1. Who We Are

ukbusinesslending.com is operated by Ulist Pty Ltd T/A Uleads Digital ("we", "us", "our"), a company registered in Australia. We operate a lead generation platform that connects UK businesses with relevant third-party business lending providers.

We process personal data relating to individuals in the United Kingdom. For the purposes of UK data protection law, we act as the Data Controller in respect of personal data collected through this website. This policy explains how we collect, use, share, and protect that data, and sets out your rights under UK law.

2. Definitions

• Service: The ukbusinesslending.com website and platform operated by Ulist Pty Ltd T/A Uleads Digital.
• Personal Data / Personal Information: Any information relating to an identified or identifiable individual.
• Usage Data: Data collected automatically from your use of the Service (e.g. pages visited, time spent, IP address).
• Cookies: Small files stored on your device to help us operate and improve our Service.
• Data Controller: The entity that determines the purposes and means of processing personal data. We are the Data Controller for personal data collected through our Service.
• Data Processor / Service Provider: A third party that processes data on our behalf under our instructions.
• Lead: A record created when you submit an enquiry through our platform.
• Provider: A third-party lender or finance broker to whom we may pass your enquiry details.

3. Our Services

We provide a business loan lead generation service. This includes:

• Connecting UK businesses with lenders and finance brokers for business loan enquiries
• Matching enquiries to relevant providers based on loan requirements and business profile
• Sending relevant offers, updates, and insights related to business finance
• Facilitating follow-up contact by lenders and brokers on your behalf

We do not make lending decisions. We are a lead generation intermediary only. Any lending decision is made solely by the third-party provider you are connected with.

4. How Our Services Work (IMPORTANT)

Our platform uses automated systems to score and prioritise leads and to match your enquiry with suitable lending providers.

If an automated decision has a legal or similarly significant effect on you (for example, a decision that materially affects your ability to be connected with a lender), you have the right to request a human review, to obtain an explanation of the decision, and to contest the outcome. To request a review contact [email protected]. We will acknowledge requests within 5 business days and respond substantively within 30 calendar days.

When you submit a form:

• You provide your business and contact details along with your loan requirements
• We assess your request (including automated processing where applicable)
• We match you with relevant third-party lenders or brokers
• Your details are shared with those providers
• Providers may contact you directly by:
  • Phone
  • Email
  • SMS or messaging apps (e.g. WhatsApp)

In some cases we may contact you first to confirm your details, or you may be redirected directly to a provider's website.

5. What Personal Information We Collect

a) Information you provide

• Name, email address, phone number
• Business address or postcode
• Business name, legal structure, and industry
• Time in business and number of employees
• Annual turnover and monthly revenue (where requested)
• Loan amount required and purpose of the loan
• Any additional information submitted as part of your enquiry

b) Automatically collected data

• IP address
• Device and browser information
• Usage behaviour and pages visited
• Cookies and tracking data

c) Additional data sources

• Marketing partners
• Data enrichment providers
• Publicly available data (e.g. Companies House)

d) Lead generation-specific data

• Partially completed form data
• Lead scoring and profiling data
• Disposition data (e.g. whether a loan was taken up with a provider)

e) Call Recording

Some providers you are connected with through our platform may record calls for quality assurance, training, fraud prevention, and dispute resolution purposes. Please refer to the relevant provider's privacy policy for details on how they handle call recordings.

6. How We Use Your Information

We use your data for:

Core services

• Matching your business with relevant lending providers
• Delivering your enquiry to suitable lenders or brokers

Lead distribution

• Sharing your details with providers so they can contact you about your loan enquiry

Verification and fraud prevention

• Ensuring submissions are genuine
• Preventing duplicate or fraudulent leads

Communications

• Responding to enquiries
• Customer support and feedback

Marketing and advertising

• Sending relevant offers related to business finance products
• Creating custom and lookalike audiences for digital advertising
• Measuring campaign performance

Service improvement

• Analytics and user behaviour insights
• Lead scoring and optimisation

7. Legal Basis for Processing

We process your personal data under the UK GDPR and the Data Protection Act 2018. Our lawful basis for each processing activity is set out below:

Processing Activity	UK GDPR Lawful Basis	Notes
Collecting form data to fulfil enquiries	Contract; Legitimate interests	Necessary to provide the service requested
Sharing leads with third-party lenders/brokers	Contract; Legitimate interests	Core purpose of the service; disclosed at point of collection
Marketing communications (email, SMS, phone)	Consent; Legitimate interests	Subject to UK PECR where applicable; opt-out available at any time
Automated matching and lead scoring	Legitimate interests	ICO guidance on automated processing applies
Fraud prevention and verification	Legitimate interests; Legal obligation
Analytics and advertising measurement	Consent; Legitimate interests	Cookie consent applies to tracking technologies
Cross-border transfers (to Australia)	Art. 46 UK GDPR safeguards	Standard contractual clauses or equivalent protections
Data subject access, correction, deletion	Legal obligation	Art. 15–22 UK GDPR; ICO guidance
Backups and disaster recovery	Legitimate interests	Art. 32 UK GDPR security obligation

8. Contacting You (Calls, SMS, AI)

When you provide your contact details, we or the providers we connect you with may contact you via phone calls, SMS, messaging platforms (e.g. WhatsApp), and email. This may include manual contact by our team or automated and AI-assisted tools.

You can opt out at any time by following the unsubscribe instructions in any message or contacting us at [email protected].

We comply with the Privacy and Electronic Communications Regulations (PECR) for all electronic marketing communications sent to individuals in the United Kingdom. All marketing messages will clearly identify us as the sender and include a functional unsubscribe mechanism. We will not send unsolicited direct marketing by electronic means without the appropriate legal basis to do so.

9. Sharing Your Personal Information

We may share your data with:

a) Service providers

(e.g. hosting, CRM, analytics providers, data enrichment or validation partners)

b) Third-party lenders and brokers (key function)

When you submit an enquiry, your data is shared with relevant lending providers who may contact you directly. These providers act as independent data controllers in respect of your data and have their own privacy policies. We recommend reviewing the privacy policy of any lender or broker that contacts you.

When your data is passed to a lending provider, that provider may also report your application outcome and loan status back to us. This may include information about whether an application was approved, declined, or funded.

c) Credit reference agencies and fraud prevention agencies

When your details are shared with lending providers, those providers will typically conduct credit and identity checks on you and/or your business using one or more of the following credit reference agencies (CRAs):

• Equifax — CRAIN notice
• Experian — CRAIN notice
• TransUnion — CRAIN notice

These checks are typically soft searches and will not affect your credit score. However, if you proceed to a full loan application with a provider, a hard credit search may be conducted, which will be visible on your credit file.

Lending providers will also carry out checks with fraud prevention agencies to verify your identity and prevent money laundering. If fraud or money laundering risk is identified, you or others may be refused services, finance, or employment. Records of any such risk may be retained by fraud prevention agencies for up to six years. This is standard practice across UK business lending and applies regardless of whether fraud is detected.

d) Automated decision-making by lenders

Some of the lenders and brokers we work with use automated systems to make or assist in lending decisions — including whether to lend, how much to lend, at what rate, and on what terms. These are decisions made by the provider, not by UK Business Lending. If you wish to challenge an automated lending decision or request human review, you should contact the relevant lender directly using the contact details in their privacy policy.

e) Our lending panel

The following table lists the lending providers and brokers we currently work with, along with links to their privacy policies. This list may be updated as our panel changes.

Provider	Type	Privacy Policy
iwoca Ltd	Business lender	iwoca Privacy Policy
Bizcap (UK)	Business lender	Bizcap Privacy Policy
Additional providers will be listed here as our panel grows.

f) Advertising platforms

(e.g. Google, Meta). We may share pseudonymised data to measure campaign performance and build custom or lookalike audiences.

g) Business transactions

If Ulist Pty Ltd T/A Uleads Digital is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

h) Law enforcement

We may disclose your data where required by law or in response to valid requests by public authorities (e.g. a court or government agency), or where we believe disclosure is necessary to protect rights, property, or safety.

10. International Transfers

Our platform is operated by an Australian company, and your data may be transferred to and processed in Australia and other countries where our service providers operate. Some of these countries may not have data protection laws equivalent to those in the United Kingdom.

Where we transfer personal data outside the UK, we take appropriate steps to ensure your data remains protected in accordance with UK GDPR, including the use of the International Data Transfer Agreement (IDTA), standard contractual clauses, or other recognised safeguards approved by the Information Commissioner's Office (ICO).

Contact [email protected] for information about the specific safeguards in place for any given transfer.

11. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected and to meet our legal obligations.

Data Type	Retention Period
Lead/enquiry data	Up to 4 years
Marketing contact data	Until opt-out or 12 months inactivity
Partial form data	24 hours (backups up to 30 days)
Web analytics data	Up to 26 months

We securely delete or de-identify data when it is no longer required.

12. Cookies and Tracking

We use cookies, event tracking technologies, and advertising identifiers for website functionality, analytics, and advertising attribution. Cookie types include:

• Strictly Necessary Cookies — required for the Service to function and cannot be disabled
• Preference Cookies — to remember your preferences and settings
• Security Cookies — for security and fraud prevention
• Analytics Cookies — to understand how visitors interact with our website
• Marketing / Advertising Cookies — used for remarketing and to measure campaign performance

Under UK PECR, we will seek your consent before placing non-essential cookies on your device. You can manage or withdraw consent at any time through our cookie consent tool or via your browser settings. Note that disabling certain cookies may affect the functionality of our website.

13. Service Providers

We work with third-party service providers who process data on our behalf. These providers only have access to your data to perform specific tasks and are contractually obligated not to use it for any other purpose.

Analytics: We use Google Analytics to monitor and analyse use of our Service. You can opt out by installing the Google Analytics Opt-out Browser Add-on. See Google's Privacy Policy for more.

Behavioural Remarketing: We use remarketing services including Google Ads and Meta (Facebook) to advertise to you on third-party websites. You can opt out of personalised Google advertising at google.com/settings/ads and manage Facebook advertising preferences at facebook.com/help.

We conduct security reviews before onboarding vendors and take reasonable steps to ensure third parties handle personal data appropriately and in accordance with UK GDPR.

14. Security

We implement appropriate technical, organisational, and physical measures to protect your data, including:

• Encryption in transit (TLS 1.2 or higher) and at rest
• Access controls and least-privilege authentication
• Multi-factor authentication for administrative access
• Firewall protections and anomalous access monitoring
• Incident response procedures for detecting, reporting, and addressing data breaches

In the event of a personal data breach we will contain and remediate the incident promptly and, where required, notify the Information Commissioner's Office (ICO) within 72 hours and affected individuals without undue delay. No method of transmission over the internet is 100% secure. If you believe your interaction with us is no longer secure, please notify us immediately at [email protected].

15. Children's Privacy

Our Service is intended solely for use by business owners and authorised representatives aged 18 or over. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will take prompt steps to remove that information.

16. Your Rights (UK)

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected]. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days (or as required by law).

• Right of access — request a copy of the personal data we hold about you (Subject Access Request)
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data in certain circumstances ("right to be forgotten")
• Right to restriction of processing — request that we limit how we use your data in certain circumstances
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format
• Right to object — object to processing based on legitimate interests or to direct marketing at any time
• Rights related to automated decision-making — not to be subject to a decision based solely on automated processing that produces a significant effect on you, and to request human review of such decisions
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

If you are not satisfied with our response to a complaint or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Changes to This Policy

We may update this Privacy Policy periodically. The latest version will always be published at ukbusinesslending.com/privacy-policy with a revised effective date. We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to notify you.

18. Contact Us

For any privacy-related queries or to exercise your rights:

• Email: [email protected]
• Mail: Ulist Pty Ltd T/A Uleads Digital, Level 2/89 McLachlan St, Fortitude Valley QLD 4006, Queensland, Australia

We will acknowledge all requests within 5 business days and respond substantively within 30 calendar days.