Spey Privacy Policy

Last updated: 14 March 2025

1. About this policy

This privacy notice outlines how we handle your personal information. It applies if you have applied for or obtained a product from Speychain Limited (“Spey”) or if we have received personal information about you.

In this notice, 'Spey', 'we', or 'us' refers to Speychain Limited, trading as Spey, registered in England under No 14718933. Our registered address is 20 Arlington Street, London, United Kingdom, SW1A 1RG. Spey is registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018, registration number ZB748037. We are authorised and regulated by the Financial Conduct Authority (FCA), Firm Reference Number 1022125.

At Spey, we are committed to safeguarding your personal information when you use our services. We ensure your data is secure and aim to provide offers tailored to your needs. Our use of your personal information complies with the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018. Under these laws, we act as the 'data controller' of your information.

Please read this notice carefully. It explains how we collect, use, store, and share your information. By using our website or platform, you accept this privacy notice. If you do not agree, please refrain from using our website or platform.

We only process your personal information when there is a lawful basis. This may include:

Performing a contract with you or taking steps before entering a contract.
Complying with legal obligations.
Pursuing our legitimate interests or those of a third party.
Obtaining your clear consent for a specific purpose.

Refusing to provide personal data for these purposes may prevent us from delivering our services or products.

This notice covers data collected from potential customers registering on our website or social media and data gathered to assess lending decisions through the Spey platform.

Please also see our Cookie Policy that covers our use of cookies.

2. Data collection methods

How we collect and handle your personal information depends on your interactions with Spey and the products or services you use. We may receive your information through:

Applications for our products or services.
Loan searches via brokers featuring Spey on their lender panel.
Submissions through our online forms.
Information shared or collected while using our website or platform.
Communications with us, including email, SMS, phone, or in writing.
Responses to customer surveys.
Engagement with us on social media platforms, such as Facebook, Instagram, or LinkedIn.
Participation in promotions or competitions.
Data provided by third parties, such as Credit Reference Agencies.
Referrals made by third parties.

All personal information held by Spey is protected under data protection laws, regardless of how it is collected or provided.

3. Types of data we collect and store

We only collect personal information necessary to provide you with our services. This includes data used to assess affordability, manage lending risk, and maintain your account throughout your loan. By submitting your personal information, you confirm it is accurate and pertains to you.

Providing information is your choice. However, if you choose not to share certain details, we may be unable to offer you some products or services.

The types of personal data we collect under the legal basis of performance of a contract may include, but are not limited to:

Personal data – Name, date of birth, current and past addresses, phone numbers, and email address.
Application data – Loan details (e.g., requested amount, repayments, purpose), employment status, income, and housing costs.
Fraud Prevention Information – As detailed in Section 13 on fraud detection.
Bank Account data – Shared with your consent via Open Banking during the loan application process. This includes bank name, account holder name, account number, sort code, and transaction history. We may also retain partial debit card details (first six and last four digits, and expiry date) for payment collection via continuous payment authority or Open Banking arrangements. We do not store full card numbers or security codes.
Credit Risk Data – Information from credit reference agencies (see Section 6 on information sharing).
Communication Information – Contact details, preferred communication method (e.g. letter, email, SMS, phone), and records of interactions with Spey (e.g. emails, calls, webchats).
Transactional data – Records of payments made or received and details of loan management requests.
Website Usage Data – Collected via cookies, including IP address, browser type, operating system, visit times, pages viewed, and actions taken on our website. Refer to our Cookie Notice for more details.
User Profile – Information created when you register on the Spey platform and data from devices you use to connect.
Contractual Information – Details of services and products we arrange for you.
Documentary Data – Documents provided during applications or throughout your relationship with Spey.
Sensitive or Special Information – Data such as health records, biometric data, or criminal records (see Section 5 on special category data).
Identification Documents – National identifiers (e.g., passport or driving licence numbers) and images of identification documents required for identity verification.
Social Media data – Comments or posts made on platforms such as Facebook or Instagram regarding our services. We will only share such content with your permission.
Operational Information – Details about complaints, login activity, subject access requests, and correction requests.
Consents – Records of permissions you grant, including consent to share your data with third parties or use special category data (e.g. health-related information).

4. How we use data

Under the General Data Protection Regulation (GDPR), we can only process personal data when we have a legitimate reason, including sharing it with third parties. We may use your information for the following purposes:

4.1 Customer Onboarding and Service

Verify your identity and submitted details.
Prevent and detect fraud, money laundering, or other crimes.
Assess eligibility and suitability for our products.
Use Open Banking data to assess affordability.
Invite you to register and create login credentials.
Manage your account and loan transactions.
Administer loan disbursal and repayment collection.
Send service-related messages about your account.
Personalise marketing messages (if opted-in).
Use transaction data for lending and collection decisions.

4.2 Fulfilling Our Contractual Obligations

Respond to your enquiries and complaints.
Provide access to our lending platform.
Deliver financing or services requested.
Send legally required notices (e.g. arrears, default, termination).

4.3 Legal and Regulatory Compliance

Uphold data protection rights.
Prevent financial crime (fraud, money laundering).
Meet regulatory reporting requirements.
Conduct internal and external audits.
Comply with UK/EU GDPR, AML laws, and sanctions.
Adhere to rules set by the FCA and HMRC.
Enforce compliance with relevant policies and laws.

4.4 Business Protection

Establish, exercise, or defend legal claims.
Trace and take action if you fail to repay a loan.
Prevent misuse or unauthorised use of our services.

4.5 Enhancing Customer Experience

Provide customer support.
Stay in touch via email, SMS, phone, or post.
Investigate reported service issues.
Notify you of new business activities and platform updates.
Request feedback for service improvement.
Process special category data (e.g., health-related information) when provided.
Inform you of new products, offers, or significant changes (marketing preferences can be updated at any time).

4.6 Business and Product Improvement

Enhance risk models and operational processes.
Analyse and refine customer services.
Generate statistical reports using anonymised data.
Conduct research on browsing trends and usage analytics.
Profile existing customers to identify new audiences.
Use cookies and tracking tools for service optimisation.

5. Special category data

5.1 Special Category Data

Special category data refers to sensitive personal information that requires extra protection under GDPR. We will only process special category data with your explicit consent or where a lawful basis applies. The types we may collect include:

Health data – To support accessibility needs (e.g., providing assistance for disabilities).
Biometric data – Such as facial images for identity verification.

5.2 Criminal Offence Data

Criminal offence data includes records of convictions and offences. In most cases, we will request your consent before processing criminal offence data. We may use this data to prevent or detect unlawful activities.

6. Information sharing

6.1 Who We Share Your Information With

We treat your information confidentially, but we may share it with third parties where we have a lawful basis to do so, including:

Service providers and agents.
Lenders who fund Spey products.
Parties to whom we transfer our rights.
Regulatory and law enforcement authorities.
Credit reference agencies (CRAs).
Fraud prevention agencies.
Identity verification service providers.

6.2 Credit Reference Agencies (CRAs)

We share your personal data with CRAs to obtain information for:

Verifying the accuracy of information you provide.
Conducting affordability and credit risk assessments.
Preventing fraud and money laundering.
Tracing and recovering debts.
Managing your account.
Ensuring offers are suitable for your circumstances.

Data Shared with CRAs: CRAs provide public and financial information, including credit history and fraud prevention data, about you and any financial associates (e.g., joint account holders).

Soft vs. Hard Credit Searches:

Soft Search: Conducted during pre-application checks (e.g., verifying bankruptcy or debt management status). Soft searches are recorded but invisible to other lenders and do not impact your credit score.
Hard Search: Performed when you formally apply for a loan after reviewing pre-contract documents. Hard searches are visible to other lenders and may affect your credit score.

Ongoing Reporting: We continue sharing data with CRAs throughout your relationship with us, including updates on settled accounts. If you miss repayments, CRAs will record the outstanding debt, which may impact your ability to obtain credit elsewhere.

Financial Associations: Although we do not offer joint loans, if you declare a financial associate, your credit records will be linked. You can request CRAs to unlink records if necessary.

Defaults and Notice: We usually provide 28 days' notice before reporting a default to a CRA unless court action is imminent.

Fraud Prevention: Your data will also be shared with fraud prevention agencies to prevent financial crime and verify identities. If fraud is detected, you may be refused services, financing, or employment. For more information, refer to Section 13 or email us at info@speyfin.com with “Fraud Prevention Agencies Information Request” in the subject line.

Credit Reference Agency Information Notice (CRAIN): Details about how CRAs use and share personal data are available via their CRAIN documents:

Equifax
Experian
TransUnion

6.3 Identity Verification Services

We may share your information with third parties to verify your identity or authenticate ID documents. These third parties may request additional information directly from you. If special category data (e.g., biometric data) is required, we will seek your explicit consent beforehand.

7. Links to other websites

Our website may include links to third-party websites for your convenience. These links do not imply our endorsement or review of their content, policies, or practices.

When visiting external sites, your personal information will be handled according to their privacy policies, not ours. This Privacy Policy applies only to our website, so we encourage you to review third-party privacy policies and terms before sharing any personal data.

In some cases, our website or platform may redirect you to a third-party site to facilitate our services. We conduct due diligence to ensure these third parties meet appropriate data protection standards.

Accessing third-party sites is at your own risk. These websites may use cookies, collect data, or request personal information. We are not responsible for their actions, misuse of your data, or any related issues.

8. Where we store your data

Spey is based in the UK and your data will only be used in the UK and EEA. It may be stored in the UK by Spey, or in the UK or EEA by third-parties we work with to provide our services.

9. Open Banking

Open Banking is a secure way for you to share financial information with us. In the UK, Open Banking is regulated by the Open Banking Limited (OBL), the implementation entity established by the Competition & Markets Authority to enhance competition and innovation in financial services, improving products and customer experiences.

When you apply for a Spey loan, we use Open Banking technology to assess your creditworthiness, determining how much you can borrow and under what terms. This ensures any loan offers align with your financial circumstances.

We partner with an authorised Account Information Service Provider (AISP) to securely access your bank account data. To use this service, you must agree to the AISP's Terms of Service. You will be redirected to your bank by the AISP for authentication, and your data will be transmitted to us in compliance with UK and EU data protection laws. All AISPs we work with are authorised and regulated by the Financial Conduct Authority (FCA).

We do not store your Internet Banking Credentials. These details are transmitted securely and encrypted, only being shared directly with your bank.

10. Automated decision-making

In some cases, we may use automated decision-making, meaning decisions are made solely by automated systems (e.g., software algorithms) without human involvement.

We use automation to assess your suitability and affordability for our products, ensuring we make accurate and efficient lending decisions. This helps us determine whether we can offer you a product and fulfil our responsibilities as a responsible lender.

These decisions are based on personal information provided by you or third parties, as outlined in this policy.

You have the right to contest an automated decision, express your viewpoint, or request a human review. To do so, contact us at info@speyfin.com.

11. Your rights

Under data protection laws, you have the following rights regarding your personal information:

Right to be informed – Know how we collect and use your data.
Right of access – Request copies of your personal data.
Right to rectification – Correct inaccurate or incomplete data.
Right to erasure – Request deletion of your data in certain cases.
Right to restrict processing – Limit how we use your data in specific situations.
Right to data portability – Transfer your data between services for personal use.
Right to object – Challenge processing in certain circumstances.
Rights in automated decision-making – Contest decisions made without human involvement.
Right to withdraw consent – Revoke consent where applicable.
Right to complain – File a complaint with the Information Commissioner's Office (ICO).

For more details, visit: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

12. How long we store your information for

Information storage

We retain your personal information only as long as necessary for the purposes outlined in this policy, unless a longer period is required or permitted by law.

As a regulated business, we may need to hold personal data based on:

Legal and regulatory obligations.
Applicable limitation periods for legal action.
Defending against claims and complaints.
Industry best practices.
Operational business needs.

Retention periods vary depending on the product or service. Typical timeframes include:

Most customer data – Up to 6 years after the relationship ends.
Sales call recordings – Up to 6 years from the recording date.
Other contact centre call recordings – Up to 6 years from the recording date.
Marketing permissions – Retained for up to 6 years after loan repayment or last login.

We regularly review the necessity of holding data and securely dispose of or anonymise any information no longer required.

Fraud Prevention and Data Sharing

If we detect or suspect false information or fraud, we may record and share this data with fraud prevention agencies and law enforcement.

Fraud prevention agencies may retain your data for different periods. If flagged as a fraud or money laundering risk, your information may be held for up to 6 years, potentially affecting your ability to access financial services, employment, or other products.

13. Fair processing notices for fraud prevention and detection

General

Before providing services, goods, or financing, we conduct checks to prevent fraud, money laundering, and verify your identity. This involves processing personal data collected from you or third parties.

We may process details such as your name, address, date of birth, contact details, financial and employment information, device identifiers (e.g., IP address), and vehicle details.

We and fraud prevention agencies may also share data with law enforcement to detect, investigate, and prevent crime. This processing is based on our legitimate interest in fraud prevention, compliance with legal obligations, and contractual requirements for our services.

Fraud prevention agencies may retain your data for varying periods, and if identified as a fraud or money laundering risk, your data may be held for up to six years.

Automated Fraud Checks

We may use automated systems to assess fraud or money laundering risks. If our checks flag behaviour consistent with fraud, known criminal activity, or attempts to conceal identity, an automated decision may be made. You have the right to contest such decisions—contact us at info@speyfin.com for more details.

Consequences of Processing

If we or a fraud prevention agency determine you pose a fraud or money laundering risk, we may:

Refuse to provide services, financing, or employment.
Stop offering existing services to you.
Record the risk with fraud prevention agencies, potentially affecting your ability to access services from other providers.

Data Transfers

If fraud prevention agencies transfer your data outside the European Economic Area (EEA), they enforce contractual protections to ensure it meets EEA data protection standards. They may also require recipients to adhere to international security frameworks for safe data sharing.

14. Changes to this policy

We keep this policy under regular review and reserve the right to amend this policy at any time. Changes will be posted on this page and become effective immediately.

15. Contact

For questions or concerns regarding this policy, please contact us by email atinfo@speyfin.com, by phone at 020 8242 6305, or by writing to us at our address of 20 Arlington Street, London, United Kingdom, SW1A 1RG.