Privacy Notice

This Privacy Notice explains how Vector Finsoft Limited (“Vector Finsoft”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you visit our website, contact us, use our services or interact with us in a business capacity.

Vector Finsoft Limited is a company registered in England and Wales.

• Company registration number: 17421302
• Registered office: 2 Claridge Court, Lower Kings Road, Berkhamsted, England, HP4 2AF
• Website: https://www.vectorfinsoft.com
• Privacy contact: mail@vectorfinsoft.com

For the purposes of applicable data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Vector Finsoft may act as a data controller or a data processor, depending on the circumstances.

This Privacy Notice applies to our own processing of personal data. Where we process personal data on behalf of a lender or another customer through our loan management software, that customer will generally determine the purposes for which the data is processed and will be responsible for providing the relevant privacy information to the individuals concerned.

This Privacy Notice applies to:

• Visitors to our website.
• Individuals who contact us or request information about our products and services.
• Representatives, employees and other business contacts of prospective and existing customers.
• Users who access our software on behalf of a customer.
• Suppliers, professional advisers and other business contacts, where relevant.
• Individuals whose personal data we process as a controller in connection with our business operations.

Our customers include banks, bridging lenders, specialist lenders and other financial services businesses.

Our loan management software may also be used to process information about borrowers, guarantors, directors, beneficial owners, brokers, property owners, investors, funders, solicitors, valuers and other individuals involved in lending and loan servicing.

Where those individuals' information is processed on behalf of a customer, the customer's privacy notice and relevant contractual arrangements should also be consulted.

Our role depends on the processing activity.

When we act as a data controller

We act as a controller when we determine why and how personal data is processed for our own purposes. This may include:

• Operating and administering our business.
• Responding to enquiries and managing business relationships.
• Marketing our products and services.
• Managing contracts, subscriptions, invoicing and payments.
• Maintaining the security and integrity of our website, systems and services.
• Meeting our legal and regulatory obligations.

When we act as a data processor

We generally act as a processor when a customer uses our loan management software to store, organise, analyse or otherwise process personal data for its lending and servicing activities, and we do so on the customer's documented instructions.

In these circumstances, the customer is generally the controller. The customer is responsible for determining the purposes and lawful basis of the processing, deciding which personal data should be collected, and providing appropriate privacy information to the individuals concerned.

We process that information in accordance with our contractual arrangements and applicable law. We may use authorised service providers to support delivery of the platform, subject to the applicable contractual and data protection requirements.

If you are a borrower, guarantor or another individual whose information is held by a lender using our software, you should normally contact that lender to exercise your data protection rights in relation to its lending decisions and records. We will assist the relevant customer where required by law and contract.

Our role must be assessed for each activity. If we determine the purposes and means of a particular processing activity ourselves, we may be a controller for that activity even where the information originated through a customer.

The personal data involved depends on how you interact with us and how our customers use the platform.

4.1 Website visitors

We may process information such as:

• Technical information generated when you access our website, including IP address, browser type, device information and request logs, where collected.
• Information about how you use the website, where analytics or similar technologies are enabled.
• Information you provide through a contact form, email or other communication.

We understand that our website currently does not intentionally store cookies. We will update this section if our website technologies or tracking practices change. Technical server logs or other technologies may nevertheless process information without storing conventional cookies.

4.2 Business contacts and customers

When you contact us, request a demonstration, enter into a contract or otherwise engage with us, we may process:

• Names, job titles and professional contact details.
• Employer and business information.
• Communications, enquiries, meeting notes and correspondence.
• Contract, subscription, billing and payment-related information.
• Account credentials and access-management information for authorised platform users.
• Marketing preferences, opt-out records and campaign engagement information.

4.3 Information processed through our loan management software

Depending on the customer's configuration and use of the platform, personal data may include:

Identity and contact information

• Names, addresses, email addresses and telephone numbers.
• Dates of birth and other identity information where supplied.
• Identification documents and proof-of-address records.

Loan and financial information

• Loan applications, balances, repayments, drawdowns, fees, arrears and redemption information.
• Financial circumstances, affordability information and relevant financial records.
• Bank account details and transaction information where supplied or obtained through an authorised integration.

Company and business information

• Company directorships, ownership, beneficial ownership and company records.
• Information obtained from Companies House and other permitted business information sources.

Property information

• Property addresses, ownership information, valuations, security details and related property documents.
• Information obtained from property data or valuation providers, where applicable.

Due diligence and risk information

• Know Your Customer (“KYC”) and identity verification records.
• Anti-money laundering (“AML”) and sanctions screening results.
• Adverse-media information.
• Credit information, where obtained from authorised sources.
• Criminal-offence data where relevant to the customer's lawful lending, due diligence or risk assessment activities.

Documents and communications

• Uploaded files, loan documents, supporting evidence and correspondence.
• Emails and related information accessed through an authorised email integration, such as Microsoft Outlook.
• Notes, review records, audit trails and user activity relating to platform operations.

The exact categories depend on the customer's use of the platform and the information supplied by the individuals, customer, authorised third parties or connected services.

We do not assume that every category listed above is collected in every case.

Depending on the processing activity, we may obtain personal data:

• Directly from you when you contact us, request a demonstration or enter into a business relationship.
• From your employer or the organisation that authorises you to use our services.
• From a customer that uploads, enters or otherwise submits information to the platform.
• From authorised users who access or update customer records.
• From emails and documents that a customer authorises us to process.
• From Companies House and other publicly available business information sources.
• From property data providers, valuation services, bank-feed providers or other third-party sources where these are used or integrated.
• From our technology and service providers, where necessary to operate our services.
• From technical systems that generate service logs, security records or account activity information.

Where we receive personal data about an individual from a source other than that individual and act as a controller, we will provide the required privacy information within the applicable legal timeframe, unless a lawful exception applies.

Where a customer is the controller, the customer is generally responsible for providing the relevant privacy information to the individuals whose data it supplies.

When we act as a controller, we must have a lawful basis for processing personal data under the UK GDPR. The basis depends on the purpose and circumstances.

We may rely on the following lawful bases where appropriate.

6.1 Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps you request before entering into a contract.

This may include managing customer accounts, providing contracted services, administering subscriptions, communicating about the service and processing relevant billing information.

6.2 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Depending on the circumstances, these interests may include:

• Operating and improving our business and services.
• Responding to business enquiries.
• Managing relationships with existing and prospective business customers.
• Maintaining service security, preventing misuse and investigating technical incidents.
• Keeping appropriate business records.
• Promoting our products and services to relevant business contacts.
• Establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we will consider the impact on individuals and apply appropriate safeguards. You have the right to object to processing based on legitimate interests in the circumstances set out in applicable law.

6.3 Legal obligation

We may process personal data where necessary to comply with a legal obligation applicable to us, including applicable accounting, tax, record-keeping or other legal requirements.

Where a customer is the controller of lending-related records, the customer is responsible for identifying and complying with the legal obligations applicable to its own processing.

6.4 Consent

Where consent is required by law, we will seek it before carrying out the relevant processing. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

For example, consent may be required for certain cookies, tracking technologies or electronic marketing communications.

6.5 Processing on behalf of customers

When we act as a processor, the customer is generally responsible for establishing the lawful basis for the processing. We process personal data in accordance with the customer's documented instructions and our contractual obligations, except where applicable law requires otherwise.

A customer's lawful basis does not automatically establish a lawful basis for any separate use we make of the same data for our own purposes.

Depending on our role and the circumstances, we may use personal data to:

• Provide, operate and maintain our website, software and related services.
• Set up and administer customer and user accounts.
• Respond to enquiries and arrange demonstrations.
• Communicate with customers, authorised users and business contacts.
• Manage contracts, subscriptions, invoices and payments.
• Support loan administration and servicing functions as instructed by customers.
• Process documents and communications submitted to the platform.
• Provide AI-assisted document extraction, summaries, analysis, underwriting flags or recommendations, where enabled by the customer.
• Support authorised integrations with email, company information, property information and financial data services.
• Maintain security, investigate suspected misuse and troubleshoot technical issues.
• Monitor service performance and improve reliability.
• Send relevant business marketing and service communications.
• Maintain suppression records for individuals who opt out of marketing.
• Comply with applicable law and establish, exercise or defend legal claims.

We will not use personal data for a new purpose incompatible with the original purpose without a lawful basis and any required transparency measures.

Our software includes AI-assisted functionality intended to support loan administration and underwriting workflows. Depending on the features enabled and the customer's instructions, this may include extracting information from documents, generating summaries, identifying potential risks or inconsistencies, and producing underwriting flags or recommendations.

8.1 AI providers

We may use third-party AI services, including services provided by OpenAI, Anthropic and Google, and an AI gateway or routing service to connect to or manage access to AI models.

The specific provider used may depend on the functionality, configuration and service available at the time.

Where personal data is sent to an AI provider to perform processing on our behalf, the provider's role, contractual terms, retention settings and any relevant international transfers must be assessed for the particular service.

8.2 Use of data for model training

Our stated practice is not to use customer personal data for training AI models. We must also verify that the relevant provider and gateway configurations, contractual terms and product settings support this position.

8.3 Human review

Our AI-assisted underwriting features are intended to support human review. They may produce flags, summaries or recommendations that a lender or authorised user considers as part of its own assessment.

A lender remains responsible for its lending policies and decisions. AI-generated information may be incomplete or inaccurate and should be checked against the underlying evidence and applicable lending criteria.

We do not intend, on the basis of our current description of the service, to make lending decisions about individuals solely through automated processing without meaningful human involvement.

If our processing practices change, we will update this Notice and implement any additional safeguards required by law.

The platform may be used by customers to process criminal-offence data or information relating to suspected offences, sanctions, adverse media or other due diligence checks.

Such information is sensitive and is subject to additional legal requirements. A lawful basis under Article 6 of the UK GDPR alone may not be sufficient. Where applicable, the controller must also identify a valid condition under Article 10 of the UK GDPR and the Data Protection Act 2018, together with any required documentation and safeguards.

Where we act as a processor, the relevant customer is generally responsible for determining and documenting the lawful basis and additional condition for its processing. We will process such information on the customer's documented instructions and in accordance with our contractual obligations and applicable law.

Where Vector Finsoft processes this information as a controller for its own purposes, we must independently establish and document the applicable lawful basis and any additional condition required by law.

We will not treat the mere presence of criminal-offence data in a system as authorisation to use it for any purpose.

We may disclose personal data where necessary for the purposes described in this Notice, subject to applicable law and contractual restrictions.

Recipients may include:

10.1 Customers and their authorised users

Where personal data is processed through the platform on behalf of a lender or other customer, that customer and its authorised users may access the information in accordance with their permissions and the customer's configuration.

10.2 Technology and infrastructure providers

We use third-party services to support our business and platform. These may include:

• Supabase, for database and related application services where configured.
• Microsoft and Azure services, including Microsoft 365 and Outlook integrations where enabled.
• AI providers such as OpenAI, Anthropic and Google, and relevant AI gateway services.
• Hosting, infrastructure, monitoring, backup and security providers used in our production environment.

The precise providers and their roles depend on the service configuration. We will use appropriate contractual arrangements where a provider processes personal data on our behalf.

10.3 External information providers

Where enabled and authorised, we may connect to or receive information from:

• Companies House.
• Property data and valuation providers.
• Bank-feed or Open Banking providers.
• Other authorised data sources selected by a customer.

The availability of a particular integration does not mean that we currently use every provider or obtain every type of data listed in this Notice.

10.4 Professional advisers and authorities

We may share relevant personal data with our professional advisers, auditors, insurers, regulators, law enforcement agencies or other authorities where necessary and permitted or required by law.

10.5 Corporate transactions

If we consider or complete a merger, acquisition, restructuring, financing or sale of all or part of our business, relevant information may be disclosed to professional advisers and prospective or actual counterparties where lawful and subject to appropriate confidentiality and data protection safeguards.

10.6 Other disclosures

We may disclose personal data where necessary to protect rights, investigate fraud or misuse, enforce agreements, establish or defend legal claims, or comply with a legal obligation.

We do not intend to sell personal data to third parties.

Our current understanding is that personal data is hosted and accessed within the UK and European Economic Area. This position must be verified against the actual locations and access arrangements of all our infrastructure, AI, email and other service providers.

Some technology providers may operate internationally or provide support from outside the UK or EEA. The location of a provider's headquarters alone does not establish where personal data is stored, accessed or transferred.

Where a restricted transfer of personal data takes place, we will ensure that the transfer is permitted under applicable data protection law. Depending on the circumstances, this may require UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and a transfer risk assessment, or a valid statutory exception.

Where required, individuals may contact us for further information about the safeguards applicable to a relevant transfer.

We retain personal data only for as long as necessary for the purposes for which it is processed, taking account of applicable legal obligations, contractual requirements, the nature of the data and the need to establish, exercise or defend legal claims.

12.1 Website enquiries and business contacts

We retain enquiries, correspondence and business contact records for as long as reasonably necessary to respond to enquiries, manage relationships, document business activities and meet applicable legal requirements.

Marketing suppression records may be retained for as long as necessary to ensure that an individual who has opted out is not contacted again for the relevant marketing purpose.

12.2 Customer account and contractual records

We retain relevant account, contract, billing and business records for the duration of the relationship and for any additional period required by law or reasonably necessary for legitimate business and legal purposes.

12.3 Customer data in the platform

For personal data processed on behalf of a customer, retention is generally determined by that customer and the applicable service agreement.

Our current intended approach is that customers control the retention and deletion of their loan and borrower records, subject to our contractual arrangements, technical capabilities and any legal requirement that applies to us.

The customer and Vector Finsoft should ensure that the relevant contract specifies how data can be returned or deleted when the service ends, how backups are handled and any applicable deletion timeframes.

12.4 Backups, logs and security records

Some information may remain in backups, audit logs or security records for a limited period after it is deleted from active systems. The applicable periods depend on the system, service configuration and security requirements.

We will apply appropriate safeguards and deletion processes in accordance with applicable law and our contractual obligations.

Where a precise retention period has not been established, we will use documented criteria to determine the period and review those criteria as appropriate.

We use technical and organisational measures intended to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Our currently identified controls include:

• Encryption in transit and at rest.
• Role-based access controls.
• Multi-factor authentication.
• Audit logs and activity monitoring.
• Backups and disaster recovery measures.

Access to personal data should be limited to individuals and service providers who need it for authorised purposes. We also seek to use appropriate contractual safeguards with providers that process personal data on our behalf.

No system or method of transmission can be guaranteed to be completely secure. We review security measures in light of the nature of the data, the risks of processing, available technology and applicable legal requirements.

Our controls and configurations may differ between services. We will not claim a security certification or control that has not been independently verified as applicable to the relevant service.

Where we act as a processor, we will notify the relevant controller of a personal data breach in accordance with our contractual obligations and applicable law, and provide reasonable assistance with its investigation and any required notifications.

Where Vector Finsoft acts as a controller, we will assess and respond to personal data breaches in accordance with applicable legal requirements, including notification to the Information Commissioner's Office where required and communication to affected individuals where the law requires it.

Depending on the circumstances and applicable law, you may have the right to:

• Access your personal data and receive information about how it is processed.
• Rectification of inaccurate or incomplete personal data.
• Erasure of personal data in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability where the relevant legal conditions apply.
• Object to processing based on legitimate interests or to direct marketing.
• Withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exemptions. They do not apply identically in every situation.

15.1 How to exercise your rights

If we act as controller for the relevant processing, you can contact us at:

Email: mail@vectorfinsoft.com

Please describe your request and provide enough information for us to identify the relevant records. We may need to verify your identity before responding.

We will respond within the applicable legal timeframe. Where a request relates to a lender's processing of borrower or loan records and the lender is the controller, we may direct you to the lender and assist it as required by law and contract.

15.2 Right to object to direct marketing

You have an absolute right to object to the processing of your personal data for direct marketing. If you object, we will stop processing your personal data for that purpose.

You may also unsubscribe using the mechanism provided in a marketing email or contact us directly.

We may use professional contact details to communicate with prospective and existing business customers about our products, services, events, updates and other relevant business information.

Where we process personal data for marketing, we must have an appropriate lawful basis under the UK GDPR and comply with applicable electronic marketing rules, including the Privacy and Electronic Communications Regulations 2003 (“PECR”).

The rules for email marketing differ depending on whether the recipient is a corporate subscriber, such as a limited company or limited liability partnership, or an individual subscriber, such as a sole trader or certain partnerships.

Where PECR requires consent, we will obtain it unless a valid exception applies. Where consent is not required under PECR, we will still comply with applicable data protection requirements, identify ourselves appropriately and provide a valid way to opt out.

We may use email delivery tools that record engagement, such as message delivery, opens or link clicks, where enabled. Such tracking will be assessed against applicable privacy and electronic communications requirements. We will provide appropriate information and obtain consent where required.

You can opt out of marketing at any time. We may retain a limited suppression record to respect your preference and avoid sending further marketing messages.

Service-related communications, such as account, security or contractual notices, are distinct from marketing communications and may still be necessary after you opt out of marketing.

We understand that our website currently does not intentionally store cookies.

Cookies and similar technologies may be introduced in future, for example to support essential functionality, analyse website use or measure advertising performance. If we introduce them, we will review the applicable requirements under PECR and the UK GDPR and provide any required information and consent controls before using technologies that require consent.

Analytics and advertising technologies are not automatically exempt from consent requirements merely because they are commonly used by businesses.

Our website may also generate technical server logs or process network information for security and operational purposes. These activities will be assessed separately from the use of cookies.

If our use of cookies or similar technologies changes materially, we will update this Notice and, where appropriate, publish a separate Cookie Policy.

Our website or communications may contain links to third-party websites or services. Those organisations may process personal data under their own privacy notices and terms.

We are not responsible for the privacy practices of third-party websites or services that we do not control. We encourage you to review their privacy information before providing them with personal data.

Where our software integrates with third-party services, the processing may also be subject to the relevant customer's instructions, the third party's terms and the applicable data protection arrangements.

Our services are designed for business and financial services use and are not intended to be directed at children.

However, personal data relating to an individual under 18 could be supplied through a customer's lending records or supporting documentation. Where this occurs, the relevant customer and Vector Finsoft must ensure that the processing is lawful, necessary and subject to appropriate safeguards for the circumstances.

We do not knowingly collect children's personal data for our own marketing purposes.

We may update this Privacy Notice from time to time to reflect changes in our services, processing activities, technology providers or legal obligations.

The updated version will be published on our website with a revised “Last updated” date. Where required by law, we will provide additional notice of material changes before the relevant processing begins.

If you have questions about this Privacy Notice or how we process personal data, please contact:

If we act as controller and you are dissatisfied with our response, you may complain to the Information Commissioner's Office (“ICO”), the UK's independent data protection regulator.

Website: https://ico.org.uk/(opens in a new tab)
Telephone: 0303 123 1113

Where your concern relates to a lender's processing of your loan application or borrower records, you may also contact that lender directly.