Privacy Policy
1. Who we are
Merchant Savvy (merchantsavvy.co.uk) is a trading name of Vubo Ltd, a company registered in England and Wales (Company Number 09017066). Our registered office is Davidson House, Forbury Square, Reading, RG1 3EU. ICO registration number: ZA067498.
Vubo Ltd is the data controller for the personal data described in this policy. If you have any questions, contact us at dpo@vubo.co.uk.
We help UK businesses compare and find business finance and payment processing services. We are an introducer: we don’t lend money or provide payment processing ourselves. Instead, we pass enquiries to carefully selected partners, who may pay us a commission when they provide a product or service to your business.
Our finance services are for limited companies and limited liability partnerships (LLPs). Although your enquiry is about your business, it includes personal information about you, such as your name, contact details and date of birth. This policy explains how we handle that information.
When a partner receives your details, it becomes a separate data controller and its own privacy notice applies to how it uses them. We link to each partner’s notice in section 4.
2. What we collect
We collect information you give us through our forms, information we obtain from other sources, and information collected automatically when you use our website.
| Source | What we collect |
|---|---|
| Business finance enquiry form | Your name, date of birth, email address, phone number, home address and residential status (for example, tenant or homeowner). Your business’s name, company number, legal status, trading start date, monthly turnover, and the amount and purpose of the finance you need. |
| Payment processing quote form | Your name, email address and phone number. Your business name, type, and location; how you take card payments; and your approximate card turnover. |
| Documents you provide | Bank statements, filed or management accounts, tax and VAT returns, proof of identity and address, company documents, existing finance agreements, invoices and other documents relevant to your enquiry. |
| Contact form, calls and emails | Your name, contact details and anything you tell us, including recordings or notes of calls where we tell you about this at the time. |
| Email newsletter | Your email address and your marketing preferences. |
| Companies House and other public registers | Public information about your business, its officers and its registered office, used to check and complete the details you give us. |
| Our partners | Updates on the progress and outcome of your enquiry, such as whether it was accepted, finance was offered or paid out, or the enquiry was declined, and any commission due to us. Where relevant, the results of identity, fraud or verification checks they carried out. |
| Providers we link to | Whether a click on one of our links led to an application or sale, and the commission due to us (see section 4). |
| Advertising, analytics and affiliate platforms | Information about the ads or links that brought you to our website, and whether you completed an enquiry. |
| Our website | Your IP address, device and browser information, pages visited, how you interact with our pages, and cookie identifiers (see section 7). |
Documents. We use documents you provide to support your enquiry, check your eligibility, verify the information you’ve given, help with onboarding, prevent fraud, and share relevant information with the partner handling your enquiry. If we need documents from you, we’ll tell you how to send them securely.
Information about other people. If you give us information about someone else, such as another director or a shareholder, please make sure they know you’re sharing it and point them to this policy.
If you don’t provide it. We need the information marked as required on our forms to handle your enquiry. Without it, we may not be able to match you with a partner.
We don’t intentionally collect special category data, such as information about your health or ethnicity. Please don’t include it in free-text fields.
3. How we use your information
We only use your information where UK data protection law gives us a lawful basis.
- Steps you’ve asked us to take. We use your information to provide the service you’ve requested, respond to your enquiry and connect your business with relevant partners.
- Your permission or consent. We ask for your permission before sharing your enquiry with partners, and your consent for marketing emails and non-essential cookies. You can withdraw it at any time, but this won’t affect anything we did before.
- Legitimate interests. We use your information to run Merchant Savvy, match enquiries with suitable partners, improve our website, prevent fraud and misuse, keep business records, handle complaints and measure our marketing. We only do this where our interests aren’t outweighed by your rights.
- Legal obligation. We keep and use information where the law requires it, for example for tax, accounting, fraud prevention and regulatory reasons.
The table below shows which basis applies to each use.
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry, check that your business is eligible and match it to suitable partners | Steps you’ve asked us to take, your permission given by ticking the box on our form, and our legitimate interest in helping your business find finance |
| Share your enquiry with a partner | Your permission, given on our form |
| Pass your enquiry to another partner if the first can’t help (for example, if it has declined the enquiry or already received one from your business) | Your permission, given on our form, limited to the partners listed in section 4 |
| Support your application and onboarding, including documents you provide | Steps you’ve asked us to take, and legitimate interests |
| Contact you about your enquiry | Legitimate interests: keeping you updated on the enquiry you made |
| Show you other products your business may be suitable for, with links to the provider | Legitimate interests: helping you compare options |
| Track clicks on our links and receive commission information from providers | Legitimate interests, and your consent where cookies are used |
| Track the outcome of your enquiry and reconcile commission with our partners | Legitimate interests: running our business and keeping accurate records |
| Send you our newsletter and offers by email | Your consent. You can unsubscribe at any time using the link in every email |
| Prevent fraud and protect our website from spam and bots | Legitimate interests, and legal obligation where it applies |
| Measure and improve our website and advertising | Your consent to non-essential cookies |
| Handle complaints and support compliance | Legitimate interests and legal obligations where it applies |
| Keep records and meet legal, tax and regulatory requirements | Legal obligation |
How we match enquiries. We use automated rules to decide which partners are likely to consider your enquiry, based on details such as your business’s legal status, trading history, turnover and the finance you need. This only decides who receives your enquiry. Any decision to offer you finance or a service is made by the partner, not by us. If you’d like to know more about how we match enquiries, contact us.
Marketing. We only send marketing emails if you’ve opted in, and our marketing consent is always separate from the permission you give to share your enquiry. You can unsubscribe at any time. If you’ve agreed to advertising cookies, we may also use your information to show you our ads on other websites and social media. Where you’ve consented, we may share a scrambled (hashed) version of your email address with Google or Meta to measure our ads and avoid showing them to existing customers.
4. Who we share your information with
We never sell your information to other companies for their own marketing.
Finance partners
When you submit a business finance enquiry, we share your details with one of the partners below. We only send your enquiry to partners likely to help, and we may pass it to another partner on this list if the first can’t help. Each partner may pay us a commission if it provides finance to your business.
| Partner | What it does | Privacy notice |
|---|---|---|
| iwoca Ltd (company number 07798925), 10 Queen Street Place, London, EC4R 1AG | Business lender. Registered with the FCA under the Payment Services Regulations 2017 (FRN 791804). | iwoca privacy policy |
| Funding Options Limited, trading as Funding Options by Tide (company number 07739337), 4th Floor, The Featherstone Building, 66 City Road, London, EC1Y 2AL | Credit broker, authorised and regulated by the Financial Conduct Authority (FRN 727867). It may share your details with its panel of lenders. | Funding Options privacy policy |
One partner at a time. We’ll only send your enquiry to one finance partner at a time. If that partner can’t help, we may pass it to another partner on our list. We’ll only send it to more than one partner at once if you choose to apply to them.
This list may change from time to time, and we’ll update it before any new partner receives your details. We only share your information where it’s relevant to your enquiry. Each partner acts as a separate data controller and uses your information under its own privacy notice and terms.
Payment processing
When you request a payment processing or card machine quote, we share your details with Independent Merchant Services Limited (company number 08062773), Carlyle House, 78 Chorley New Road, Bolton BL1 4BY. IMS will contact you about card payment processing and merchant services, and may pay us a commission. Its privacy notice explains how it uses your information.
Links to other providers
We may show you other products your business may be suitable for, such as business credit cards, with a link to the provider’s website. When you click one of these links, you leave Merchant Savvy and the provider’s own terms and privacy notice apply. We don’t send your form details to these providers.
Our links include a tracking reference, sometimes through an affiliate network, so the provider can tell us if your click led to an application or sale. We receive commission information but not your application details. The provider may set its own cookies when you arrive on its website.
Credit reference and fraud prevention agencies
Our partners share information with credit reference agencies and with fraud prevention agencies. Section 5 explains how.
Service providers
We use trusted service providers to run our website and business. They act on our instructions and can’t use your information for their own purposes, except where noted below.
| Provider | Purpose | Location |
|---|---|---|
| Kinsta Inc. | Website hosting | US |
| Google Ireland Ltd (Analytics, Ads, Ad Manager, Tag Manager, reCAPTCHA, Fonts, Workspace) | Analytics, advertising, spam protection, email and documents | Ireland, with possible transfers to the US |
| Microsoft Corporation (Clarity, Advertising) | Session recording, heat maps and advertising. Microsoft may also use Clarity data for its own purposes, including its advertising | US |
| Meta Platforms Ireland Ltd | Advertising and conversion measurement | Ireland, with possible transfers to the US |
| Plausible Insights OÜ | Privacy-friendly analytics | Estonia |
| Cloudflare, Inc. | Website security, performance and bot protection | US |
| Calendly, LLC | Appointment booking | US |
| Fonticons, Inc. (Font Awesome) | Website icons | US |
| FLG360 | Customer records | UK |
Others
We may share your information with our professional advisers, with law enforcement, regulators or courts where the law requires it, or with a buyer if our business is sold or reorganised.
5. Credit and fraud checks
Our partners’ checks. Our partners may run their own soft credit and identity checks with credit reference agencies such as Experian, Equifax, TransUnion and Creditsafe. These also won’t affect your credit score. A partner will only run a hard search, which other lenders can see, with your agreement, usually when you decide to apply. The Credit Reference Agency Information Notice explains how the three main agencies use your information.
Fraud prevention. Our partners may share your information with fraud prevention agencies to prevent fraud and money laundering and to verify your identity. If fraud is detected, you or others could be refused services, finance or employment. Fraud prevention agencies can hold your information for up to six years. Each partner’s privacy notice gives details of the agencies it uses.
Identity and business checks. Our partners may also verify your identity and your business, and carry out anti-money laundering checks, before offering you a product.
Lending decisions. Merchant Savvy doesn’t make lending decisions. Any decision about eligibility, affordability, approval or funding is made by the relevant partner.
6. Transfers, retention and security
Transfers outside the UK. Some of our service providers are based in, or use servers in, the European Economic Area or the United States. Where we transfer your information outside the UK, we make sure it’s protected, either because the UK government has found the country’s protections adequate (including the UK Extension to the EU-US Data Privacy Framework) or by using the ICO’s approved International Data Transfer Agreement or Addendum.
How long we keep your information.
| Information | How long we keep it |
|---|---|
| Finance and payment processing enquiries, including the permission you gave and the wording you saw | 6 years after your last enquiry, to handle questions and complaints and to reconcile commission |
| Documents you provide | Up to 30 days after your enquiry, unless a partner or the law requires longer |
| Records of commission and payments | 6 years after the end of the tax year they relate to |
| Click and referral tracking records | 2 years after the click, to reconcile commission |
| Newsletter subscriptions | Until you unsubscribe, then your email address is kept on a suppression list so we don’t email you again |
| Contact form messages | 2 years after we last hear from you |
| Website and cookie data | As set out in our Cookie Policy |
Security. We use appropriate technical and organisational measures to protect your information from unauthorised access, loss, misuse or disclosure. These include:
- access controls, and limiting access to staff and contractors who need it
- encryption of information in transit, and at rest where appropriate
- secure handling and storage of documents
- secure hosting and storage providers
- monitoring and logging of our systems
- internal policies and procedures
We send enquiries to partners over secure connections. No website or system is completely secure, so we can’t guarantee absolute security, but we take reasonable steps to protect your information.
7. Your rights, cookies and contact
Your rights. Under UK data protection law, you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that’s wrong or incomplete
- ask us to delete your information
- ask us to restrict how we use your information
- object to us using your information based on our legitimate interests, and to any direct marketing at any time
- ask us to transfer information you gave us to another organisation
- withdraw your permission or consent at any time. This won’t affect anything we did before you withdrew it, including enquiries already sent to partners
To use any of these rights, email dpo@vubo.co.uk. It’s free, and we’ll reply within one month. If we’ve shared your information with partners, we’ll tell them about any correction or deletion where we can, but you may also need to contact them directly.
Cookies. We use cookies and similar technologies. Non-essential cookies are only set with your consent.
Complaints. If you’re unhappy with how we’ve handled your information, please contact us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Other websites. Our website links to other websites, including our partners’. We’re not responsible for how they handle your information, so please read their privacy notices.
Children. Our services are for businesses and aren’t intended for anyone under 18. We don’t knowingly collect information about children.
Changes to this policy. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
Contact us. Vubo Ltd (t/a Merchant Savvy), Davidson House, Forbury Square, Reading, RG1 3EU. Email: dpo@vubo.co.uk.