Last Updated: 13 July 2026

1. Introduction and Purpose

This Privacy Notice explains how Bolton Business Finance Ltd (“We”, “Us”, “Our”, “the Broker”) collects, uses, stores, shares and protects your personal data when you engage with Us as a client, prospective client, introducer, or visitor to Our website (https://bolton-finance.co.uk).

We are committed to protecting your privacy and handling your personal data in a transparent, fair and lawful manner in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Code of Practice and Minimum Standards of the National Association of Commercial Finance Brokers (NACFB).

This Notice forms part of Our Terms of Business and is provided to You separately or alongside any Confirmation of Instructions Letter. By providing personal data to Us or by signing Our Terms of Business, You acknowledge that You have read and understood this Notice.

Important: Bolton Business Finance Ltd is not authorised or regulated by the Financial Conduct Authority (FCA). We provide non-regulated commercial finance broking services only (business loans, invoice finance, asset finance, merchant cash advances, trade finance, commercial mortgages, unregulated bridging loans, property development finance and non-regulated buy-to-let mortgages). We work with an unrestricted number of Lenders and act solely as an introducer.

2. Who We Are (Data Controller)

Data Controller: Bolton Business Finance Ltd

Company Number: 12495909 (registered in England and Wales)

Registered Office: Westgate House, Westgate Avenue, Bolton, Greater Manchester, BL1 4RF

ICO Registration: ZA712923 (you can check Our registration at www.ico.org.uk)

NACFB Membership: We are a full member of the National Association of Commercial Finance Brokers. You can verify Our status at www.nacfb.org.

Data Protection Contact / Information Officer: Marcus Wright

Telephone: 0161 546 9128

Email: marcus@bolton-finance.co.uk

Website: https://bolton-finance.co.uk

3. What Personal Data We Collect

We collect and process the following categories of personal data depending on the nature of the enquiry or engagement:

3.1 Identity and Contact Data

Full name, title, previous names/surnames, date of birth, nationality, marital status, gender, dependants and ages
Home address (current and previous if less than 3 years), residential status (homeowner/tenant/family), email address, mobile and landline telephone numbers
National Insurance number (where required for identity verification or credit searches)

3.2 Financial and Credit Data

Employment/self-employment status, job title, employer, length of service, income (employed or self-employed)
Residential property value, outstanding mortgage, monthly payments, arrears, CCJs, bankruptcy or insolvency history
Business turnover, accounts, management figures, bank statements (usually 3–6 months), existing borrowing, overdrafts, liabilities, hard assets
Details of adverse credit, tax arrears (VAT, PAYE, Corporation Tax), claims or lawsuits involving the business or directors

3.3 Property and Transaction Data (for Property Finance)

Property address, value, purchase price, existing lending, loan amount required, term, type of property, bedrooms, rental income, tenants, units (HMO/MUFB)
EPC rating, planned works/development costs, GDV, source of deposit, exit strategy, portfolio details
Security offered (including personal guarantees), estimated values

3.4 Business and Corporate Data

Company name, company number, trading name, start date, VAT registration, trading address, ownership structure, directors/shareholders (25%+), PSC information
Main business activities, number of employees, value of assets, card payment providers and average monthly card sales (for MCA/invoice finance)

3.5 Special Category / Sensitive Data

We do not routinely collect special category data (e.g. health, racial/ethnic origin, political opinions). If such data is required (for example health information relevant to keyman insurance or capacity), We will only process it with Your explicit written consent and for a specific purpose.

3.6 Technical and Website Data

IP address, browser type, device information, cookies and similar technologies (see Our Cookie Policy)
Information You provide via website contact forms, enquiry forms or chat

4. How We Collect Your Data

We collect personal data from the following sources:

Directly from You – via telephone, email, fact-find forms (Property Finance Fact Find and general Application Form), Asset Schedule, website forms, or face-to-face meetings
From third-party introducers, accountants, solicitors or other professional advisers who refer You to Us (with Your knowledge or consent)
From publicly available sources such as Companies House, Land Registry, and credit reference agencies (via Lenders)
From Lenders and ancillary service providers (solicitors, valuers, surveyors) during the application and underwriting process
Via cookies and analytics tools when You visit Our website

5. Lawful Bases for Processing

Under UK GDPR Article 6 We rely on the following lawful bases:

Performance of a Contract: Processing is necessary to take steps at Your request prior to entering into a contract (Terms of Business / Confirmation of Instructions) and to perform Our Credit Broking Services under that contract.
Legitimate Interests: To introduce You to suitable Lenders, to administer Our business, to prevent fraud, to improve Our services, and to send relevant commercial marketing communications where We have a soft opt-in or legitimate interest that is not overridden by Your rights (You may object at any time).
Legal Obligation: To comply with anti-money laundering (AML), counter-terrorist financing, fraud prevention, tax and other statutory requirements.
Consent: Where We process special category data or where We send electronic marketing and a soft opt-in is not available. You may withdraw consent at any time by contacting Us.

6. How We Use Your Personal Data

We use Your personal data for the following purposes:

To assess Your finance requirements and prepare a Lending Proposal
To source Finance Offers from an unrestricted panel of Lenders and introduce You to them
To complete Our fact-find, Application Form, Confirmation of Instructions Letter and Commission Disclosure Document
To coordinate valuations, legals, insurance and other ancillary services
To manage the relationship through to Completion and for aftercare / renewal opportunities
To comply with Our legal and regulatory obligations (including NACFB Code)
To prevent and detect fraud, money laundering and other crime
To send You service-related communications and, where permitted, marketing about products and services that may interest You
To maintain records for audit, complaints handling and professional indemnity purposes

7. Who We Share Your Data With

We may share Your personal data confidentially and only as necessary with:

Lenders and Funders: Banks, alternative lenders, invoice finance providers, asset finance companies, bridging and development lenders on Our panel (details available on request). Different Lenders pay different commission models (fixed fee, percentage of amount borrowed, rate for risk, etc.).
Ancillary Service Providers: Solicitors, valuers, surveyors, insurance brokers, accountants and other professionals engaged in connection with Your application.
Credit Reference and Fraud Prevention Agencies: Via Lenders, for identity verification, credit scoring and fraud prevention.
Professional Advisers and Regulators: Our accountants, solicitors, professional indemnity insurers, the NACFB, ICO, HMRC, courts and law enforcement where required by law.
Introducers: Where You have been referred to Us, or where We refer You, commission arrangements will be disclosed.
Business Transfer: In the event of a sale, merger or reorganisation of Our business.

We do not sell Your personal data. International transfers outside the UK are rare; if required We will ensure appropriate safeguards (e.g. UK International Data Transfer Agreement or adequacy regulations) are in place and will inform You.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements.

Typical retention periods:

Client files and application records: duration of the relationship + 6 years (limitation period for contract claims)
Enquiry data where no engagement: up to 12–24 months for legitimate interest / soft opt-in marketing, or sooner if You object
Fraud prevention records: up to 6 years
Website analytics and cookies: as set out in Our Cookie Policy (usually 12–24 months)

9. Your Rights Under UK GDPR

You have the following rights in relation to Your personal data:

Right to be informed: This Privacy Notice provides the required information.
Right of access: You may request a copy of the personal data We hold about You (Subject Access Request).
Right to rectification: You may ask Us to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): You may request deletion in certain circumstances.
Right to restrict processing: You may request that We limit how We use Your data.
Right to data portability: You may request Your data in a structured, commonly used and machine-readable format.
Right to object: You may object to processing based on legitimate interests (including direct marketing – this is absolute).
Rights relating to automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, please contact Marcus Wright (details in Section 2). We will respond within one month (extendable in complex cases). We may need to verify Your identity. There is usually no fee, but We may charge a reasonable fee or refuse unfounded or excessive requests.

10. Marketing and Communications

We may contact You by telephone, email or post about products and services that We believe may be of interest to You (including renewals, refinance opportunities and portfolio reviews).

For existing clients or those who have enquired, We rely on legitimate interests or soft opt-in under PECR. You can opt out of marketing at any time by:

Clicking the unsubscribe link in any marketing email
Emailing marcus@bolton-finance.co.uk with “Unsubscribe” in the subject
Calling 0161 546 9128

Service-related communications (e.g. updates on Your application, fee invoices, Terms of Business) are not marketing and will continue.

11. Data Security

We take appropriate technical and organisational measures to protect Your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include secure IT systems, access controls, staff training, encrypted communications where appropriate, and secure storage of paper files (We operate a largely paperless office with documents saved to Dropbox and notes in HubSpot). We maintain professional indemnity insurance.

12. Cookies and Website Tracking

Our website uses cookies and similar technologies to improve Your browsing experience, analyse traffic and support marketing. By continuing to use the website You agree to Our use of cookies as described in Our separate Cookie Policy (available on the website footer or on request).

You can control cookies through Your browser settings. Essential cookies required for the website to function cannot be disabled.

13. Complaints

If You are unhappy with how We have handled Your personal data, please contact Marcus Wright in the first instance (details in Section 2). We will investigate and respond promptly.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk/make-a-complaint

As a NACFB member We also follow the NACFB complaints and mediation procedures set out in Our Terms of Business.

14. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in law, Our practices or Our services. The latest version will always be available on Our website or on request. Material changes will be notified to existing clients where appropriate. This version is dated 13 July 2026.

15. Contact Us

If You have any questions about this Privacy Notice, how We handle Your data, or wish to exercise Your rights, please contact:

Marcus Wright

Information Officer / Director

Bolton Business Finance Ltd

Westgate House, Westgate Avenue, Bolton, Greater Manchester, BL1 4RF

Tel: 0161 546 9128

Email: marcus@bolton-finance.co.uk

Website: https://bolton-finance.co.uk

This Privacy Notice should be read in conjunction with Our Terms of Business and any Confirmation of Instructions Letter.