Privacy Policy

This Privacy Policy explains how Speychain Limited ("Spey","we", "our" or "us") collects, uses, stores and shares personal data.
‍
Our registered address is 20 Arlington Street, London, United Kingdom, SW1A 1RG. Spey is registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018, registration number ZB748037. We are authorised and regulated by the Financial Conduct Authority (FCA), Firm Reference Number 1022125.
‍
This policy applies if you make use of the website or have applied for or obtained a product from Speychain Limited (“Spey”) or if we have received personal data about you. It is important that you read this policy carefully to ensure you understand how we collect, store, use and share personal data.

At Spey, we are committed to safeguarding your personal data when you use our services. We ensure your data is secure and only provide access to third parties subject to applicable lawful bases. Spey does not act as an insurance broker. Our use of your personal data complies with the General Data Protection Regulation ("GDPR") and the Data Protection Act 2018. Under these laws, we act as the ‘data controller’ of your information.

Please read this policy carefully. It explains how we collect, use, store, and share your information. If you do not agree, please refrain from using our website or platform.

We only process your personal data when there is a lawful basis. This may include: 
‍
• As necessary to perform the services.
• Performing a contract with you or taking steps before entering a contract.
• Complying with legal obligations.
• Where necessary for our legitimate interests or those of a third party.
• Where you have provided consent.
‍
Refusing to provide personal data for these purposes may prevent us from delivering our services or products.
‍
Please also see our Cookie Policy on the Speyfin.com website that covers our use of cookies.
‍
This Privacy Policy describes a number of different services provided by Spey. Not all sections will apply to every individual.  

Where you apply for lending products or services offered by Spey, additional sections relating to credit reference agencies, Open Banking, fraud prevention and affordability assessments will also apply. 

Where there is any inconsistency between sections, the section most closely connected with the relevant service shall prevail. Use of other Spey services such as Spey Register may be governed by separate privacy policies or notices; ensure that you read them carefully.

How we collect and handle your personal data depends on your interactions with Spey and the products or services you use. We may receive your information through:
‍
• Applications for our products or services.
• Loan searches via brokers featuring Spey on their lender panel.
• Insurer referrals.
• Submissions through our online forms.
• Information shared or collected while using our website or platform.
• Communications with us, including email, SMS, phone, or in writing.
• Responses to customer surveys.
• Engagement with us on social media platforms, such as Facebook, Instagram, or LinkedIn.
• Participation in promotions or competitions.
• Data provided by third parties, such as Credit Reference Agencies.
• Referrals made by third parties, including but not limited to Merchants, Insurers and Lenders.
• Evidence and file uploads submitted through our services such as Spey Register.
• Data entered into our services including Spey Register.
‍
Speychain Limited acts as a data controller for personal data it processes in connection with the operation, administration, security and testing of its services.

Insurers, lenders and other organisations receiving information generally act as separate and independent data controllers in respect of information they access, receive or download through the platform.

All personal data held by Spey is protected under data protection laws, regardless of how it is collected or provided.

We only collect personal data necessary to provide you with our services. This may include data used to assess insurability, saleability, affordability, lending risk, or to maintain your account. By submitting your personal data, you confirm it is accurate and pertains to you.
‍
Providing information is your choice. However, if you choose not to share certain details, we may be unable to offer you some products or services.
‍
The types of personal data we collect may include, but are not limited to:
‍
• Personal data - Name, date of birth, current and past addresses, phone numbers, and email address.  
• Application data - Loan details (e.g., requested amount, repayments, purpose), employment status, income, and housing costs.  
• Fraud Prevention Information - As detailed in Section 13 on fraud detection.  
• Bank Account data - Shared with your consent via Open Banking during the loan application process. This includes bank name, account holder name, account number, sort code, and transaction history. We may also retain partial debit card details (first six and last four digits, and expiry date) for payment collection via continuous payment authority or Open Banking arrangements. We do not store full card numbers or security codes.  
• Credit Risk Data - Information from credit reference agencies (see Section 6 on information sharing).  
• Communication Information - Contact details, preferred communication method (e.g. letter, email, SMS, phone), and records of interactions with Spey (e.g. emails, calls, webchats).
• Transactional data - Records of payments made or received and details of loan management requests.  
• Website Usage Data - Collected via cookies, including IP address, browser type, operating system, visit times, pages viewed, and actions taken on our website. Refer to our Cookie Notice for more details.  
• User Profile - Information created when you register on the Spey platform and data from devices you use to connect.  
• Contractual Information – Details of services and products we arrange for you.  
• Documentary Data - Documents provided during applications or throughout your relationship with Spey.  
• Sensitive or Special Information - Data such as health records, biometric data, or criminal records (see Section 5 on special category data).  
• Identification Documents - National identifiers (e.g., passport or driving licence numbers) and images of identification documents required for identity verification.  
• Social Media data - Comments or posts made on platforms such as Instagram or LinkedIn regarding our services. We will only share such content with your permission. 
• Operational Information - Details about complaints, login activity, subject access requests, and correction requests.  
• Consents - Records of permissions you grant, including consent to share your data with third parties or use special category data (e.g. health-related information).
‍
Information We Do Not Intentionally Collect 
‍On the speyfin.com website, Spey does not intentionally request or require the following information, and Users of the website should avoid uploading: 

• special category data;
• criminal offence data;
• payment card information;
• bank account details;
• government-issued identification numbers;
• data unrelated to the purposes of the upload;
• unnecessary personal data. 

Where such information is inadvertently uploaded, we may remove, restrict or delete it where appropriate. Where a User applies for a loan or is transferred to a third-party provider, this section may not apply. Third-party partners act as separate data controllers.

Under the General Data Protection Regulation (GDPR), we can only process personal data when we have a legitimate reason, including sharing it with third parties. We may use your information for the following purposes:

• Providing access to the website;
• Verifying your identity and submitted details;
• Testing, validating, and evaluating the functionality of the website;
• Investigating security, usability and operational issues;
• Maintaining audit records;
• Facilitating information sharing authorised by Users;
• Supporting application verification functionality;
• Improving system security and performance;
• Preventing and detecting fraud, money laundering, or other crimes;
• Assessing eligibility and suitability for our products;
• Using Open Banking data to assess affordability;
• Inviting you to register and create login credentials;
• Managing your account and loan transactions;
• Administering loan disbursal and repayment collection;
• Sending service-related messages about your account;
• Personalising marketing messages (if opted-in);
• Using transaction data for lending and collection decisions;
• Responding to your inquiries and complaints;
• Providing access to our lending platform;
• Delivering financing or services requested;
• Sending legally required notices (e.g. arrears, default, termination);
• Upholding data protection rights;
• Preventing financial crime (fraud, money laundering);
• Meeting regulatory reporting requirements;
• Conducting internal and external audits;
• Complying with UK/EU GDPR, AML laws, and sanctions;
• Adhering to rules set by the FCA and HMRC;
• Enforcing compliance with relevant policies and laws;
• Establishing, exercising, or defending legal claims;
• Tracing and taking action if you fail to repay a loan;
• Preventing misuse or unauthorised use of our services;
• Providing customer support;
• Staying in touch via email, SMS, phone, or post;
• Investigating reported service issues;
• Notifying you of new business activities and platform updates;
• Requesting feedback for service improvement;
• Special category data where a specific lawful condition under Article 9 UK GDPR applies and where such processing is necessary.
• Informing you of new products, offers, or significant changes (marketing preferences can be updated at any time);
• Enhancing risk models and operational processes;
• Analysing and refining customer services;
• Generating statistical reports using anonymised data;
• Conducting research on browsing trends and usage analytics;
• Profiling existing customers to identify new audiences;
• Using cookies and tracking tools for service optimisation;
• Testing artificial intelligence, machine learning and automated processing systems used within our services including Spey Register;
• Analysing uploaded information to improve platform functionality, security and User experience.
‍
4.1 Lawful Basis
‍

5.1 Special Category Data  
‍
Special category data refers to sensitive personal data that requires extra protection under GDPR. We will only process special category data where an Article 6 lawful basis applies, and an additional condition under Article 9 UK GDPR permits such processing. This may include: 

• Health data – To support accessibility needs (e.g., providing assistance for disabilities and vulnerable customers).
• Biometric data – Such as facial images for identity verification. 

Unless a User identifies they are a vulnerable individual following a prompt or there is a reasonable basis to conclude a User is vulnerable, Special Category data such as health data will not be collected, stored or shared. 
‍
5.2 Criminal Offence Data  
‍
We do not intentionally collect criminal offence data. If such information is inadvertently uploaded, we may process it only where required by law or where necessary to investigate misuse, fraud or unlawful activity and where a lawful basis exists. Spey may delete criminal offence data or restrict access where appropriate. Users should not upload criminal offence data unless expressly authorised.

6.1 Who We Share Your Information With  
‍
Information is only shared where: 
‍
• The User has voluntarily chosen to share information;
• Sharing is necessary to provide the requested functionality;
• A lawful basis exists under applicable data protection laws.Once information has been shared, the receiving organisation becomes an independent data controller and is responsible for its own compliance with UK GDPR, including retention, security and responses to data subject requests. 

Insurers, lenders, financial institutions, merchants, and other organisations receiving personal data through Spey Register generally act as independent data controllers in respect of that information. Each organisation is independently responsible for determining the purposes and means of its processing activities and for complying with applicable data protection laws. 

Service providers who process personal data solely on our behalf do so as data processors under written contracts requiring them to process personal data only on our instructions and to implement appropriate technical and organisational security measures. Other organisations, such as lenders, credit reference agencies and regulators, may process personal data as independent controllers where they determine their own purposes and means of processing. 

Spey cannot generally require recipients to erase information already received where they have their own legal, regulatory or business obligations to retain.  We treat your information confidentially, but we may share it with third parties where we have a lawful basis to do so, including:
• Service providers and agents;
• Lenders who fund Spey products;
• Insurers onboarded to Spey (Spey does not recommend insurers);
• Parties to whom we transfer our rights;
• Regulatory and law enforcement authorities;
• Credit reference agencies (CRAs);
• Fraud prevention agencies;
• Identity verification service providers;  
• Companies within the Spey Group Structure.

 6.2 Credit Reference Agencies (CRAs)
‍
We share your personal data with CRAs to obtain information for:
‍
• Verifying the accuracy of information you provide.
• Conducting affordability and credit risk assessments.
• Preventing fraud and money laundering.
• Tracing and recovering debts.
• Managing your account.
• Ensuring offers are suitable for your circumstances.
‍
Data Shared with CRAs: CRAs provide public and financial information, including credit history and fraud prevention data, about you and any financial associates (e.g., joint account holders).

Soft vs. Hard Credit Searches:
• Soft Search: Conducted during pre-application checks (e.g., verifying bankruptcy or debt management status). Soft searches are recorded but invisible to other lenders and do not impact your credit score. 

• Hard Search: Performed when you formally apply for a loan after reviewing pre-contract documents. Hard searches are visible to other lenders and may affect your credit score.
‍
Ongoing Reporting: We continue sharing data with CRAs throughout your relationship with us, including updates on settled accounts. If you miss repayments, CRAs will record the outstanding debt, which may impact your ability to obtain credit elsewhere.

Financial Associations: Although we do not offer joint loans, if you declare a financial associate, your credit records will be linked. You can request CRAs to unlink records if necessary.

Defaults and Notice: We usually provide 28 days' notice before reporting a default to a CRA unless court action is imminent.

Fraud Prevention: Your data will also be shared with fraud prevention agencies to prevent financial crime and verify identities. If fraud is detected, you may be refused services, financing, or employment. For more information, refer to Section 13 or email us at info@speyfin.com with "Fraud Prevention Agencies Information Request" in the subject line.

Credit Reference Agency Information Notice (CRAIN):

Details about how CRAs use and share personal data are available via their CRAIN documents:

• Equifax
• Experian
• TransUnion
‍
6.3 Identity Verification Services  
‍
We may share your information with third parties to verify your identity or authenticate ID documents. These third parties may request additional information directly from you. If special category data (e.g., biometric data) is required, we will seek your explicit consent beforehand.

Our website may include links to third-party websites for your convenience. These links do not imply our encouragement, endorsement or review of their products, services, content, policies, or practices.  
‍
When visiting external sites, your personal data will be handled according to their privacy policies, not ours. This Privacy Policy applies only to our website, so we encourage you to review third-party privacy policies and terms before sharing any personal data.  
‍
In some cases, our website or platform may redirect you to a third-party site to facilitate our services. We conduct due diligence to ensure these third parties meet appropriate data protection standards.  
‍
Accessing third-party sites is at your own risk. These websites may use cookies, collect data, or request personal data. We are not responsible for their actions, misuse of your data, or any related issues.

Spey is based in the UK, and your data will primarily be used in the UK and the EEA.  Where personal data is transferred outside the UK or EEA, we will implement appropriate safeguards, including adequacy regulations, standard contractual clauses or other recognised transfer mechanisms.  

We may use reputable third-party cloud hosting, infrastructure, backup and software service providers to store, process or transmit personal data on our behalf. These providers may process personal data using servers located outside the United Kingdom or the European Economic Area (EEA) or may permit limited remote access to personal data from other jurisdictions for the purposes of system administration, maintenance or technical support. Where this occurs, we will ensure that appropriate safeguards are in place in accordance with UK data protection law, including adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other legally recognised transfer mechanisms, together with appropriate technical and organisational security measures. We require our service providers to process personal data only on our documented instructions and to maintain appropriate standards of confidentiality and security.

Open Banking is a secure way for you to share financial information with us. In the UK, Open Banking is regulated by the Open Banking Limited (OBL), the implementation entity established by the Competition & Markets Authority to enhance competition and innovation in financial services, improving products and customer experiences. 
‍
When you apply for a Spey loan or third-party loan, we may use Open Banking technology to assess your creditworthiness, determining how much you can borrow and under what terms. This ensures any loan offers align with your financial circumstances.  
‍
We partner with an authorised Account Information Service Provider (AISP) to securely access your bank account data. To use this service, you must agree to the AISP’s Terms of Service. You will be redirected to your bank by the AISP for authentication, and your data will be transmitted to us in compliance with UK and EU data protection laws. All AISPs we work with are authorised and regulated by the Financial Conduct Authority (FCA).
‍
We do not store your Internet Banking Credentials. These details are transmitted securely and encrypted, only being shared directly with your bank.

In some cases, we may use automated decision-making, meaning decisions are made solely by automated systems (e.g., software algorithms) without human involvement. We use automation to assess your suitability and affordability for our products, ensuring we make accurate and efficient lending decisions. This helps us determine whether we can offer you a product and fulfil our responsibilities as a responsible lender.  
‍
These decisions are based on personal data provided by you or third parties, as outlined in this policy.   

Spey may use automated systems to organise information, extract information from documents, generate audit records, identify inconsistent information, minimise data, erase/retain data (Subject to periodic human review), generate informational scores, indicators or platform outputs and improve platform functionality and security. 

You have the right to contest an automated decision, express your viewpoint, or request a human review. To do so, contact us at info@speyfin.com.

Under data protection laws, you have the following rights regarding your personal data:
‍
• Right to be informed – Know how we collect and use your data.
• Right of access – Request copies of your personal data (See SAR form).
• Right to rectification – Correct inaccurate or incomplete data.
• Right to erasure – Request deletion of your data in certain cases.
• Right to restrict processing – Limit how we use your data in specific situations.
• Right to data portability – Transfer your data between services for personal use.
• Right to object – Challenge processing in certain circumstances.
• Rights in automated decision-making – Contest decisions made without human involvement.
• Right to withdraw consent – Revoke consent where applicable.
• Right to complain – File a complaint with the Information Commissioner’s Office (ICO).
‍
If your rights have been breached, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters.
‍
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

Telephone: 0303 123 1113
Website: ico.org.uk
‍
For more details, visit: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
Where personal data has been shared with an insurer, lender or another participating organisation/financial institution acting as an independent controller, requests relating to that organisation's processing may need to be directed to that organisation. Spey will cooperate where required by law. 

If you become aware of any suspected misuse, unauthorised access to your account, or any incident that may affect the confidentiality, integrity or availability of personal data processed through the platform, please notify us without undue delay using the contact details set out in section 18.

Information storage
‍
We retain your personal data only as long as necessary for the purposes outlined in this policy, unless a longer period is required or permitted by law.  
‍
As a regulated business, we may need to hold personal data based on:  
‍
• Legal and regulatory obligations;
• Applicable limitation periods for legal action;
• Defending against claims and complaint;
• Industry best practices;
• Operational business needs;
• Internal data retention policy;
‍
Retention periods vary depending on the product or service. Typical timeframes include:
‍
• Most customer data – Up to 6 years after the relationship ends.
• Sales call recordings – Up to 6 years from the recording date.
• Other contact centre call recordings – Up to 6 years from the recording date.
• Marketing permissions – Retained for up to 6 years after loan repayment or last login.
• Personal User Data – Retained for up to 6 years. Historical record/ownership history may, depending on the circumstances, cease to be “personal data” as they become matters of historical record if items are transferred before account closure in platform item deletion.
‍
We regularly review the necessity of holding data and securely dispose of or anonymise any information no longer required. Data may be retained in certain circumstances for less than or more than the stated periods above, subject to human review.
‍
Fraud Prevention and Data Sharing
‍
If we detect or suspect false information or fraud, we may record and share this data with fraud prevention agencies and law enforcement.  
‍
Fraud prevention agencies may retain your data for different periods. If flagged as a fraud or money laundering risk, your information may be held for up to 6 years, potentially affecting your ability to access financial services, employment, or other products.

General
‍
Before providing services, goods, or financing, we conduct checks to prevent fraud and money laundering, and verify your identity. This involves processing personal data collected from you or third parties. We may process details such as your name, address, date of birth, contact details, financial and employment information, device identifiers (e.g., IP address), and vehicle details if applicable. We and fraud prevention agencies may also share data with law enforcement to detect, investigate, and prevent crime. This processing is based on our legitimate interest in fraud prevention, compliance with legal obligations, and contractual requirements for our services. Fraud prevention agencies may retain your data for varying periods, and if identified as a fraud or money laundering risk, your data may be held for up to six years.
‍
Automated Fraud Checks
‍
We may use automated systems to assess fraud or money laundering risks. If our checks flag behaviour consistent with fraud, known criminal activity, or attempts to conceal identity, an automated decision may be made. You have the right to contest such decisions—contact us at info@speyfin.com for more details.
‍
Consequences of Processing
‍
If we or a fraud prevention agency determine you pose a fraud or money laundering risk, we may:  

• Refuse to provide services, financing, or employment.
• Stop offering existing services to you.
• Record the risk with fraud prevention agencies, potentially affecting your ability to access services from other providers.


Data Transfers
‍
If fraud prevention agencies transfer your data outside the European Economic Area (EEA), they enforce contractual protections to ensure it meets EEA data protection standards. They may also require recipients to adhere to international security frameworks for safe data sharing.

We apply data minimisation principles where technically viable and seek to ensure that personal data processed through our services is adequate, relevant and limited to what is necessary for the purposes described in this Privacy Policy.
‍
Users and participating organisations should avoid uploading unnecessary personal data and should use anonymised or pseudonymised information wherever reasonably possible during testing activities.
‍
It may be technically impractical to data-minimise directly uploaded documentation due to file formats and the volume of documentation. Uploading parties should therefore attempt to minimise data where possible prior to upload.

We implement technical and organisational measures designed to protect personal data, including:
‍
• access controls;
• authentication measures;
• audit logging;
• encryption in transit and at rest where appropriate;
• monitoring and incident management procedures.
‍
While we take reasonable steps to protect personal data, no system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials.

We keep this policy under regular review and reserve the right to amend this policy at any time. Changes will be posted on this page and become effective immediately.

This policy was last updated on 22/07/2026.

We use cookies and similar technologies to operate our website, improve performance, remember preferences and analyse website usage. Where required by law, we will obtain your consent before placing non-essential cookies. Further information is available in our Cookie Policy.

For questions or concerns regarding this policy, please contact us by email at info@speyfin.com, by phone at 020 8242 6305, or by writing to us at our address of 20 Arlington Street, London, United Kingdom, SW1A 1RG.