Privacy Policy

Keystone Commercial Funding Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 17382027. Our trading address is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, and you can reach us at info@keystonecommercialfunding.co.uk.

We are registered with the Information Commissioner's Office as a data controller under registration number ZC214234. Both numbers also appear in the footer of every page.

When you submit an enquiry form on this site, we collect your name, email address, telephone number, the type of funding you are asking about, the amount, and whatever you tell us in the free-text field about the deal.

If your enquiry progresses, we will collect considerably more: identification documents, proof of address, bank statements, filed and management accounts, details of property and other assets, information about your credit history, and details of other people connected to the application such as fellow directors, shareholders and guarantors.

For an initial enquiry, our lawful basis is legitimate interests: you have asked us to look at a funding requirement and we cannot do that without the information. You can object at any time and we will stop.

Once you ask us to approach lenders, the basis becomes performance of a contract — the brokerage service you have engaged us to provide.

Where we are required to verify your identity and screen for financial crime, the basis is compliance with a legal obligation.

Special category data and criminal offence data — for example a health condition affecting affordability, or a past insolvency — are only processed where you have provided them and it is necessary for the funding application, and are held only as long as that application requires.

Lenders and their underwriters, but only those we have discussed with you and only once you have told us to proceed. We do not distribute your details to a panel of lenders speculatively.

Third parties necessary to complete a transaction: valuers, solicitors, monitoring surveyors, accountants and insurers, where relevant to your case.

Credit reference and fraud prevention agencies, where a search is required. A soft search leaves no footprint visible to other lenders; a hard search does, and we will not run one without telling you first.

Our own service providers — the systems we use for email, document storage and case management — process data on our behalf under written terms that restrict them to our instructions. Where a case is placed through a specialist packager, we will tell you before anything is shared with them.

Where an enquiry does not proceed, we hold the information for twelve months and then delete it. That period lets us pick up a conversation you come back to, and no longer.

Where a facility completes, we are required to retain records including identity verification for at least five years from the end of the business relationship under money laundering regulations, and longer where other rules apply.

Marketing consents are held until you withdraw them. Records of complaints are held for six years. If you would like the retention position on a specific record, ask and we will tell you.

Under UK GDPR you have the right to ask what we hold, to have it corrected, to have it deleted where we have no continuing basis for it, to restrict or object to how we use it, and to receive it in a portable format.

To exercise any of these, email info@keystonecommercialfunding.co.uk. We will respond within one month.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.

Data is held in access-controlled systems, encrypted in transit and at rest, with access limited to the people working on your case. Documents are not sent to lenders by unencrypted email where a secure portal is available.

Where a provider stores data outside the UK, the transfer is covered by the UK International Data Transfer Agreement or equivalent safeguards. If a breach affects your rights, we will notify you and the Information Commissioner's Office within the statutory timescales.