This privacy policy applies to Capital Business Loans Limited (trading as SME Finance Hub), a business finance brokerage authorized and regulated by the Financial Conduct Authority (FCA).

Personal Information:

• Name, email address, phone number
• Business details (company name, registration number, trading address)
• Financial information (turnover, loan requirements, banking details)
• Credit history and business credit reports
• Identity verification documents

Technical Information:

• IP address, browser type, and device information
• Website usage data and analytics
• Cookies and similar tracking technologies
• Communication records (calls, emails, chat logs)

Primary Purposes:

• Process your business finance applications
• Match you with suitable lenders from our panel
• Perform credit checks and risk assessments
• Communicate about your application status
• Provide customer support and account management

Legal and Regulatory Purposes:

• Comply with FCA regulations and requirements
• Conduct anti-money laundering (AML) checks
• Verify your identity and prevent fraud
• Maintain records as required by law
• Report suspicious activities to relevant authorities

Business Purposes:

• Improve our services and website functionality
• Analyze market trends and customer needs
• Send relevant marketing communications (with consent)
• Conduct customer satisfaction surveys

Authorized Third Parties:

• Lenders: We share your application with suitable lenders on our panel
• Credit Reference Agencies: Experian, Equifax, and TransUnion for credit checks
• Companies House: To verify business registration details
• Professional Advisors: Legal, accounting, and compliance consultants
• Technology Partners: Secure hosting, analytics, and communication platforms

Regulatory Bodies:

• Financial Conduct Authority (FCA)
• Information Commissioner's Office (ICO)
• National Crime Agency (suspicious activity reports)
• HM Revenue & Customs (when legally required)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Security Measures:

• 256-bit SSL encryption for all data transmission
• Secure, UK-based data centers with 24/7 monitoring
• Regular security audits and penetration testing
• Staff training on data protection and security
• Multi-factor authentication for system access

Data Retention:

• Active Applications: For the duration of the application process
• Successful Applications: 6 years from completion (FCA requirement)
• Unsuccessful Applications: 3 years from decline date
• Marketing Consent: Until consent is withdrawn
• Legal Requirements: As required by applicable law