CapSage Privacy Policy

1. About this Privacy Policy

CapSage respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you use CapSage, including when you complete a business funding assessment, verify your contact details, ask us to introduce your business to a Funding Provider or apply to become a CapSage Funding Provider.

CapSage is operated by Daddy Marketing Resources Limited, a company registered in Malta with company number C81348.

Our registered office and principal business address is:

For data protection purposes, Daddy Marketing Resources Limited is the controller of the personal information collected and used through CapSage.

You can contact us about privacy or data protection matters at:

privacy@capsage.co.uk

For general customer support:

support@capsage.co.uk

CapSage currently provides its funding matching and introduction service to UK limited companies seeking business funding and also enables eligible businesses to apply to participate in the CapSage network as Funding Providers.

2. What CapSage does

CapSage helps UK limited companies identify potentially suitable forms of business finance and, where appropriate, introduces them to an independent Funding Provider.

When you complete our assessment, CapSage uses the information you provide to:

• assess your business funding requirement;
• determine whether your enquiry meets our qualification criteria;
• recommend a potentially appropriate category of business finance;
• check for duplicate enquiries;
• identify a Funding Provider whose stated criteria match your enquiry; and
• where appropriate, send your enquiry to that Funding Provider.

Funding Providers may include direct lenders and finance brokers or intermediaries.

Funding Providers are independent third parties. They are not agents or representatives of CapSage.

CapSage does not itself provide business finance and does not make the Funding Provider's decision about whether to offer finance.

CapSage also enables businesses to apply to participate in the CapSage network as Funding Providers. Funding Provider applications are reviewed by CapSage and, if approved, are subject to separate commercial onboarding before a Funding Provider profile is activated.

3. Information we collect

Depending on how you use CapSage, we may collect the following information.

Information about you

This may include:

• your name;
• email address;
• mobile telephone number;
• your relationship to or authority to act for the business;
• verification of your email address and mobile number; and
• records of the consent and authority you provide during the assessment.

Information about your business

This may include:

• business name;
• postcode and geographic region;
• business sector;
• legal structure;
• length of time trading; and
• annual turnover.

Information about your funding requirement

Depending on the type of funding being considered, this may include:

• amount of funding required;
• intended purpose of the funding;
• how quickly funding is required;
• information relevant to Asset Finance;
• information relevant to Invoice Finance; and
• other information you provide as part of the CapSage assessment.

Verification and assessment information

We may also record:

• email verification status and time;
• mobile verification status and time;
• consent status and time;
• version of the consent wording presented to you;
• assessment outcome;
• recommended funding category;
• qualification outcome;
• duplicate detection information; and
• Funding Provider matching and delivery information.

Funding Provider application information

If you apply to become a CapSage Funding Provider, we may collect:

• your name and contact details;
• your relationship to or authority to act for the applicant business;
• the applicant business's name and contact details;
• information about the finance products it provides;
• funding criteria, minimum requirements, sector preferences and geographic coverage;
• information about the volume of leads the applicant is willing to consider;
• information provided as part of our review of the application;
• records relating to your acceptance of the CapSage Website Terms & Conditions, including the version accepted and the date and time of acceptance; and
• your IP address, where available, which we retain as part of the record of your acceptance of the CapSage Website Terms & Conditions.

Technical and attribution information

When you visit CapSage, we may receive limited technical or referral information associated with your visit.

This may include:

• the referring website or source;
• UTM campaign parameters contained in the URL, such as source, medium, campaign, term and content; and
• operational information generated by our hosting and infrastructure providers.

We use referral and campaign information to understand how people find CapSage and to assess the effectiveness of our marketing.

CapSage does not currently use advertising pixels or analytics tracking technologies within the public assessment journey.

Please see our separate Cookie Policy for more information.

4. How we use your information

We use personal information only where we have a lawful reason for doing so. Depending on the purpose and circumstances, we rely on taking steps at your request in connection with providing the CapSage service, our legitimate interests, compliance with legal obligations, or consent where consent is specifically required.

Providing the CapSage service

We use the information you submit to process your assessment, understand your funding requirement, recommend a funding category and, where appropriate, identify a suitable Funding Provider.

We rely on taking steps at your request in connection with providing the CapSage service and, where applicable, our legitimate interests in operating and delivering that service.

Verifying your contact details

We use your email address and mobile number to verify that the contact details supplied with an enquiry are valid and controlled by the person submitting it.

We rely on our legitimate interests in preventing false, fraudulent or inaccurate enquiries and maintaining the quality and integrity of the CapSage service.

Qualification and funding recommendation

We use information supplied during the assessment to determine whether an enquiry meets CapSage's qualification criteria and to recommend a potentially appropriate category of finance.

We rely on taking steps at your request in connection with providing the CapSage service and our legitimate interests in providing relevant funding introductions.

Matching you with a Funding Provider

We use information about your business and funding requirement to identify a Funding Provider whose stated appetite and criteria match the enquiry.

We rely on taking steps at your request to provide the CapSage service and our legitimate interests in facilitating relevant business funding introductions.

Sharing a qualified enquiry with a Funding Provider

Where an appropriate Funding Provider is identified, CapSage creates a Funding Provider Brief containing relevant information about you, your business and your funding requirement and sends it to that Funding Provider.

Under the current CapSage model, an enquiry is introduced to one Funding Provider at a time. If an introduction does not result in funding being provided, CapSage may, where appropriate, consider whether another Funding Provider within its network is a suitable match and make a further introduction.

This sharing is a core part of the CapSage service you have asked us to provide. We process and disclose the relevant information for that purpose on the lawful basis applicable to providing the requested service and, where appropriate, our legitimate interests in facilitating a relevant introduction. Where consent is specifically required by law for a particular processing activity, we will obtain it.

Preventing duplicate enquiries

We use certain information to identify enquiries that may already have been submitted to CapSage.

We rely on our legitimate interests in preventing duplicate distribution and maintaining the integrity of our one at a time introduction model.

Operating, securing and improving CapSage

We may use information where reasonably necessary to:

• maintain and secure the service;
• diagnose technical problems;
• investigate failed deliveries;
• prevent misuse;
• monitor operational performance;
• produce internal business reports; and
• improve the effectiveness of the service.

We rely on our legitimate interests in operating, securing and improving CapSage.

Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary for that purpose and the impact on the individual's interests, rights and freedoms.

Processing Funding Provider applications

If you apply to become a CapSage Funding Provider, we use the information submitted to review your application, assess whether your business may be suitable to participate in the CapSage network, contact you about the application and, where appropriate, progress the application to commercial onboarding.

We rely on taking steps at your request in connection with your application and our legitimate interests in reviewing and managing businesses that apply to participate in the CapSage Funding Provider network.

If your application is approved, information collected during the application process may also be used to establish and maintain your Funding Provider profile and to progress the separate commercial onboarding process.

5. How CapSage makes recommendations and matches enquiries

CapSage uses a rules based system to process assessment information.

The system does not use artificial intelligence, machine learning or predictive credit scoring to determine whether you should receive finance.

Based on the information you provide, predefined rules are used to:

• recommend a category of business finance;
• determine whether the enquiry meets CapSage's qualification criteria;
• detect duplicate enquiries; and
• identify an eligible Funding Provider based on criteria such as funding product, amount, sector, geography and other relevant requirements.

The system may determine that no Funding Provider currently meets the criteria for a particular enquiry.

CapSage does not itself approve or reject an application for finance.

Any decision about whether to offer finance, the amount offered, interest or other charges, repayment terms, security requirements or any other terms is made independently by the relevant Funding Provider.

6. Information we share with Funding Providers

If your enquiry qualifies and CapSage identifies an appropriate Funding Provider, the way an introduction is made depends on the arrangements in place with that Funding Provider.

Where an introduction involves CapSage sending your funding enquiry to a Funding Provider so that it can consider and respond to it, we may share the information reasonably necessary for that purpose, which may include:

• business name;
• contact name;
• email address;
• telephone number;
• postcode;
• business sector;
• trading history;
• turnover range;
• legal structure;
• recommended funding product;
• amount required;
• purpose of funding;
• required timing;
• relevant Asset Finance or Invoice Finance information;
• confirmation that email and mobile verification have been completed;
• confirmation that the required authority or consent has been recorded; and
• a CapSage enquiry reference.

The Funding Provider then uses the information as an independent organisation for the purposes of considering and responding to your funding enquiry.

In this situation, the Funding Provider may contact you directly.

Once your information has been provided to an independent Funding Provider, that organisation will be responsible for explaining how it uses your personal information under its own privacy arrangements.

Where CapSage instead introduces you by directing you to a Funding Provider's website, application process or other route controlled by that Funding Provider, CapSage does not share the personal information contained in your CapSage assessment with that Funding Provider as part of that referral.

Any information you then provide directly to the Funding Provider is provided by you to that Funding Provider, and will be handled by the Funding Provider under its own privacy arrangements.

CapSage does not control the Funding Provider's independent lending or broking decisions.

7. Other organisations we use

We use third party service providers to operate CapSage. These providers process information on our behalf where necessary to provide their services.

Hosting and application infrastructure

CapSage uses Vercel to host and operate the web application.

Database infrastructure

CapSage uses Neon to provide database infrastructure. The primary CapSage production database is currently hosted in Frankfurt, Germany.

Email

CapSage uses Postmark to send transactional and service emails, including verification messages and Funding Provider Briefs.

SMS

CapSage uses Vonage to send mobile verification messages.

Website security and bot prevention

CapSage uses Cloudflare Turnstile to help protect the website contact form from automated abuse. When you submit the contact form, Turnstile processes limited technical information from your browser, such as your IP address and browser characteristics, to assess whether the request is likely to be automated. This is used for security and bot prevention only, not for advertising or analytics.

We may also disclose information where required by law, regulation, legal process or a competent authority, or where reasonably necessary to establish, exercise or defend legal rights.

8. International transfers

CapSage is operated by a Maltese company and uses technology providers that may process information in different countries.

Our primary production database is currently hosted within the European Union.

Some of our service providers may process or make personal information accessible outside the United Kingdom or European Economic Area.

Where applicable data protection law treats such processing as an international or restricted transfer, we take appropriate steps to ensure that the transfer is permitted and that appropriate protections are in place.

Depending on the circumstances, these protections may include an applicable adequacy decision or regulation, recognised contractual safeguards, or another lawful transfer mechanism.

You may contact privacy@capsage.co.uk if you would like more information about the safeguards applicable to your personal information.

9. How long we keep your information

We do not keep personal information for longer than reasonably necessary for the purposes for which it was collected, including where information needs to be retained for legal, regulatory, accounting, fraud prevention, dispute resolution or legitimate business purposes.

We apply different retention periods to different categories of information rather than retaining all CapSage information indefinitely.

Completed funding enquiries and Funding Provider delivery records

Up to six years after the enquiry or completion of the relevant commercial relationship, where reasonably required to maintain records of introductions, consent, commercial transactions, complaints, disputes or potential legal claims.

Funding Provider applications and acceptance records

Up to six years after the application or, where the application is approved, completion of the relevant commercial relationship, where reasonably required to maintain records of the application, Website Terms acceptance, commercial onboarding, disputes or potential legal claims.

Consent and verification records

Up to six years where reasonably required to demonstrate the circumstances in which an enquiry was submitted, verified and disclosed.

Incomplete or abandoned assessments

Up to 12 months after the last activity, after which identifiable assessment information will be deleted or anonymised unless there is another legitimate reason to retain it.

Duplicate detection information

For as long as reasonably necessary to operate the duplicate prevention and one at a time introduction system, subject to periodic review.

Marketing suppression and opt out records

For as long as reasonably necessary to ensure we continue to respect an individual's request not to receive marketing.

Operational logs and technical records

For periods appropriate to their operational and security purpose.

Where information is no longer required, we will delete it or anonymise it so that it can no longer reasonably be associated with an identifiable individual.

10. Marketing communications

CapSage does not currently use information submitted through the assessment to send marketing emails or SMS messages.

Using the CapSage assessment service or being introduced to a Funding Provider does not subscribe you to CapSage marketing.

Submitting a Funding Provider application does not subscribe you to CapSage marketing.

CapSage may introduce marketing communications in the future. Where consent or another specific requirement applies to email, SMS or other electronic marketing, we will implement the appropriate permission and opt out mechanisms before sending those communications.

Any marketing permission will be separate from any authority or consent required to process a funding enquiry or introduce a business to a Funding Provider.

You will not be required to agree to receive marketing communications in order to use the CapSage assessment service.

You can withdraw marketing consent or object to direct marketing at any time.

11. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include controls appropriate to the nature of the CapSage service and the technology used to provide it.

However, no internet based system can guarantee absolute security.

You are responsible for ensuring that information you provide to CapSage is accurate and that you use email addresses and mobile numbers that you are authorised to access.

12. Your data protection rights

Depending on the circumstances and the lawful basis on which your information is being used, you may have rights including:

• access, to request a copy of personal information we hold about you;
• rectification, to ask us to correct inaccurate or incomplete information;
• erasure, to ask us to delete personal information in certain circumstances;
• restriction, to ask us to restrict the way we use your information in certain circumstances;
• objection, to object to certain uses of your personal information;
• data portability, to request certain information in a portable format where the legal requirements for this right are met; and
• withdrawal of consent, where we rely on consent, to withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Some rights are subject to exemptions or limitations and may not apply in every situation.

To exercise a data protection right, contact:

privacy@capsage.co.uk

We may need to ask for information necessary to verify your identity before acting on a request.

Your right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.

You have the right to object at any time to the use of your personal information for direct marketing purposes.

13. Complaints

If you have a concern about how CapSage uses your personal information, please contact us first at:

privacy@capsage.co.uk

We will try to resolve your concern.

You also have the right to lodge a complaint with a data protection supervisory authority. Daddy Marketing Resources Limited is established in Malta, where the supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC). Depending on the circumstances and the data protection law applicable to the processing, you may also have the right to complain to another competent supervisory authority.

14. Information about other people

If you provide personal information about another person to CapSage, you must ensure that you are authorised to provide that information and that doing so is lawful.

Please do not provide personal information about another person unless it is genuinely necessary for your business funding enquiry or Funding Provider application.

15. Accuracy of information

You should provide information that is accurate and complete to the best of your knowledge.

CapSage's assessment and Funding Provider matching are based on the information supplied to us.

Providing inaccurate or incomplete information may affect the recommendation made, whether an enquiry qualifies or whether an appropriate Funding Provider can be identified.

If you are applying to become a CapSage Funding Provider, inaccurate or incomplete information may affect our ability to review your application or whether the application is approved.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• the CapSage service;
• the information we collect;
• the organisations we work with;
• our technology; and
• applicable law or regulatory guidance.

The latest version will be published on capsage.co.uk and will show the date it was last updated.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected users where required.

17. Contact us

CapSage is operated by:

Privacy enquiries: privacy@capsage.co.uk

Customer support: support@capsage.co.uk