Privacy Notice

At a glance

This notice explains how we use information from website visits, enquiries, job applications and commercial finance services. Mortgage, insurance and protection enquiries are passed to Capital Advisory Finance Ltd, which handles them as a separate controller. It also explains retention periods and your data protection rights.

This notice explains how Capital Commercial Finance Ltd handles personal information when you visit our website, contact us, submit a business finance enquiry, apply for a job through our contact form or use our commercial finance services. Mortgage and insurance or protection enquiries submitted through the general contact form are passed to Capital Advisory Finance Ltd to respond to and progress. We explain below how that referral works and which company is responsible for your information. The notice also covers people connected with a business finance application, including directors, owners, guarantors, accountants and authorised representatives.

1. Who we are and how to contact us

Capital Commercial Finance Ltd (company number 17299270), trading as Capital Finance Group, is the data controller for the processing described in this notice. This means we decide why and how your personal information is used.

Capital Advisory Finance Ltd also trades as Capital Finance Group. If your general contact enquiry concerns a mortgage or insurance or protection product, we share the relevant information with Capital Advisory Finance Ltd so it can contact you and progress the enquiry. Capital Commercial Finance Ltd is responsible for the initial website collection and referral described here. Capital Advisory Finance Ltd acts as a separate controller for its subsequent handling of the enquiry; its own privacy information applies to that processing.

Our registered privacy contact details are:

• Data Protection Lead: Matthew Wood, Director
• Address: 22A Ropergate, Pontefract, WF8 1LY
• Email: matt@capitalfinancegroup.co.uk
• Telephone: 07795 608082

You can use these details to ask questions about this notice, exercise a data protection right or make a privacy complaint.

2. Personal information we collect

The information we collect depends on how you interact with us.

Website contact enquiries

• Your name and email address.
• The reason for contacting us and the content of your message, including whether your enquiry concerns a mortgage, insurance or protection product.
• Technical information needed to deliver and protect the service, including your IP address for short-term rate limiting.

Job applications

• Your name, email address, message and PDF CV.
• Information contained in your CV, which may include employment history, qualifications, skills and other information you choose to provide.
• Please avoid including unnecessary special-category or highly sensitive information in a CV or general message unless we have specifically asked you to provide it.

Business finance enquiries and applications

• Business details, including legal name, trading name, company type, company registration number, industry and website.
• Contact details, including name, email address and UK telephone number.
• Funding requirements, including amount, purpose, urgency, preferred repayment term and any optional reasons or supporting information you provide.
• Optional accountant details, including accountant name, email address and firm.
• If an enquiry progresses, identity, ownership and business information, financial statements, bank statements, accounts, forecasts, assets, liabilities, credit commitments, property or security details, guarantees, repayment plans and information reasonably required to assess or arrange finance.
• Records of communications, instructions, agreements, complaints, fees, commission and payment or accounting information where relevant.

Technical and security information

• IP address used temporarily for anti-spam, abuse prevention and rate limiting.
• Cookie-consent choice and, where you choose analytics, website usage, landing-page, referrer and campaign information collected through Umami Cloud.
• Public company information returned through the Companies House search feature.
• Where present, referral and enquiry-attribution information, including the landing page, referrer and URL parameters such as utm_source, utm_medium, utm_campaign, ref, source and amount.

3. Where information comes from

We receive personal information directly from you, your business and people authorised to act for you. Where relevant to a finance application, we may also receive information from directors, owners, guarantors, accountants, introducers, advisers, lenders, business-information or credit-reference providers, fraud-prevention services, valuers, identity-check providers and other professionals involved in a transaction.

We may obtain public information from sources such as Companies House, Land Registry and the UK Sanctions List. Where relevant, we may also obtain company risk, credit or report information from business-information providers such as Creditsafe using a company registration number.

Referral and attribution information may come from the page visited, the referring website and parameters attached to a website link.

If you provide personal information about another person, such as an accountant, director or guarantor, please make sure you are authorised to do so and make this notice available to them where appropriate.

4. Why we use information and our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. The basis we rely on depends on the purpose and the individual involved.

Where we rely on legitimate interests, we consider whether the processing is necessary and reasonably expected and balance our interests against your rights and freedoms. You may ask us for further information about that assessment.

We do not currently use contact or finance-enquiry details for direct marketing. Submitting an enquiry does not sign you up to marketing.

Where special-category information is genuinely necessary, we will identify an appropriate additional condition under data protection law. We do not ask job applicants to provide unnecessary sensitive information in a general application.

5. Website-specific processing

Companies House search

When you use the company-search feature, the company name you enter is sent to the Companies House public API. The service returns public company information. If you select a result, the company name, company number and company type are used to help populate the business finance enquiry form. We do not send your enquiry contact details, message or IP address to Companies House as part of this search.

Rate limiting and security

We use your IP address as a short-lived rate-limit identifier to prevent spam, abuse and excessive automated requests. The plaintext IP address is temporarily stored in Upstash Redis in the UK (eu-west-2) and expires automatically with the applicable rate-limit window:

• up to 15 minutes for contact and business finance enquiry submissions; and
• up to 1 minute for Companies House search requests.

6. Who we share information with

We share personal information only where reasonably necessary for the relevant purpose. For a mortgage, insurance or protection enquiry sent through the general contact form, we share the name, email address, reason for contact and message with Capital Advisory Finance Ltd so it can respond and progress the request. It is a separate controller for its subsequent processing. Depending on the interaction or stage of a commercial finance application, other recipients may include:

• Potential or selected lenders and funders, and business-information, credit-reference, identity, fraud-prevention and due-diligence providers involved in assessing or progressing a finance application.
• Accountants, solicitors, valuers, surveyors, authorised representatives, introducers and other professionals involved in a transaction where necessary and lawful.
• Regulators, courts, law-enforcement bodies, tax authorities, auditors, insurers and legal advisers where disclosure is justified or legally required.
• A prospective buyer or successor if our business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.

Website and business service providers

Service providers acting on our behalf must handle information under appropriate contractual and security requirements. Capital Advisory Finance Ltd, lenders, credit-reference agencies, Companies House and some professional advisers act as independent controllers for their own processing and may provide their own privacy information.

We do not sell personal information or provide website enquiry information to third parties for their own advertising or marketing purposes.

7. Credit checks and automated decisions

Capital Commercial Finance Ltd does not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Job applications are reviewed by people; we do not use automated CV scoring or screening.

A lender or funder may carry out credit-reference, fraud-prevention or automated assessment processes under its own privacy notice. Where applicable, the lender or relevant provider is responsible for explaining its processing, whether a search is visible on a credit file, and any rights relating to automated decisions or human review.

8. International transfers

Our website hosting and Upstash Redis database are in the United Kingdom. Our Umami Cloud data region is EU / Frankfurt, and n8n states that n8n Cloud data is hosted in the European Union. Resend stores customer data in the United States, including message content, delivery logs, webhook payloads and account records. Other providers or their subprocessors may also store or access information outside the UK.

Transfers to the European Economic Area may be covered by UK adequacy regulations. For transfers elsewhere, we use an appropriate transfer mechanism where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard. Resend states that UK transfers to the United States are supported by the UK Addendum and its participation in the UK Extension to the EU-US Data Privacy Framework. You may contact us for further information about safeguards relevant to your information.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, accounting and claims requirements. Our normal retention periods below apply to information Capital Commercial Finance Ltd holds. Capital Advisory Finance Ltd sets out its own retention arrangements in its privacy information for enquiries it progresses.

We may retain particular information for longer where required by law or where necessary for an investigation, complaint, dispute or legal claim. Where information is no longer required, we delete or anonymise it securely. Copies downloaded or moved into internal business systems remain subject to the same retention principles.

10. Cookies and analytics technologies

Our website offers Essential only and Accept analytics choices. Umami Cloud analytics loads only after you select Accept analytics. The essential cfg_cookie_consent cookie remembers your choice for one year; its value is essential or all and does not identify you.

Where referral or campaign information is present, Umami may collect landing-page, referrer and URL-parameter information only after analytics consent. This may include utm_source, utm_medium, utm_campaign, ref, source and amount. These parameters are not currently included as separate attribution fields in the finance-enquiry record sent to n8n.

You can reopen Cookie settings from the website footer to change your choice. Selecting Essential only stops future optional analytics collection. You can also control cookies through your browser settings, although blocking necessary storage may affect website functions.

We do not currently use advertising or marketing cookies.

11. Your data protection rights

Depending on the circumstances and the lawful basis for processing, you may have the following rights:

• Right of access: Ask for a copy of personal information we hold about you and information about how it is used.
• Right to rectification: Ask us to correct inaccurate or incomplete personal information.
• Right to erasure: Ask us to delete personal information where the legal conditions for erasure are met. This right is not absolute, for example where we must keep information to comply with law or establish, exercise or defend legal claims.
• Right to restriction: Ask us to restrict how we use your information in certain circumstances.
• Right to data portability: Receive certain information you provided to us in a structured, commonly used, machine-readable format where the legal conditions apply.
• Right to object: Object to processing based on legitimate interests for reasons relating to your particular situation. You also have an absolute right to object to direct marketing if we ever carry it out.
• Right to withdraw consent: Withdraw consent at any time where we rely on consent, including optional analytics. Withdrawal does not affect processing that was lawful before consent was withdrawn.
• Rights relating to solely automated decisions: Ask for relevant safeguards where a significant decision is made solely by automated processing. We do not currently make such decisions ourselves.

You have the right to object to direct marketing at any time. You may also object to processing based on legitimate interests for reasons relating to your particular situation.

To exercise a right, contact Matthew Wood using the details in section 1. We may request proportionate proof of identity or authority. Rights requests are normally free of charge and we respond without undue delay and within the applicable legal period, normally one calendar month. Where a lawful extension or clarification rule applies, we will explain it to you.

12. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure. These measures include access controls, authentication, restricted access to lead records, secure cloud services, rate limiting and appropriate contractual arrangements with service providers.

No information system is completely risk-free. Suspected personal-data breaches are assessed and handled in accordance with applicable legal requirements.

13. Privacy complaints and the ICO

If you are concerned about how we have used your personal information, you can complain to us using the contact details in section 1. Please explain your concern and how we can contact you.

We will acknowledge a data protection complaint within 30 days of receiving it, take appropriate steps to investigate without undue delay, keep you informed where appropriate and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at any time. The ICO can be contacted through its complaints service or by telephone on 0303 123 1113. We would appreciate the opportunity to address your concern first, but this does not affect your right to complain to the ICO.

14. Changes to this notice

We may update this notice when our website, services, suppliers, data flows or legal obligations change. The current version will be published on our website with its last-updated date.

If you need this notice in another format or have questions about any part of it, contact the Data Protection Lead using the details in section 1.