Privacy Policy

Date last updated: 13th October 2026

About Us

Our website address is: www.quayfinancialgroup.com Our site is provided by Quay Financial Group Ltd.

Comments

To the extent that any comment functions are available on our site then when visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

To the extent that any comment functions are available on our site then if you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

To the extent that any editing or publishing functions are available on our site then If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service.

Contact details of the Data Protection Officer (DPO)

Peter Henderson MLRO@quayfinancialgroup.com

Legal Basis for Processing Personal Data 

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:

  • Performance of a contract – where processing is necessary to deliver services or meet contractual obligations, including obligations involving TransUnion.
  • Legal obligation – where processing is required to comply with applicable laws, regulatory requirements, or statutory obligations.
  • Legitimate interests – where processing is necessary for legitimate business purposes such as system security, fraud prevention, risk management, audit, and compliance, and where such interests do not override the rights and freedoms of individuals.
  • Consent – where required by law, and where individuals have been provided with a clear choice and the ability to withdraw consent at any time. 

Where legitimate interests are relied upon, appropriate assessments are conducted to ensure that the rights and freedoms of data subjects are protected. 

The legitimate interests pursued by the controller (if processing is based on legitimate interests). 

Our legitimate interests include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and protecting TransUnion data. These interests are balanced against the rights and freedoms of individuals, with appropriate safeguards in place. 

The source of personal data (if not obtained directly from the data subject). 

We may collect personal data about you from:

  • you directly
  • employers/clients when you apply for a role or are considered for an opportunity.
  • referees (where relevant and permitted)
  • publicly available sources (for example professional networking sites, business websites, and public records)
  • credit reference agencies (CRAs) where required for consumer credit, identity, or affordability checks.
  • third party service providers used to support recruitment, screening, and compliance processes. 

Details of any international data transfers outside the UK/EU and the safeguards in place. 

International Data Transfers 

We do not transfer, store, or process personal data outside of the United Kingdom. 

All personal data is handled exclusively within the UK and is not accessed by individuals, employees, or third-party providers located outside of the UK. 

As such, no international data transfer safeguards are required. 

The right to lodge a complaint with the Information Commissioner’s Office (ICO) or another supervisory authority. 

You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data. 

Provision of Personal Data 

Is the provision of personal data statutory or contractual? 

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations. 

Personal data is required to:

  • enter into and perform contracts with customers, suppliers, or business partners.
  • process orders, manage accounts, and deliver goods and services.
  • verify identity and prevent fraud; and
  • comply with applicable legal, regulatory, accounting, and tax obligations. 

What are the consequences of not providing personal data? 

If you choose not to provide the personal data, we request:

  • we may be unable to enter into a contract with you.
  • we may be unable to fulfil orders, supply goods, or provide services.
  • we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
  • as a result, our services may be delayed, restricted, or declined.  

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

  • Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
    FCA Firm Reference Number: 742313
  • TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
    FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

The categories of personal data being processed. 

We may collect and process the following categories of personal data, as necessary to provide our services and meet our legal, contractual, and security obligations: 

  • Identity data – including name, date of birth, title, username, or other identifiers.  
  • Contact data – including postal address, email address, telephone number.  
  • Account and access data – including user IDs, login details, access permissions, and authentication information.  
  • Professional or employment data – including job title, employer name, and business contact details.  
  • Financial and transactional data – including payment details, billing information, and transaction records (where applicable)   
  • Technical and usage data – including IP address, device information, browser type, operating system, access logs, and usage activity.  
  • Security and audit data – including system logs, monitoring records, access records, and incident related information. ‑related  
  • Communications data – including correspondence, emails, and records of interactions with us.  
  • Compliance and risk data – including records required for regulatory, audit, or due diligence purposes.  

Non-Automated Decision Making and Profiling  

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.  

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.  

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.   

Scroll to Top