HYPOTEK CAPITAL LIMITED
DATA PRIVACY INFORMATION / PRIVACY NOTICE

​

Last Updated: March 2026

​

Who We Are

​

Hypotek Capital Limited is a company registered in England and Wales with company number 13421043.

Hypotek Capital Limited has a number of wholly owned subsidiaries which may be used in connection with providing lending services to customers.

​

This Privacy Notice applies to Hypotek Capital Limited and all subsidiaries that are wholly owned by Hypotek Capital Limited (together referred to as “Hypotek Capital”, “we”, “us”, or “our”).

​

We will inform you which specific legal entity you are contracting with when entering into a lending or business relationship. The relevant Hypotek Capital entity acts as the data controller in respect of the personal information it collects and processes.

​

Hypotek Capital provides property-backed lending and related financial services primarily to corporate borrowers.

For data protection enquiries please contact:

Email: Nikolay@hypotek.co.uk

​

1. Information We Collect

We may collect and process the following categories of personal data:

• identity Data - including name, date of birth, title, or identification information.

• contact Data - including postal address, email address, and telephone number.

• professional or Business Information - including employment details, company roles, shareholdings, or directorship information.

• financial and Transaction Information

• information relevant to lending, due diligence, payments, or contractual arrangements.

• technical Data - including IP address, device information, browser type, operating system, and website interaction data.

• communications Data

• correspondence, enquiries submitted through our website, email communications, and interaction records.

• compliance and Risk Information

• information required for due diligence, fraud prevention, regulatory compliance, and risk assessment.

• security and Audit Information

• system access records, authentication logs, and monitoring information.

​

2.How We Collect Personal Data

​

Personal data may be collected from:

• information provided directly by you
• inquiries submitted through our website or communications with us
• company representatives or professional advisers
• publicly available sources including Companies House and business registers
• credit reference agencies where required for due diligence purposes
• service providers assisting with compliance or operational activities.

​

3. How We Use Personal Data (Purpose of Processing)

We process personal data only where necessary and for lawful purposes including:

• responding to enquiries or communications
• assessing and managing commercial lending applications
• conducting company and director due diligence checks
• identity verification and fraud prevention
• managing customer, supplier, and professional relationships
• complying with legal, regulatory, and contractual obligations
• protecting systems, data, and business operations
• managing authentication, monitoring, and audit activities
• detecting and responding to security incidents.

​

4. Legal Basis for Processing

We process personal data under the following lawful bases:

• performance of a Contract - where processing is necessary to assess or provide lending or related services.

• legal Obligation - where processing is required to comply with applicable laws or regulatory requirements.

• legitimate Interests- including commercial risk assessment, fraud prevention, due diligence, governance, audit, compliance, and system security.

• consent - where required by law, including certain marketing communications.

• where legitimate interests are relied upon, appropriate balancing assessments are undertaken to protect individuals’ rights and freedoms.

• ​

5. Credit Reference and Due Diligence Checks

As part of our commercial lending and due diligence activities, we may obtain information relating to company directors or relevant individuals from credit reference agencies (CRAs).

We obtain certain information via Creditsafe Business Solutions Limited, which may use its data partner TransUnion International UK Limited to supply credit and identity information.

Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
FCA Firm Reference Number: 742313

TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
FCA Firm Reference Number: 805757

Information received may include identity verification data, publicly available information, directorship history, financial associations, and credit-related indicators relevant to business risk assessment and fraud prevention.

This information is used solely for legitimate business purposes including:

• commercial due diligence
• fraud prevention and identity verification
• risk assessment connected with lending activities.

Further information about how these organisations process personal data can be found at:

Creditsafe Transparency Notice:
https://www.creditsafe.com/gb/en/legal/privacy-policy.html

TransUnion Credit Reference Agency Information Notice:
https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference

TransUnion Bureau Privacy Notice:
https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

​

6. Sharing Personal Data

We may share personal data where necessary with:

• Hypotek Capital group companies where required to administer lending activities
• professional advisers including legal, accounting, and financial advisers
• regulated service providers and contractors
• credit reference agencies
• regulators or law enforcement authorities where required by law
• technology and cloud service providers supporting our operations.

Where personal data is transferred outside the United Kingdom, appropriate safeguards are implemented.

 

7. Data Security

We implement appropriate technical and organisational security measures designed to protect personal data, including:

• restricted system access controls
• encrypted devices and secure cloud storage
• authentication and monitoring controls
• logging and audit processes.

​

8. Data Retention

We retain personal data only for as long as necessary to fulfil business, contractual, legal, or regulatory obligations.

Due diligence and lending records are retained in accordance with applicable compliance requirements and securely deleted when no longer required.

​

9. Your Rights

Under UK data protection law you have the right to:

• request access to your personal data
• request correction of inaccurate data
• request erasure where lawful
• request restriction of processing
• object to processing based on legitimate interests
• request data portability where applicable.

Requests may be made using the contact details provided above.

​

10. Complaints

If you are dissatisfied with how we manage your personal data, you have the right to complain to:

Information Commissioner’s Office (ICO)
www.ico.org.uk

​

11. Provision of Personal Data

Providing certain personal data may be necessary to:

• enter into lending or commercial agreements
• verify identity and prevent fraud
• comply with legal or regulatory obligations.

Failure to provide required information may prevent us from proceeding with services or transactions.

 

12. Automated Decision Making

We may use systems or tools to support risk assessment, fraud prevention, identity verification, or record management processes.

However, decisions that have legal or similarly significant effects are not made solely through automated processing and involve appropriate human review.

​

13. Website Usage and Cookies

Our website may collect limited technical information such as IP address and browsing behaviour to improve website functionality, performance, and security.

Where cookies or analytics technologies are used, they operate in accordance with applicable data protection and electronic communications regulations.

​

14. Updates to This Privacy Notice

We may update this Privacy Notice periodically to reflect operational, legal, or regulatory changes. The latest version will always be published on our website.