.g. marketing similar products to existing customers, with an easy opt-out).

Withdraw consent anytime via the opt-out link in any marketing message, or by emailing [email protected]. We action opt-out requests promptly, and always within 30 days.

13. How long we keep your information

We generally retain enquiry and application data for up to 6 years after our relationship with you ends, to handle queries, disputes, or regulatory requirements (aligned with UK limitation periods and AML/tax obligations). Website analytics data is kept in de-identified/aggregated form for a shorter period. Retention periods are reviewed periodically.

14. Security of your information

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, misuse, or disclosure — including secure hosting, HTTPS encryption in transit, access controls limiting staff access to what’s necessary, and contractual safeguards with service providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your information has been compromised, contact us immediately.

15. Credit checks and credit reference agencies

We, or the lenders we introduce you to, may carry out a soft credit search or identity check with agencies such as Experian, Equifax, or TransUnion, in relation to you and/or other business owners or directors. Soft searches do not affect your credit rating.

If you proceed with a lender’s full application, a full credit check may be carried out, which could be recorded on your credit file.

16. Cookies

Our website uses cookies and similar technologies via our cookie-consent management platform, Osano, to help the site function properly, remember your preferences, and understand how visitors use our site.

Some cookies (e.g. essential, and certain analytics/functionality cookies meeting strict first-party conditions) may operate without asking for your consent first; all others — including advertising and social-media cookies — only run after you give affirmative opt-in consent via our cookie banner.

See our separate Cookie Policy for the complete list, categories, and how to manage your preferences at any time via the “Cookie Preferences” link in our website footer.

17. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you (a “subject access request”).
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (“right to be forgotten”), subject to any legal/regulatory reason we may need to retain it.
• Restriction — ask us to restrict how we use your data in certain circumstances.
• Portability — ask for your data in a structured, commonly used, machine-readable format.
• Object — object to our processing, including for direct marketing, which we will always honour.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — to us directly (Section 18) and/or to the ICO (Section 18).

To exercise any of these rights, email [email protected] or write to: Data Protection, Advance Funds Network Limited, Paternoster House, 65 St. Paul’s Churchyard, London EC4M 8AB. We do not charge a fee for reasonable requests and respond within one calendar month, as required by law.

18. How to complain (Statutory Complaints Procedure — Section 164A DPA 2018)

If you consider that we have handled your personal data in breach of the Data Protection Legislation, you have a statutory right under Section 164A of the Data Protection Act 2018 to lodge a data protection complaint directly with us.

How to submit your complaint:

• By Email: [email protected] (Subject: Formal Data Protection Complaint)
• By Post: Data Protection Complaints, Advance Funds Network Limited, Paternoster House, 65 St. Paul’s Churchyard, London EC4M 8AB

Our Statutory Handling Process:

• Acknowledgement: We will formally acknowledge receipt of your complaint within 30 days of receiving it (and will aim to acknowledge within 5 business days).
• Investigation & Updates: We will take appropriate steps without undue delay to investigate your concerns and keep you informed of progress.
• Outcome: We will notify you in writing of the outcome of our investigation without undue delay.

Escalation to the Information Commissioner’s Office (ICO):

In accordance with the Data Protection Legislation, individuals are expected to raise concerns directly with us in the first instance. If you remain dissatisfied following the conclusion of our investigation, or if we fail to respond appropriately, you retain the right to escalate your complaint to the Information Commissioner’s Office:

• Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• Website: ico.org.uk

19. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements. Updates are posted here with a revised “Last updated” date; where changes are material, we will take reasonable steps to notify you.

20. Contact us

Advance Funds Network Limited

• By post: Paternoster House, 65 St. Paul’s Churchyard, London EC4M 8AB, United Kingdom
• By email: [email protected]
• By phone: Inbound telephone support is currently available to existing applicants via their dedicated account manager.
• ICO registration number: ZC182755
• Company number: 17298045