Privacy Notice

Privacy Notice

Version 1.1 · Last updated: 21 October 2026

This notice explains how Approven uses personal information when you enquire about, apply for or progress commercial finance through us. It applies to individuals connected with a business, including directors, owners, shareholders, partners, sole traders, guarantors and authorised contacts.

1. Who we are and how to contact us

Approven Limited, company number 17503844, is a company registered in England and Wales with its registered office at 20 Swan Street, Swan Building, First Floor, Manchester, England, M4 5JW. Approven provides commercial finance brokerage and intermediary services. For the personal information covered by this notice, Approven Limited acts as the data controller, unless another party such as a lender or funder is responsible for its own separate processing.

Privacy enquiries, rights requests and data-protection complaints: enquiries@approven.co.uk. ICO registration number: ZC274570, registered 14 October 2026.

2. If you did not give us your information yourself

This section is for you if someone else applied

Often the person who submits an application is not the only person it concerns. A director may give us details of a co-director. An applicant may name someone as a proposed guarantor. If that is how we came to hold information about you, this section explains what happens next.

• You are a director, owner, partner or other individual named on an application someone else submitted. The person submitting the application may give you this notice on our behalf. We check that it has been provided within the deadline below, or send it directly. You may also request a copy using the contact details above.
• You are a proposed guarantor. We contact you directly. We do not rely on the applicant to pass this notice on where a personal guarantee is proposed, because at that point you have not agreed to anything.
• A lender needs to search your personal credit file. Where Approven must obtain your personal search authority, we ask you directly. Where the lender obtains it itself, we record that arrangement rather than duplicate it. Required permission must be in place before the search.

Where we obtain your information from another source, we provide this notice within a reasonable period and no later than one month after obtaining it, or earlier when we first communicate with you or disclose your information to another recipient. This is subject to applicable legal exceptions, including where you already have the required information.

3. What information we collect

We collect personal information that is reasonably relevant to a funding enquiry, application, transaction or our relationship with you. What we collect depends on the business, product, lender requirements and how the enquiry progresses. The categories below are illustrative rather than exhaustive.

• Contact and identity. Name, role, email address, telephone number, date of birth, home address, and identity or address verification information where a lender requires it.
• Business and ownership. Business name, company number, legal structure, registered or trading address, public-record information, ownership or shareholding, and your role or authority in the business.
• Funding and financial. Funding amount and purpose, turnover, existing borrowing, accounts, bank statements, tax and VAT information, and other financial evidence supplied.
• Application and case. Application source, information and notes provided to us, communications, lender requests, offers, decisions, terms, funding dates, and how the application progresses.
• Authority and compliance records. Evidence of accuracy confirmations, lender-sharing authority, personal search authority, Terms of Business acceptance, privacy-notice acknowledgements and other declarations relevant to the transaction.
• Technical and usage. Where our website, forms or systems collect it: device or browser information, IP address, form activity, page or referral data, and system audit information.

We do not ordinarily request special-category personal information or criminal-offence information for a routine commercial finance enquiry. If such information is genuinely required, or is included in material provided to us, we will only process it where permitted by law and with appropriate safeguards.

If you do not provide information. Most of what we ask for is information a lender needs in order to consider your application. You are not obliged to give it to us, and there is no legal requirement on you to do so. But if you do not, we may not be able to assess your requirement, compare funding routes or submit an application, and a lender may decline to proceed. Where a particular piece of information is needed because of a legal requirement or a specific lender requirement rather than our own, we will tell you.

4. Where we get information from

• You directly, through our website, forms, email, telephone, meetings or other communications;
• the applicant business and people authorised or reasonably involved in providing information for the application, such as directors, employees or advisers - see section 2;
• referral partners and introducers who bring or progress a funding enquiry;
• publicly available and official sources, such as Companies House and other relevant registers;
• lenders, funders and other parties involved in assessing or progressing the funding request, where information is returned or made available to us; and
• service providers supporting our systems, communications, security, e-signature or workflow.

The sources used depend on the circumstances. We do not obtain information from every category in every case.

5. What we do and do not do

What our service is

We assess the funding requirement you tell us about, compare the funding routes available to us, and tell you which option we consider most commercially appropriate. You decide. We then submit the application to the lender or lenders you agree to approach.

If we cannot place your actual case through our available lenders, we may refer you to another finance broker, including for a product we normally offer. We name the firm and ask permission before sharing. Our Terms of Business explain how that firm may pay us.

We do

• Carry out basic public-record checks, such as Companies House, so that we do not submit a case with an obvious problem.
• Obtain and record search authority where the lender requires us to hold it, or record that the lender will obtain it directly.
• Tell you all intended lenders before sharing, together in one call or message where practical, and tell you about additions before sharing with them.
• Ask the individual concerned for any personal search authority we must obtain; otherwise record the lender-direct collection route.
• Tell you, and ask your permission, before we refer you to another broker.

We do not

• Assess your creditworthiness, affordability or credit risk. That is the lender's assessment, not ours.
• Carry out credit searches ourselves. Lenders and funders do that as part of their own underwriting.
• Share your information with a lender you have not been told about.
• Rely on one person's authority to search another person's credit file.
• Pass your information to another broker without asking you first.

Lenders and funders determine their own purposes and means of processing for their underwriting and should provide their own privacy information where required.

6. How and why we use your information

UK data protection law requires a lawful basis for each purpose. The basis can differ between individuals and activities. Client authority under our lender-sharing process is recorded separately and is not a substitute for a lawful basis.

• Respond to enquiries and establish the funding requirement. Legitimate interests in responding to and managing business enquiries. Pre-contract steps may also apply where you are personally the prospective contracting party.
• Assess the requirement, compare funding routes and form the recommendation we give you. Legitimate interests in providing the brokerage service requested. Contract or pre-contract steps may also apply, for example where you are a sole trader.
• Share an application with a lender or funder you have been told we propose to approach. Legitimate interests in arranging and progressing the requested finance. Contract or pre-contract steps may also apply. Your authority is recorded separately.
• Verify identity, authority and business information; manage fraud, security or compliance risk. Legitimate interests in protecting Approven, clients, lenders and the integrity of the service. Legal obligation where a specific duty applies.
• Manage offers, funding, lender communications, commission and case administration. Legitimate interests in operating, administering and evidencing the service. Contract may also apply where you are personally the contracting party.
• Handle complaints, disputes, audits and legal claims. Legitimate interests in resolving issues and establishing, exercising or defending legal rights; legal obligation where a specific duty applies.
• Send optional marketing communications, including about renewals and repeat funding. Consent where required or where we ask to rely on it; otherwise legitimate interests in relevant business marketing where the channel rules allow and our assessment supports it. Section 10 explains the routes. You may object to direct marketing at any time.
• Operate and secure our website, CRM, communications and other business systems. Legitimate interests in running secure and effective business systems; consent where required for non-essential cookies or similar technologies.
• Refer your enquiry to another finance broker where we cannot place it. Legitimate interests in helping you find funding we cannot arrange ourselves, and in the referral arrangement itself. We ask your permission before we share anything, and you can decline.

Where we rely on legitimate interests we have considered whether those interests are outweighed by your interests, rights and freedoms. You can ask us for a summary of that assessment for any purpose above.

7. Who we share information with

• lenders and funders we propose to approach in connection with your funding request;
• other parties directly involved in assessing, verifying, arranging or completing the transaction where reasonably necessary;
• technology and service providers supporting our CRM, communications, cloud storage, document handling, electronic signature, website, security, workflow or AI-assisted business tools;
• professional advisers, insurers, accountants, auditors or legal advisers where reasonably required;
• introducers and referral partners, in relation to the enquiry they introduced and only to the extent appropriate; and
• other finance brokers to whom we refer an enquiry we cannot place ourselves, where you have agreed to the referral. That firm decides its own purposes for the information it receives and gives you its own privacy information; and
• courts, regulators, law-enforcement bodies, public authorities or others where required by law or reasonably necessary to establish, exercise or defend legal rights, manage fraud or address serious risk.

Where a service provider processes personal information on our behalf, we require it to handle that information only for authorised purposes and subject to appropriate contractual and security requirements.

8. International transfers

Some service providers may store, access or process personal information outside the United Kingdom. Where the UK international-transfer rules apply, we ensure the transfer is covered by an appropriate lawful mechanism and the safeguards required by applicable law, and we assess the risk of the transfer before relying on it.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this notice. Our retention periods are set out in our retention schedule, RET-001, and depend on the type of record, whether an enquiry progressed, whether funding completed, contractual or lender requirements, complaint or dispute risk, fraud-prevention needs and any applicable legal obligation.

We review supporting documents 90 days after an abandoned enquiry or completed submission, deleting those no longer needed. A justified legal, lender or evidential need may require longer retention under RET-001. Core authority, transaction and complaint evidence is kept separately. A limited contact and renewal record does not justify keeping old bank statements or ID; identity documents are deleted when their required purpose ends.

10. Marketing

We may send relevant business marketing, including renewal information, where the applicable channel rules and a lawful data-protection basis allow. For company and other corporate-subscriber email contacts, we may rely on legitimate interests following assessment. For sole traders and other individual subscribers, we use consent or a valid soft opt-in for our own similar services: details obtained during a sale or negotiation, an opt-out at collection and in each message. If subscriber status is uncertain, we use the individual-subscriber rules.

Marketing consent is optional and separate from an application. We screen live marketing calls against TPS, CTPS and our objection records, identify ourselves and display a contact number; a registered number requires the appropriate consent. Emails identify us and provide an opt-out. We honour objections and withdrawals and do not change basis to get around them. Automated marketing calls require specific consent. Contact us or use the unsubscribe method to stop marketing; service communications about a live case are separate. An unanswered marketing message does not restart retention of old deal documents.

11. Automated decision-making

Approven may use technology, including AI-assisted tools, to support administration, document handling, summarisation, workflow and internal analysis. These tools support rather than replace meaningful human involvement in material client matters. Every case receives a human review before it is submitted to any lender.

Approven does not currently take significant decisions about you solely by automated processing, and it does not make a lender's credit or funding decision. If Approven introduces significant decision-making based solely on automated processing in future, it will assess the applicable lawful basis and apply the safeguards required by UK data-protection law, including appropriate information about the decision and routes to make representations, obtain human intervention and contest the decision where applicable.

Lenders and funders may use automated tools or profiling within their own underwriting. Their own privacy information applies to that processing.

12. Your data protection rights

Depending on the circumstances, you may have rights to ask for access to personal information we hold about you; ask us to correct inaccurate or incomplete information; ask us to erase information in certain circumstances; ask us to restrict how we use information in certain circumstances; object to processing based on legitimate interests or to direct marketing; receive certain information in a portable format where that right applies; withdraw consent where we rely on consent; and make representations about, request human intervention in, or contest a significant decision based solely on automated processing where the relevant safeguards apply.

If you gave us authority for a lender to search your personal credit file, you can withdraw it in respect of any search that has not yet been carried out.

These rights do not apply in every circumstance and some are subject to legal exemptions. To exercise a right, contact enquiries@approven.co.uk. We may need to confirm your identity before responding.

13. Complaints

You have a right under section 164A of the Data Protection Act 2018 to complain to us if you consider that we have handled your personal information in breach of data protection law. You can do that at enquiries@approven.co.uk, or by any other means you find convenient - we will not insist on a particular form.

We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to respond without undue delay, keep you informed of progress where it takes time, and tell you the outcome. Our complaints policy sets out how we handle complaints generally, and in practice we aim to acknowledge within two business days and give you an outcome within twenty.

You can also complain to the UK data-protection regulator - currently the Information Commissioner's Office, at ico.org.uk. Complaining to us first does not affect that right.

14. Changes to this notice

We may update this notice when our services, systems, suppliers, lender relationships or legal requirements change. Where a change materially affects how we use personal information, we will take reasonable steps to bring the updated information to the attention of affected individuals before the new use begins where required.