Last updated: [PLACEHOLDER: date of last review, e.g. 1 November 2026]. This policy applies to the website at debtfactoring.org.uk and to the enquiry and contact forms on it. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In short: we collect the details you give us when you send an enquiry, we use them to respond and, where you ask us to, to pass your enquiry to a finance provider or intermediary so they can contact you. We do not sell personal data. You can ask us to delete your data at any time.
1. Who we are
Debt Factoring is an independent UK information and enquiry service about debt factoring, invoice factoring and invoice finance. We are not a lender and we do not provide finance ourselves.
The data controller for personal data collected through this website is:
- Legal entity: [PLACEHOLDER: full legal name of the trading entity, e.g. "Example Limited, trading as Debt Factoring"]
- Company registration number: [PLACEHOLDER: Companies House number, or state that the business is a sole trader or partnership]
- Registered office: [PLACEHOLDER: registered office address]
- ICO registration number: [PLACEHOLDER: Information Commissioner's Office registration reference, if registered, or confirm that an exemption applies]
- Privacy contact: [PLACEHOLDER: email address for data protection queries]
We have not appointed a statutory Data Protection Officer. [PLACEHOLDER: confirm, or name the DPO and give contact details if one has been appointed]
2. What personal data we collect
We collect only the data we need to run the website and to deal with the enquiries you choose to send us.
2.1 Data you give us through our forms
When you use the quote request form or the contact form we may ask for:
- your name;
- your business name and, where you choose to tell us, the type of business (limited company, LLP, sole trader or partnership);
- your email address and telephone number;
- the sector your business operates in;
- an annual turnover band;
- an outstanding invoice value band;
- the type of funding you are interested in (for example factoring, invoice discounting or selective invoice finance);
- any free-text message you choose to write.
Please do not include sensitive information in free-text fields, such as health details, bank account numbers or passwords. We do not need them and we would rather not hold them.
2.2 Data you give us in other ways
If you email or telephone us, we keep a record of the correspondence and the details you provide so that we can reply and keep track of what was discussed.
2.3 Technical data collected automatically
When you visit the website our hosting provider's server logs may record your IP address, the date and time of your visit, the pages requested, the referring page, and your browser type and operating system. This is standard for almost every website and is used for security, capacity planning and troubleshooting.
Hosting provider: [PLACEHOLDER: name of hosting or CDN provider and the retention period of its server logs].
2.4 Cookies and similar technologies
The website is built as a static site and does not set cookies by default. If analytics or other non-essential cookies are introduced in future, we will ask for your consent first and update our cookie policy. Please read that policy for the current position.
2.5 Data we do not collect
We do not ask for bank details, card details, passwords, identity documents or special category data (such as health, ethnicity or political opinions) through this website. We do not carry out credit searches. Any provider you go on to deal with will have its own privacy notice covering the checks it carries out.
3. How and why we use your data
UK GDPR requires us to have a lawful basis for each use of personal data. The table below sets out what we do and the basis we rely on.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your enquiry and explaining the options that may suit your business | Form data, correspondence | Legitimate interests: you have contacted us and reasonably expect a reply. Where the enquiry leads towards a facility, taking steps at your request before entering into a contract may also apply. |
| Passing your enquiry to a finance provider or authorised intermediary so they can contact you about a quotation | Form data | Legitimate interests and, where the form includes an explicit tick box, your consent. [PLACEHOLDER: confirm whether the form uses a consent tick box or relies on legitimate interests with a clear statement above the submit button] |
| Keeping a record of enquiries and correspondence | Form data, correspondence | Legitimate interests: managing our business, dealing with follow-up questions and defending legal claims. |
| Running, securing and improving the website | Technical data | Legitimate interests: keeping the site available and secure, and understanding how it is used in aggregate. |
| Sending you marketing emails about invoice finance topics | Name, email address | Consent only. We will not send marketing unless you have opted in, and you can opt out at any time. [PLACEHOLDER: delete this row if no marketing is sent] |
| Complying with legal obligations | Any relevant data | Legal obligation, for example responding to a lawful request from a regulator or court. |
Where we rely on legitimate interests we have considered whether our interests are outweighed by your rights and freedoms, and we have concluded that they are not, given the limited data involved and your reasonable expectations when you contact a business finance information service. You have the right to object to processing based on legitimate interests (see section 8).
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
4. Who we share your data with
We share personal data only where it is necessary for the purposes above.
4.1 Finance providers and intermediaries
The purpose of the quote request form is to connect you with a business that can discuss and, if appropriate, provide an invoice finance facility. When you submit an enquiry we pass the details you have given to:
[PLACEHOLDER: name of the finance provider, or the FCA-authorised commercial finance intermediary, that enquiries are passed to; its registered address and a link to its privacy notice. If enquiries may be passed to more than one organisation, list them or describe the categories and how the recipient is chosen.]
Once an enquiry has been passed on, the recipient becomes a separate data controller for the data it receives and will process it under its own privacy notice. The recipient is responsible for any credit searches, identity checks or underwriting it carries out. We recommend reading its privacy notice before proceeding.
We do not pass enquiries to lead-buying marketplaces or sell your details to third parties. [PLACEHOLDER: confirm this statement is accurate for the chosen commercial model]
4.2 Service providers acting on our behalf
We use third-party suppliers to run the website and handle enquiries. They act as our processors, only on our instructions and under written contracts that require them to protect your data.
- Form handling and email delivery: [PLACEHOLDER: name of the form-handling or email service that receives form submissions, where its servers are located and a link to its privacy notice]
- Website hosting: [PLACEHOLDER: hosting provider name and location]
- Email and document storage: [PLACEHOLDER: email and office software provider, e.g. the provider of our business email]
- Analytics: none currently installed. [PLACEHOLDER: update if an analytics tool is added]
4.3 Other disclosures
We may also disclose personal data to professional advisers (such as accountants, solicitors or insurers) where necessary, to a buyer or successor if the business is sold or restructured, and to regulators, law enforcement or courts where the law requires it.
5. How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected, and then delete or anonymise it.
| Category | Retention period | Reason |
|---|---|---|
| Enquiries that are passed to a provider or intermediary | [PLACEHOLDER: e.g. 24 months from the date of the enquiry] | To deal with follow-up questions, reconcile any remuneration and respond to complaints. |
| Enquiries that are not passed on or that receive no reply | [PLACEHOLDER: e.g. 6 months] | Short period in case you come back to us; then deleted. |
| General correspondence | [PLACEHOLDER: e.g. 24 months after the last contact] | Record of what was discussed. |
| Complaint records | [PLACEHOLDER: e.g. 6 years from closure] | Limitation period for legal claims. |
| Server logs | [PLACEHOLDER: as set by the hosting provider, e.g. 30 days] | Security and troubleshooting. |
| Marketing consent records | For as long as you remain opted in, plus [PLACEHOLDER: e.g. 12 months] after you opt out | To evidence consent and honour your opt-out. |
6. International transfers
We aim to store personal data in the United Kingdom. Some of our service providers (for example form-handling, email or hosting services) may store or access data outside the UK. Where that happens we make sure one of the following safeguards is in place:
- the destination country is covered by UK adequacy regulations (this includes the European Economic Area and, for certified organisations, the UK Extension to the EU-US Data Privacy Framework);
- the transfer is governed by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
- another safeguard permitted by UK GDPR applies.
Transfers currently made: [PLACEHOLDER: list any providers that process data outside the UK, the countries involved and the safeguard relied on, or state "none" if all processing is in the UK].
7. How we keep your data secure
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:
- serving the website over HTTPS so that form submissions are encrypted in transit;
- restricting access to enquiry data to the people who need it to respond to you;
- using reputable service providers with their own security certifications;
- keeping the volume of data we hold to a minimum, and deleting it in line with section 5.
No method of transmission over the internet is completely secure. If we become aware of a personal data breach that is likely to result in a high risk to you, we will tell you and the Information Commissioner's Office as the law requires.
8. Your rights
Under UK GDPR you have the following rights in relation to your personal data. None of them is absolute, and some apply only in certain circumstances, but we will always explain our reasoning if we cannot comply in full.
- Right of access: you can ask for a copy of the personal data we hold about you and information about how we use it.
- Right to rectification: you can ask us to correct data that is inaccurate or incomplete.
- Right to erasure: you can ask us to delete your data, for example where it is no longer needed or where you withdraw consent.
- Right to restriction: you can ask us to pause processing while a query about accuracy or our lawful basis is resolved.
- Right to data portability: where we process data you gave us by automated means on the basis of consent or contract, you can ask for it in a structured, machine-readable format.
- Right to object: you can object to processing based on legitimate interests, and you can object to direct marketing at any time, in which case we will stop.
- Right to withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
- Rights relating to automated decisions: we do not make solely automated decisions with legal or similar effects about you.
To exercise any of these rights, contact us using the details in section 12. We will respond within one month, which can be extended by up to two further months for complex requests. We will not normally charge a fee. We may ask you to confirm your identity before we act on a request.
If you have asked us to pass your enquiry to a provider or intermediary, you may also need to contact that organisation directly to exercise your rights over the copy it holds. We will tell you who to contact.
9. How to complain
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put it right. Our complaints information page explains the process.
You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at any time:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Children
This website is aimed at UK businesses and the people who run them. It is not intended for anyone under 18 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Links to other websites
The website contains links to third-party sites, including UK Finance, the Financial Conduct Authority, gov.uk and the finance provider or intermediary that handles enquiries. We are not responsible for the privacy practices of those sites. Please read their privacy notices before providing them with any personal data.
12. Contact us
Questions about this policy or about your personal data should be sent to:
- Email: [PLACEHOLDER: privacy or general contact email address]
- Post: [PLACEHOLDER: postal address for data protection correspondence]
- Telephone: [PLACEHOLDER: telephone number, if calls are accepted]
You can also use the contact form, which is itself covered by this policy.
13. Changes to this policy
We review this policy at least once a year and whenever our processing changes, for example if we add an analytics tool or change the organisation that receives enquiries. The date at the top of the page shows when it was last updated. Significant changes will be highlighted on this page, and where we hold your email address and the change materially affects you, we will tell you directly.
Previous versions are available on request.
Questions about your data?
Get in touch and we will explain what we hold and how it is used.
See also our cookie policy, our terms and conditions and our regulatory information.