PIPEDA & GDPR
compliance statement

The Commercial Lender Ltd, registered in England and Wales under company number 13561105 at 55 Hoole Road, Chester, Cheshire, CH2 3NJ, is the data controller for the personal information collected through this website, our enquiry and application forms, and our correspondence with you. Where we pass an application to a partner financial institution, that institution becomes a controller in its own right for the assessment it carries out.

We apply the UK General Data Protection Regulation and the Data Protection Act 2018, the EU General Data Protection Regulation for clients in the European Economic Area, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for clients and partner institutions in Canada. Where these regimes differ, we apply the higher standard to every client rather than segmenting our practice by jurisdiction.

A named privacy officer is accountable for our compliance and is reachable at enquiry@tcomlenders.biz marked "Privacy Officer". We maintain a record of processing activities, conduct data protection impact assessments before introducing any new processing that carries elevated risk, and review this statement at least annually.

• Accountability — a designated officer is responsible for our compliance and for the conduct of our processors.
• Identifying purposes — we state why information is needed at the point we ask for it, in plain language.
• Consent — we obtain knowledge and consent for collection, use and disclosure, except where the law permits otherwise.
• Limiting collection — we collect only what is necessary to assess and arrange the facility you ask for.
• Limiting use, disclosure and retention — information is used only for the stated purpose and kept only as long as required.
• Accuracy — records are kept accurate, complete and current so that decisions are not made on faulty data.
• Safeguards — protection is proportionate to sensitivity, using technical, organisational and physical controls.
• Openness — our policies and practices are published and available without a request.
• Individual access — you may confirm the existence of, access, and challenge the accuracy of your information.
• Challenging compliance — you may complain to our privacy officer and receive a substantive written response.

We rely on the performance of a contract, or steps taken at your request before entering one, to assess an application; on our legitimate interests to respond to advisory enquiries, prevent fraud and improve our service; on legal obligation for anti–money laundering, know-your-customer and record-keeping duties; and on consent where we send marketing communications, which you may withdraw at any time without affecting any facility already arranged.

We do not sell personal information, we do not use it to train third-party models, and we do not make a final lending decision by automated means alone. Where any automated assessment informs a decision, you may request a human review and an explanation of the factors involved.

• Access — receive a copy of the personal information we hold about you.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — have information deleted where no legal or regulatory duty requires us to keep it.
• Restriction and objection — limit or object to processing carried out on legitimate interests.
• Portability — receive information you provided to us in a structured, commonly used format.
• Withdraw consent — stop consent-based processing, including marketing, at any time.
• Human review — ask that a person review any decision informed by automated processing.

Write to enquiry@tcomlenders.biz. We respond within one month under the GDPR and within thirty days under PIPEDA, and we will tell you in advance if a complex request requires an extension. We do not charge a fee, and we will never require you to waive a right in order to obtain finance.

Our partner institutions sit across Europe, Asia, Australia, New Zealand and North America, so arranging a facility may involve a transfer outside your own country. Every transfer is made under an adequacy decision, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, supported by a transfer risk assessment and, for Canadian clients, contractual protections comparable to those PIPEDA requires of a transfer for processing.

Advisory enquiries that do not proceed are deleted within twenty-four months. Files for arranged facilities are retained for the term of the facility and then for seven years, as required by financial record-keeping and anti–money laundering law. Marketing consents are reviewed every two years and lapse if not renewed.

Information is encrypted in transit and at rest, access is restricted to the advisors who need it, and administrative access is logged. Should a breach create a real risk of significant harm, we notify the Information Commissioner's Office within seventy-two hours, notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, and maintain a record of every breach whether or not it is reportable.

Raise a concern with our privacy officer first; we acknowledge within three business days. If you remain dissatisfied you may complain to the Information Commissioner's Office in the United Kingdom, to your national supervisory authority in the European Economic Area, or to the Office of the Privacy Commissioner of Canada. Exercising that right costs you nothing and does not affect any application in progress.