Privacy notice

Who we are

Lightning Business Loans is a trading style of Highland Business Finance Ltd, a company incorporated in England and Wales under company number 13200053. Our registered office is 24 High Street, Billericay, Essex CM12 9BQ.

We are the data controller for the information described in this notice. We are authorised and regulated by the Financial Conduct Authority under firm reference number 948251, and registered with the Information Commissioner's Office under registration ZA910509.

If you have a question about this notice, or you want to exercise any of the rights below, email privacy@lightningbizloans.co.uk or write to us at the registered office above.

What information we hold about you

If you contact us through this website, by email or by phone, we collect your name, work email address and phone number. You may also give us your company name and a description of your business or funding needs. Our website host delivers the site and processes your enquiry submission. It also processes technical information needed to deliver and protect the site, including your IP address, browser information and request logs.

We also use aggregate request totals from our website host to check whether pages are being reached and working. These totals do not depend on accepting optional analytics. They include repeat visits and automated requests, so they are not a count of individual people or confirmed email clicks. We do not add tracking cookies or identify visitors for this report.

If you accept analytics, Google Analytics receives the page you visit, the time of the visit, browser and device information, an approximate location based on your IP address, how you found the website, whether you start or complete the application and whether our system confirms a contact save. We shorten page and referring website addresses before sending them. We do not send query strings, enquiry details or form answers to Google.

If you accept analytics, our visitor identification service receives technical information about your visit, including your IP address, browser and device, page visits and referring website. For US-based traffic, it may combine this with information from public and commercial sources to try to identify your company and business contact details, such as your name, work email address, job title and professional profile. The visitor identification script runs only on our homepage and application page, and only after you accept. Because it runs on those pages, it can technically access information shown or entered there, including enquiry details and form answers.

If you have received a marketing email from us and have not been in touch, we hold a small amount of business contact information:

• your name and job title, where they were included
• your work email address
• your company's name, and in some cases its registered number, industry and location
• a record of the emails we sent you, whether they were delivered and opened, and any reply you sent

We do not hold your personal financial details, your home address or any special category data at this stage. If you go on to ask us to arrange finance, we will collect more information from you and we will tell you what we need and why at that point.

Where we got your details

If you contact us, we get your details directly from you.

Your business contact details came from a commercially compiled business marketing list, or from publicly available company information.

If you accept visitor identification, the service may give us company and business contact information from public and commercial sources for US-based traffic.

We market to limited companies and limited liability partnerships. We remove sole traders and personal email addresses before we send anything.

Why we use it, and our lawful basis

If you contact us about finance, we use your details to respond, understand what you need, assess which finance options may be suitable and, if you ask us to, approach finance providers. We use limited technical information to operate and protect this website.

Our lawful basis is legitimate interests. Our interests are answering requests from businesses, arranging finance, checking that our website works and keeping our website and records secure. If we need to use your information to meet a legal or regulatory duty, our lawful basis is legal obligation.

If you accept analytics, we use Google Analytics to count visits and anonymous application steps. We use our visitor identification service to measure campaign visits and, for US-based traffic, to find business contacts who visited so we can consider relevant business marketing follow-up. Our lawful basis for collecting and identifying this information is consent. Any follow-up uses the legitimate interests basis and contact limits described below. We do not use visitor identification information to assess whether you qualify for finance. You can withdraw or change your choice at any time through “Analytics settings” in the footer. Changing a previous acceptance to reject refreshes the current page to stop visitor identification, so make a note of any unsubmitted form details first.

You have the right to object to our use of legitimate interests. See “Your rights” below or email privacy@lightningbizloans.co.uk.

You do not have to give us your details. We cannot respond to an online enquiry unless you provide your name, email address and phone number.

We do not make decisions about you by solely automated means that have a legal or similarly significant effect on you. If you ask us to approach finance providers, each provider decides how it assesses your application and will tell you about its own decision-making.

We use your business contact details to tell you that we can arrange commercial finance, and to follow up a small number of times if you do not reply.

How many emails you will get. At most four short emails over about two and a half weeks, then we stop. Some people receive only the first one. If you do not reply, we do not contact you again for at least 90 days, and only then with a different approach. If you reply, the sequence stops immediately.

Our lawful basis is legitimate interests. Our interest is in reaching businesses that may need finance. We have weighed that against your interests and concluded that a short, clearly labelled business offer sent to a work address, which you can stop with one reply, is a reasonable thing to send. You can ask us for a copy of that assessment.

If you become a client, we will process your information on different bases, including performance of a contract and our legal obligations as a regulated firm, and we will give you a fuller notice then.

Who we share it with

We share your details with:

• our website hosting and security provider, which delivers the site, processes your enquiry submission and handles technical request information
• our email delivery provider, which sends the emails on our behalf and records deliveries and replies
• our customer relationship management system, where an enquiry is recorded and worked on
• Google Analytics, only after you accept, to measure visits, traffic sources and anonymous application steps
• our visitor identification service, only after you accept, to receive technical visit data and, for US-based traffic, try to match it to company and business contact information for campaign measurement and relevant follow-up
• finance providers, but only if you ask us to look for finance for you, and only what is needed to do that

We do not sell your details to anyone, and we do not share them with other marketers.

Some of the providers we use are based outside the United Kingdom, including in the United States. Where your information is transferred outside the UK, we rely on the safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.

How long we keep it

• If you make an enquiry but do not become a client, we keep the enquiry and related correspondence for 24 months after our last contact. We may keep it longer if we need it to handle a complaint or meet a legal or regulatory requirement. If you become a client, the six-year period below applies instead.
• We can access website function logs for one day. We may preserve a specific log for longer if we need it to investigate a security incident or meet a legal requirement.
• Google Analytics user and event data is set to be deleted after two months. Our visitor identification service keeps technical visit data, its identifiers and any matched profile under its own retention settings. If we use matched business contact information for follow-up, the marketing retention periods below apply. We keep your analytics choice in your browser until you change it or clear your browser data.
• If you do not reply to us, we delete or anonymise your details 24 months after the last email we send you.
• If you ask us to stop contacting you, we keep the minimum needed to honour that, which is your email address on a suppression list. We keep that indefinitely, because it is the only way to be sure we never contact you again.
• If you become a client, we keep your records for as long as our regulator and the law require, which is normally six years after our relationship ends.

Your rights

You have the right to:

• stop marketing. You can object to direct marketing at any time and we must stop. Reply "unsubscribe" to any of our emails, or email us at the address above.
• ask what we hold. We will give you a copy of your personal data.
• correct it if it is wrong.
• ask us to delete it, or to restrict what we do with it.
• object to our use of legitimate interests, and ask us to explain the balancing test.
• receive your data in a portable format, where that right applies.

We answer within one month. If a request is complex we may take up to two further months, and we will tell you within the first month if that happens. We do not charge for any of this.

Complaints

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. Website ico.org.uk.

Cookies and analytics

We use Google Analytics and a visitor identification service only if you choose “Accept” through “Analytics settings” in the footer. We keep these settings closed until you open them, and you can use the website without accepting. Neither service loads before you accept. Google Analytics sets analytics cookies so we can count visits, understand traffic sources and count anonymous application steps. For US-based traffic, the visitor identification service may match a visit with company and business contact information from public and commercial sources so we can measure campaigns and consider relevant follow-up. We have switched off Google advertising cookies, Google signals, enhanced measurement and automatic form tracking. We tell Google when you start the form, when our system confirms a contact save and when you complete the application. We do not send enquiry details or form answers to Google. The visitor identification script runs only on the homepage and application page after you accept, and can technically access information shown or entered there, including enquiry details and form answers.

We configure Google to receive the page path without its query string and the referring website address without its page path or query string. The visitor identification service can receive the page URL and referring website from your browser. After our system confirms your application, we keep a short-lived marker in your browser so we count the confirmation once. The marker contains no enquiry details, and we remove it after you accept or reject analytics on the confirmation page.

For more information about Google Analytics, read how Google uses information from sites or apps that use its services.

Use “Analytics settings” in the footer at any time to accept, reject or change your choice. Rejecting analytics stops future Google Analytics and visitor identification collection and removes Google Analytics cookies, visitor-identification cookies and visitor-identification local browser storage from this website where your browser allows it. The visitor identification service may retain information it received while you had accepted under its own retention settings, but it does not load after the page refreshes. Changing a previous acceptance to reject refreshes the current page to stop visitor identification, so make a note of any unsubmitted form details first.

Changes to this notice

If we change how we use your information, we will update this page and change the date at the top.

Regulatory information

Lightning Business Loans is a credit broker, not a lender. We introduce you to a range of finance providers and may receive a commission from the provider if you enter into an agreement. We are not independent financial advisers and do not provide financial advice.