Privacy notice

Privacy Notice

Effective from: 1^st October 2026 (Version 5.0)

This Privacy Notice explains how Reward Finance Group Limited, referred to in this notice as “Reward”, “we”, “us” or “our”, collects and uses personal information. It applies when you apply for, receive or support business finance; provide a guarantee or security; act for a customer, supplier or introducer; visit our website; communicate with us; or otherwise interact with Reward.

This notice is provided for transparency. You do not consent to all of our processing merely by visiting our website or giving us information. Where we rely on consent for a specific activity, such as non-essential cookies, we will ask you separately and you may withdraw it at any time.

This general Privacy Notice should be read together with any specific privacy information or fair-processing notice we provide for a particular activity, product, credit-reference or fraud-prevention check. Those notices supplement this document and may provide more detailed information about the relevant processing.

1. Who is responsible for your information?

Reward Finance Group Limited, company number 07385919 and ICO registration number ZB540835, is the principal data controller responsible for the personal information covered by this Privacy Notice.

Customers enter into their relevant agreements and relationships with Reward Finance Group Limited.

Other companies within the Reward group may receive or process personal information where they support Reward Finance Group Limited, administer a relevant activity or participate in funding arrangements. Further information about these companies and how they may be involved is provided in section 11.

Depending on the activity, another Reward group company may act as a processor acting on our instructions, as a separate controller, or jointly with us as a joint controller. Where another company acts as a controller or joint controller and further information is required, we will explain its role and provide appropriate contact information.

2. How to contact us

If you have a question, want to exercise a data protection right or wish to complain about how we use your information, please contact:

Contact	Details
Email	privacy@rewardfunding.co.uk
Post	Data Protection Officer, Reward Finance Group, 1st Floor, 12 King Street, Leeds, England, LS1 2HL
Website	www.rewardfunding.co.uk

Reward has appointed Tim Stafford as its Data Protection Officer (DPO), supported by Stephen Thomas as Deputy Data Protection Officer. They oversee Reward’s data protection compliance and act as the central contact for data protection matters.

3. Whose information we use

Applicants, customers and prospective customers, including sole traders where relevant;
Directors, shareholders, partners, members, trustees, beneficial owners, persons with significant control and other people connected with a business;
Guarantors, indemnifiers, security providers, property owners and occupiers;
Children whose limited personal information is relevant to a trust, property ownership or security arrangement connected with a loan;
Representatives, employees, agents and professional advisers of customers and counterparties;
Brokers, introducers, suppliers, service providers and other professional contacts;
People who contact us, make a complaint, exercise a right, visit our website or receive business communications; and
Other individuals whose information is relevant to fraud prevention, financial crime checks, recoveries, disputes or legal proceedings.

4. The information we use

Depending on the relationship and what is necessary, we may use the following categories of personal information:

Category	Examples
Identity and contact	Name, date of birth, addresses, contact details, nationality, signature, photographic identification and proof of address.
Business role and ownership	Directorships, employment, professional role, shareholding, beneficial ownership, PSC status, authority to act and ownership or control structures.
Financial and banking	Bank account details, statements, income, assets, liabilities, tax and accounting information, source of funds or wealth and affordability-related information where relevant.
Credit and insolvency	Credit searches, credit history, court judgments, insolvency events, repayment history, credit scores and assessments.
Property, assets and security	Ownership, valuations, property inspection reports and photographs, charges, insurance, tenancy or occupancy information, asset details and guarantee or security documentation.
Application and facility	Funding requirements, purpose, terms, underwriting information, risk ratings, decisions, conditions, drawdowns, payments and account administration.
AML, Financial crime and Fraud	CDD and verification results, sanctions and PEP checks, adverse media, fraud indicators, CIFAS information, suspicious activity and investigation records.
Communications and opinions	Emails, letters, meeting notes, telephone records or recordings where used, complaints, reviews and internal professional opinions or decision rationales.
Technical and website	IP address, device and browser information, cookie identifiers, website activity, security logs and consent preferences.
Marketing and preferences	Business interests, event or campaign engagement, communication preferences, objections and suppression records.
Children connected with trusts or security	Limited identifying information, normally a child’s name, age and address, where relevant to a trust, property or security arrangement connected with a loan.
Special category or vulnerability	Limited health or vulnerability information disclosed or obtained where needed to provide support, manage recoveries or handle a complaint or legal matter.
Criminal offence information	Allegations, suspected fraud, criminal conduct, convictions or related security measures where relevant and lawfully processed.

We do not ordinarily seek special category information as part of our commercial lending activities, and we do not offer products or services directly to children. However, we may collect limited information about a child, normally their name, age and address, where this is necessary in connection with security for a loan. This may include circumstances where property is held in trust, a child is named in trust documentation or a child’s interest is relevant to a property or security arrangement.

We will only use this information where it is necessary and lawful for the relevant trust, property or security purpose. We will limit access to the information and will minimise, remove or delete it when it is no longer required. We will not use a child’s information for marketing or to assess the child as a borrower.

5. Where we obtain information

We obtain information directly from you and from other sources where this is necessary and lawful. These may include:

An applicant, customer, guarantor, security provider or another person connected with the application or facility;
Brokers, introducers, accountants, solicitors, valuers, surveyors, property inspection and field-agent service providers, insolvency practitioners and other advisers;
Companies House, HM Land Registry, court and insolvency records, electoral information and other public registers;
Credit reference agencies, CIFAS and other fraud prevention agencies;
Identity verification, AML, sanctions, PEP and adverse-media screening providers;
Banks, funders, insurers, security trustees, assignees and payment providers;
Law enforcement bodies, regulators, public authorities and tax authorities;
Reward group companies, existing records and people authorised to act for you; and
Publicly accessible websites, search engines, media sources and website or cookie technologies.

6. Keeping your information accurate

We take reasonable steps to ensure that the personal information we use is accurate and, where necessary, kept up to date. Please tell us if information you have provided has changed during your relationship with Reward. We may also verify or update information using appropriate internal and external sources.

7. Why we use information and our lawful bases

We only use personal information where we have a lawful basis and where the processing is necessary for a defined purpose. More than one lawful basis may apply to different uses of information within the same relationship.

We may use personal information to:

Receive, assess and determine applications for finance;
Verify identity, authority, ownership and control;
Assess creditworthiness, affordability and lending risk;
Inspect, value and verify property, assets and security offered or connected with an application or facility;
Conduct fraud, anti-money laundering, sanctions, PEP and other financial-crime checks;
Document, administer, monitor, vary and enforce facilities, guarantees and security;
Process payments and manage customer accounts and relationships;
Deal with enquiries, complaints, data protection requests, disputes and legal claims;
Maintain the security and operation of our systems and business;
Obtain customer feedback and conduct appropriate business-to-business marketing; and
Meet our legal, regulatory, accounting, taxation and reporting obligations.

The table below explains the principal lawful bases on which we rely.

Lawful basis	How it may apply
Contract	Where an individual is personally party to an agreement or asks us to take steps before entering one. It does not automatically apply to a director merely because the borrower is a company.
Legal obligation	Where processing is necessary to meet legal duties, including applicable AML, sanctions, accounting, tax, regulatory, court and record-keeping obligations.
Legitimate interests	For proportionate commercial lending assessment, relationship and facility management, security, recoveries, legal claims, business security, supplier management and appropriate business-to-business marketing. We consider necessity, reasonable expectations and the impact on individuals.
Recognised legitimate interests	Where processing is necessary for a purpose listed in UK GDPR Annex 1, most likely detecting, investigating or preventing crime. We will identify and document the relevant listed purpose and will not use this basis for ordinary lending or relationship management.
Consent	For genuinely optional processing where we ask for a specific choice, including non-essential cookies where required. Consent may be withdrawn at any time.
Additional conditions for sensitive information	Where we process special category or criminal offence information, we must identify an appropriate Article 6 lawful basis and satisfy the additional conditions under Articles 9 or 10 of the UK GDPR and the Data Protection Act 2018.
Vital interests	In rare emergency circumstances where processing is necessary to protect the life of an individual or another person and the relevant interests cannot reasonably be protected in a less intrusive way. Reward does not rely on vital interests for routine lending, underwriting or relationship-management activities.

We maintain more detailed records of our processing activities. You may contact us at privacy@rewardfunding.co.uk to request further information about the processing activities relevant to your personal information, including the purposes, information involved, lawful bases, recipients and applicable retention arrangements.

8. Credit reference and fraud prevention agencies

We may carry out identity, creditworthiness, affordability, financial crime and fraud checks before and during a relationship. We may provide personal information to credit reference agencies and fraud prevention agencies, including CIFAS, and receive information from them. They may keep a record of searches, whether an application proceeds, and may link records relating to financial associates or connected businesses where lawful.

Where a facility proceeds, we may continue to exchange information with credit reference agencies during and after the relationship. This may include information about account performance, payments, settled accounts and sums that are not repaid on time. Credit reference agencies may retain search and account information and share it with other organisations for purposes explained in their own privacy information.

We and those agencies use this information to verify identity, assess applications and risk, prevent and detect fraud, money laundering and other crime, manage facilities and debts, and comply with legal duties. Fraud prevention records may affect access to finance or other services. Law enforcement bodies may access and use relevant information where permitted by law.

We will use the current fair processing wording required by each agency and make it available with this notice. CIFAS provides further information about how member organisations and fraud prevention agencies use personal data.

CIFAS Fair Processing Notice

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 742313.
TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority. FCA Firm Reference Number: 737740.

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

Creditsafe Privacy / Transparency Notice:
Transparency Notice | Customers & Suppliers

TransUnion Bureau Privacy Notice:
https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

9. Special category and criminal offence information

We do not ordinarily request sensitive personal information as part of commercial lending. We may, however, receive limited health or vulnerability information, particularly where someone asks for support or where it is relevant to a recovery, complaint, dispute or legal claim. We will restrict access, use only what is necessary and retain it only for as long as the relevant need continues.

Where we use special category information, we require both Article 6 lawful basis and an Article 9 condition. Depending on the circumstances, this may include explicit consent, establishing, exercising or defending legal claims, or another condition permitted by the Data Protection Act 2018. We will tell you where a specific condition or consent is required.

We may process criminal offence or suspected unlawful activity information for fraud prevention, AML, sanctions, investigations, security and legal claims. This requires Article 6 basis and authority under Article 10 and the Data Protection Act 2018, including applicable conditions relating to preventing or detecting unlawful acts and fraud prevention.

10. Profiling and automated decision-making

We may combine information from applications, credit reference agencies, screening providers, public sources and our own records to assess credit, fraud, financial crime and operational risk. This may amount to profiling because it involves evaluating aspects of a person or their connection with a business.

Reward does not make decisions producing legal or similarly significant effects about individuals solely by automated processing. Electronic systems, credit-reference information, screening tools and internal risk indicators may support our assessment, but relevant results are reviewed by appropriately authorised personnel and decisions involve meaningful human consideration.

If we introduce significant solely automated decision-making, we will update this notice and provide the information and safeguards required by law, including an opportunity to make representations, obtain human intervention and challenge the decision.

11. Who we share information with

We share only what is necessary and require appropriate confidentiality, security and data protection arrangements. Depending on the circumstances, recipients may include:

Other Reward group companies providing operational, finance, compliance, technology, risk or administrative support;
Credit reference agencies, CIFAS and other fraud prevention agencies;
Identity verification, AML, sanctions, PEP, adverse-media and due-diligence providers;
Funders, insurers, security trustees, participants, assignees and prospective purchasers of a facility or portfolio;
Brokers, introducers and professional advisers acting in connection with an application or facility;
Banks, payment providers, accountants, auditors, solicitors, valuers, surveyors, property inspection and field-agent service providers and other asset professionals;
Courts, enforcement agents, tracing agents, debt-recovery providers and insolvency practitioners;
The FCA, ICO, NCA, OFSI, HMRC, law enforcement bodies and other regulators or public authorities where required or permitted;
IT, cloud, communications, hosting, security, document management, analytics and customer-review service providers; and
Potential purchasers, investors and advisers in connection with a corporate transaction, restructuring or portfolio transfer.

Some recipients act as our processors, while others determine their own purposes and act as independent controllers. We may provide further privacy information where this distinction is important.

Reward group companies

Where relevant and necessary, Reward Finance Group Limited may share personal information with the following Reward group companies:

Reward group company	Company number	ICO registration	Relevant activity
Reward Capital Limited	09432492	ZA104349	May support commercial lending and related group activities.
Reward Invoice Finance Limited	09432479	ZA104340	Manages the residual invoice finance portfolio and may process information relevant to that portfolio.
Reward Capital (A) Limited	13558424	ZB542173	Group company that may support relevant funding or operational arrangements.
Reward Invoice Finance (A) Limited	13558429	ZB542175	Group company that may support relevant funding or operational arrangements.
Reward SPV1 Ltd	12373901	ZB542237	Special-purpose group company associated with funding arrangements. Personal information will only be shared where this is necessary for the relevant arrangement.
Reward SPV2 Ltd	12518501	ZB542241	Special-purpose group company associated with funding arrangements. Personal information will only be shared where this is necessary for the relevant arrangement.
Reward Asset Finance Ltd	13919550	ZB664453	Group company that may support asset finance and related group activities.

The involvement and data protection role of each company depends on the particular activity. A company may act as our processor, as a separate controller or jointly with us. We only share personal information with another group company where there is a lawful and necessary reason to do so, and we will provide further information where required

12. International transfers

Reward is based in the UK. Some service providers, group connections or recipients may nevertheless process personal information, use subprocessors or permit support access outside the UK. An international customer or overseas business connection does not by itself mean that we transfer information outside the UK; the issue is whether information is sent or made accessible abroad.

Where we make a restricted transfer, we will use a lawful mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another safeguard permitted by UK data protection law. We will carry out any required transfer risk assessment and apply supplementary protections where appropriate. You may contact us for more information about the relevant safeguard and how to obtain a copy, subject to lawful redactions.

13. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, regulatory, accounting, taxation, fraud-prevention, evidential and limitation requirements.

Where an application proceeds and a customer enters into a facility or other business relationship with Reward, we will normally retain the customer file and associated personal information for six years from the end of our contractual or business relationship. This period will normally run from the latest relevant date, such as final repayment or closure of the facility, release or discharge of any guarantee or security, or the end of our other dealings with the customer.

Where an application, enquiry or proposed transaction does not proceed, we will normally retain the associated personal information for 24 months from the date on which the application or enquiry is closed or from our last meaningful contact, whichever is later.

In particular circumstances, we may retain information for longer where this is necessary and lawful. This may include where information is required for a complaint, investigation, fraud-prevention purpose, litigation, enforcement action, legal claim, legal hold or another legal or regulatory obligation. Conversely, we may delete or minimise particular information sooner where it is no longer necessary, especially sensitive, vulnerability or children’s information.

Some records may be subject to a specific statutory, regulatory or third-party agency retention requirement. Where such a requirement applies, it will take precedence over the general periods described above.

At the end of the applicable period, personal information will be securely deleted, anonymised or placed beyond routine use in accordance with our systems and backup arrangements. Further information about the retention arrangements relevant to your personal information is available on request by contacting privacy@rewardfunding.co.uk.

14. Marketing and business development

We may use business contact details to keep in touch with customers, prospective customers, introducers and professional contacts about relevant products, events and services. Depending on the communication, we may rely on consent or our legitimate interests in appropriate business development and relationship management. Electronic marketing is also subject to the Privacy and Electronic Communications Regulations 2003 (PECR).

You can object to direct marketing at any time, without giving a reason, by using the unsubscribe option in a message or contacting privacy@rewardfunding.co.uk. We will stop using your information for direct marketing and may retain minimal information on a suppression list so that we do not contact you again. Withdrawing consent or objecting does not affect earlier lawful processing.

15. Customer feedback and reviews

We value customer feedback and may invite customers to review our services following completion of a transaction or at another appropriate stage in the customer relationship.

We use Trustpilot A/S (“Trustpilot”), an independent customer-review platform, to send and manage review invitations. For this purpose, we may provide Trustpilot with limited personal information, including:

Your name;
Your email address; and
A transaction or customer reference, where required to authenticate the invitation.

We process this information on the basis of our legitimate interests in obtaining genuine customer feedback, monitoring customer experience and improving our products and services.

You have the right to object to this processing at any time. You can opt out by using the unsubscribe option included in a review invitation or by contacting us at privacy@rewardfunding.co.uk.

Trustpilot may process personal information for its own purposes when operating its review platform. Further information is available in Trustpilot’s Privacy Policy.

16. Website, cookies and analytics

Our website uses storage and access technologies, including cookies. Essential technologies may be used where necessary to operate, secure and remember choices on the website. Where required, we ask for consent before using non-essential analytics, advertising or similar technologies. Cookie and device identifiers can be personal information even when they do not directly name you.

Our current technologies may include Google Analytics and CookieYes. You can accept, reject or change non-essential cookie choices through Cookie Settings. The Cookie Policy gives current details of each technology, provider, purpose and lifespan. Cookie Policy

17. Security

We use proportionate organisational and technical measures to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures include access controls, staff training, system security, supplier due diligence, secure disposal and incident-management procedures. Access is limited to people who need the information for an authorised purpose.

No system is completely secure. If a personal data breach occurs, we will assess it, take appropriate action and notify the ICO and affected individuals where the law requires.

18. If you do not provide information

Some information is needed to assess an application, verify identity, comply with legal duties, enter into an agreement, administer a facility or provide support. If required information is not provided, we may be unable to proceed, may need to restrict a service or may have to end or enforce a relationship. We will explain the likely consequence where it is not obvious.

19. Your data protection rights

Your rights depend on the circumstances and lawful basis. They may include:

Right	What it means
Be informed	To receive clear information about how we use your personal information.
Access	To ask whether we use your information and receive a copy, together with relevant supplementary information.
Rectification	To have inaccurate information corrected and incomplete information completed.
Erasure	To ask us to delete information where a legal ground applies. This is not an absolute right.
Restriction	To ask us to restrict use in specified circumstances.
Portability	For certain information you provided to us, processed by automated means on consent or contract, to receive it in a structured, commonly used and machine-readable format or have it sent to another controller where technically feasible.
Object	To object to processing based on legitimate interests or a task in the public interest. We will consider the objection and applicable overriding grounds.
Object to direct marketing	To require us to stop using your information for direct marketing at any time. You do not need to give a reason.
Withdraw consent	To withdraw consent at any time where consent is the basis, without affecting prior lawful use.
Automated decisions	Where applicable, to receive safeguards concerning significant solely automated decisions, including human intervention and challenge rights.
Complain	To complain to Reward and to the ICO about the use of your personal information.

20. Subject access requests

You may make a subject access request verbally or in writing, including by emailing privacy@rewardfunding.co.uk. We may ask for information that is reasonably needed to verify your identity and identify the information you are requesting. We will not ask for more information than is necessary.

We will respond within the period required by law, normally for one month. The law allows time to be paused or calculated from receipt of reasonably required information in specified circumstances and allows an extension for complex or numerous requests. We will tell you if this applies. We are required to conduct reasonable and proportionate searches for your personal information.

A request is normally free of charge. We may charge a reasonable fee or refuse to act only where the law permits, including where a request is manifestly unfounded or excessive. We will explain any refusal and your complaint rights.

21. How to make a data protection complaint

If you believe that Reward has infringed data protection law, please contact us using privacy@rewardfunding.co.uk or the postal address in section 2. Please identify the relevant relationship, explain your concern and include any information that may help us investigate. We will make reasonable adjustments or provide another accessible route where needed.

We will:

Acknowledge your complaint within 30 days;
Make appropriate enquiries and investigate the issues raised;
Keep you informed about progress where appropriate;
Respond without undue delay and explain the outcome and any action taken or not taken; and
Tell you about your right to complain to the Information Commissioner’s Office (ICO).

You may complain to the ICO at any time, although the ICO will normally expect you to have raised the matter with us first so that we have an opportunity to resolve it.

Information Commissioner’s Office: ico.org.uk/make-a-complaint | Telephone: 0303 123 1113

22. Changes to this notice

We may update this notice to reflect changes in law, guidance, products, suppliers or how we use information. The current version will be published on our website and will show the date of the latest update. Where a change materially affects individuals, we will take reasonable steps to bring it to their attent