Privacy Notice

Who we are

We are Inclusive Finance Limited, trading as Creditspring (" we ", " us ", " our "). We are a private limited company, and our registered company number is 10522518. Our registered office is 86-90 Paul Street, LONDON, EC2A 4NE

We are registered with the Information Commissioner's Office (" ICO ") with registration number: ZA252803. We are the data controller of any personal data you provide to us and are subject to any applicable data protection laws.

This notice explains how and why we use your personal information.

Changes to this Privacy Notice

Version date: 15 July 2026

We reserve the right to modify this Privacy Notice at any time. Any changes we may make to our Privacy Notice will be made available to you through this page on our website.

The personal data we collect about you

You can browse our website as a guest.

We collect information by using cookies. Please see our Cookies Notice which explains what cookies we use on our website, why we use them and how you can control them.

Additional services are available once you register with us and login to our website. In this case, we will know who you are, your activities on our website and information about your computer may be linked to you on our systems. We may retain copies of any correspondence you send us, details of your registration history and any materials you post or upload to the Creditspring website.

We also store data that you submit to us via email and through our contact form and email subscription sign-up form on our website.

Our website and services are not intended for children, and we do not knowingly collect personal data relating to children.

What information do we collect from website users?

We may collect and process the following personal information from you:

• Identity Data - information that you provide by filling in forms on our website. This includes your first name, maiden name, last name, title, date of birth and gender.
• Profile Data - information provided at the time of registering to use our website, such as your username and password. You may also choose to provide additional personal data to us after you have created your profile.
• Contact Data - information including your billing address, delivery address, email address and telephone numbers. If you contact us, we may keep a record of that correspondence.
• Financial Data - information including your bank account details, payment card details, spending habits and other information required to undertake underwriting and credit reference agency checks
• Marketing and Communications Data - includes
  • your preference in receiving marketing from us and our third parties, and
  • any information you provide when you respond to surveys we use for marketing, PR and research purposes, for example, to understand customer experiences, gather views on financial topics relevant to our customer base, and produce content, case studies or campaign materials based on the responses. Participation is optional, and we may offer incentives such as prize draws to encourage participation.
  • We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them. We may also ask you for information when you report a problem with our website.
• Usage Data - details of your visit to the website, page response times, lengths of visit, transactions you carry out through our website and of the fulfilment of orders. This also includes your account sign-up timestamp and patterns associated with your application.
• Technical Data - details of your visits to the website including, but not limited to, login information, browser type and version, traffic data, location data, weblogs and other communication data, IP address, device fingerprint (a combination of your device's hardware specifications, browser attributes, and persistent device identifiers), email and mobile intelligence signals, and the resources that You access.

We may also collect 'special category data' which is personal information that needs more protection because it is sensitive including:

• physical or mental health details;
• offences and alleged offences; and
• criminal proceedings, outcomes and sentences.

Information from other sources

We may also check information about you held on our own records and also obtain information from credit reference agencies about you and your financial associates' personal credit behaviour and personal credit accounts.

We may also search at fraud prevention agencies for information on you and your financial associates and business partners.

We may receive information about you from service providers including:

• third parties that introduce you to us
• third parties you request services from who we referred you to; and/or
• suppliers of marketing lists.

Purposes and lawful basis to process your personal data

We have set out below, in a table format, a description of all the ways we use your personal data as stated above, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data.

Who we may share your data with

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006 (where applicable).

Notwithstanding any terms to the contrary, we may disclose your personal data to third parties only where strictly necessary for the purposes set out above, including:

• other entities who are affiliated to us;
• credit reference and fraud prevention agencies;
• public, regulatory and governmental authorities and agencies where required by law;
• courts and tribunals;
• service providers;
• professional bodies, advisers and consultants;
• our own finance providers and investors, agents and trustees acting in connection with our financing arrangements;
• credit brokers and other third parties that you request services from directly via our arrangement with them;
• third party companies or individuals to assist us with fraud prevention and risk assessment, to assist us with customer service, and to facilitate the payments or reimbursements of fees you request;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

Most of these third parties will only process the data on our behalf to provide services to us. However, some will make use of your data for their own purposes. Sometimes this is so they can comply with their own legal obligations, other times it's to improve their own products and services or to troubleshoot issues.

Some of our third-party fraud screening providers may also use aggregated or anonymised data derived from your application as independent controllers, for the limited purpose of developing and improving their fraud detection models. Where they do so, they are subject to their own privacy notices, which we can provide on request.

For transparency, here are links to the fair processing notices of selected third-party data controllers we work with:

• The Hoxton Mix Limited (Virtual Office & Mail Sorting): help.hoxtonmix.com/en/article/privacy-policy-4bp798/
• SEON Technologies Limited (Fraud Screening & Digital Footprint Analysis): seon.io/legal-and-security/privacy/
• Alternative Payments Limited (Card Payments): www.judopay.com/privacy-notice/privacy-policy
• GoCardless Limited (Direct Debit Collections): gocardless.com/privacy/payers

What credit reference and fraud prevention agencies do

When a credit reference agency receives an initial search from us they will leave a "footprint" on your credit file. However, this footprint will only be visible to you and us.

If you accept our offer of a loan, we will perform a full credit search which will leave a visible credit search "footprint" on your credit file. If the search was for a credit application, the record of that search (but not the name of the organisation that carried it out) may be seen by other organisations when you apply for credit in the future.

A credit reference agency will link together the previous and subsequent names advised by you of anyone that is a party to the account.

Credit reference agencies supply the following information to us:

• information about you, such as previous applications for credit and similar personal credit information in your name or in relation to your financial associates and business partners
• details of any financial sanctions imposed by the United Kingdom government which are applicable to you;
• public information such as County Court Judgments (CCJs) and bankruptcies;
• electoral register information on you and your business partners; and
• fraud prevention information.

Credit reference agencies will keep records of outstanding debt on file for six years after they are closed, whether settled by you or defaulted.

The information which we and other organisations provide to the credit reference agencies and fraud prevention agencies about you, your financial associates, your business partners and details about your business may be supplied by credit reference agencies and fraud prevention agencies to other organisations and used by them to:

• prevent crime, fraud and money laundering by, for example checking details provided on applications for credit and credit related or other facilities;
• check the operation of credit and credit-related accounts;
• verify your identity if you, your financial associates or your business partner(s) apply for other facilities; electoral register information on you and your business partners; and
• make decisions on credit and credit related services about you, your financial associates and/or your business partners, or your business;
• manage your personal account(s), your financial associate's account(s), Your business partner's and/or business credit or credit related account(s);
• trace your whereabouts and recover debts that you owe;
• conduct other checks to prevent or detect fraud; and
• undertake statistical analysis and system testing.

If false or inaccurate information is provided by you and fraud is identified we will record this and details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

• checking details on applications for credit and credit related or other facilities;
• managing credit and credit related accounts or facilities;
• recovering debt;
• checking details on proposals and claims for all types of insurance; and
• checking details of job applicants and employees.

Please contact us if you want to receive details of the relevant fraud prevention agencies. We and other organisations may access and use from other countries the information recorded by fraud prevention agencies.

The identities of the credit reference agencies, and the ways in which they use and share personal information, are explained in more detail at:

• www.experian.co.uk/crain
• www.equifax.co.uk/privacy-hub/crain
• www.transunion.co.uk/legal/privacy-centre/pc-credit-reference

Where we store your personal data and our security measures

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us, one of our affiliates or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. Where we transfer your personal data outside the United Kingdom, we ensure a similar degree of protection by relying on an appropriate safeguard, such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), or by transferring to a country the UK government has deemed to provide adequate protection. You can request a copy of the relevant safeguard by contacting us using the details in the "Contacting Us" section below. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted.

We take appropriate measures to ensure that any personal data is kept secure and for the duration of your use of our services. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data when transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

If your personal details change, we ask you to update them by accessing the relevant page of the website or by contacting us using the contact details in the “Contacting Us” section at the bottom of this Privacy Notice.

We'll keep your personal information for as long as is necessary for the purposes specified in this Privacy Notice. The criteria that we use to determine the period for which we retain personal information include:

• Legal and regulatory requirements and guidance;
• Limitation periods that apply in respect of taking legal action;
• Our ability to defend ourselves against legal claims and complaints; and
• The operational requirements of our business.

These reasons vary from one piece of information to the next depending on the products and/or services you have signed up for, so the amount of time we keep your personal information for may vary.

Creditspring may use Artificial Intelligence and Machine Learning technologies to support the delivery of our services and improve operational efficiency.

We may apply Artificial Intelligence or Machine Learning in the following ways:

• Customer Service Enhancement: To interact with customers and analyse such interactions (e.g. calls, chats) for training, quality assurance and service improvement.
• Operational Analytics: To better understand user behaviour and improve our platform's performance and user experience.
• Underwriting and Credit Decisioning: To assess creditworthiness and eligibility as part of our credit checks. Where this involves automated-decision making, your rights are set out in the “Automated Decisions – Your Rights” section below.

It is important that the personal data we hold about you is accurate and current.  Please keep us informed if your personal data changes during your engagement with us.

Where we are acting as a Data Controller, and under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a Data Subject Access Request (DSAR)). This enables you to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you.  This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data.  This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground.  You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you.
• Request the transfer of your personal data to another party.
• Right to withdraw consent. In the circumstances where we are processing your data on the basis of consent you have provided us, and we have no other legal justification or obligation to continue the processing, you have the right to withdraw your consent for that specific processing at any time.

For your protection and to protect the privacy of others, we may need to verify your identity before completing your request.

If you object to us using your personal data or withdraw consent for us to use your personal data (when we are processing your personal data based on your consent) after initially giving it to us, we will respect your choice in line with applicable law.

If you would like to exercise any of these rights or would like to confirm the accuracy of your information, please contact us using the contact details in the “Contacting Us” section at the bottom of this Privacy Notice.

We may use automated processes to make decisions about credit applications. These include:

• credit scoring to assess your creditworthiness using information you provide and information from credit reference agencies; and
• fraud screening to verify your identity and protect us against fraudulent activity

These automated outputs feed into our decision on whether to approve your application. Because these decisions can have a significant effect on you, you have the right under Article 22 of the UK GDPR to:

• obtain meaningful information about the logic involved;
• ask for the decision to be reviewed by a member of our team rather than relying solely on the automated process; and contest the decision.

To exercise any of these rights, please contact us using the details in the "Contacting Us" section.

These rights will not apply in all circumstances, for example where the decision is authorised or required by law and steps have been taken to safeguard your interests.

Complaints

If you are unhappy with how we have handled your personal data or how we have responded to a request to exercise your rights, you have the right to complain to us. You can do so by contacting our Data Protection Officer using the details in the “Contacting Us” section below.

When you make a data protection complaint to us, we will:

• Acknowledge receipt of your complaint within 30 days;
• Take appropriate steps to respond to your complaint, our response will usully be within 45 days of our acknowledgement; and
• Inform you of the outcome of your complaint.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO). You can do this via phone on 0303 123 1113 or online at ico.org.uk/make-a-complaint..

The ICO will normally expect you to have raised your concerns with us first and give us a reasonable opportunity to respond (usually around 45 days) before it takes further action on your complaint. We would therefore appreciate the chance to deal with your concerns directly before you approach the ICO.

Please take a look at some helpful guidance on ICO website which can be found here.

Contacting us

If you have any questions about this Privacy Notice or your information, or to exercise any of your rights as described in this Privacy Notice or under any applicable data protection laws, you can contact us or our appointed Data Protection Officer (“DPO”):

• By form: The Creditspring Data Protection Officer, following this link.
• By post:

  The Creditspring Data Protection Officer
  86-90 Paul Street
  LONDON
  EC2A 4NE