Privacy Notice

Last updated 7 September 2026

CreditRefPro holds identity, income, asset, credit and repayment information about people applying for credit. This notice says what we hold, why, who sees it, and what you can do about it. It describes what the platform actually does rather than what it reserves the right to do.

Who is responsible

The platform is operated by legal entity name to be confirmed at registered address to be confirmed .

Participating lenders and your employer are each responsible for their own use of the information they receive. When a lender decides whether to make you an offer, or your employer processes a deduction you authorised, they are acting on their own account and not on ours.

What we hold

Identity and contact

Your name, email address, telephone number, employee reference where you have one, and the identity document you provided with an application.

Financial information

Income you declare and the evidence you upload for it, assets, existing loans and obligations, and the affordability figures calculated from them.

Employment

Your employer, your payroll details where your employer participates, and the deduction capacity available from your pay.

Credit activity

Your CreditRefPro Score and the factors behind it, your loan requests, the offers you received, which you accepted or declined, and your repayment record.

Consents

Every confirmation you gave with a one-time code: what you agreed to, in the words shown to you at the time, when you agreed, which version of the terms was presented, and the lender and loan request it applied to.

Access records

Every time your records are read, changed, approved or deducted from — who did it, when, from what address, and under what authority.

Technical

Your IP address and browser identification when you sign in or confirm an action, kept as part of the record of that action.

Where it comes from

Most of it comes from you. Some is confirmed by your employer, which is the point of the platform: income that has been confirmed by the organisation paying it is worth more than income asserted on a form. Some may come from a bank, payroll provider or identity provider where you have authorised that connection, and some from a lender reporting what it received.

Why we hold it

Because you asked us to

Building your profile, calculating your score, and putting a request in front of lenders all happen because you started them.

Because you confirmed it

Seven actions need a one-time code: activating your account, sharing your information, submitting a loan request, accepting an offer, authorising a payroll deduction, allowing an application to read your profile, and important changes to your account. Nothing in those categories happens without one.

To run the service

Keeping accounts secure, calculating what is owed in platform fees, investigating disputes, and keeping the records that let us answer a question about any of it later.

Because the law requires it

Some records must be kept and some must be produced on request. Which ones depends on applicable jurisdiction to be confirmed .

Who else sees it

Lenders

A lender sees your profile when you apply to that lender, and not before. Applying is what creates the relationship; browsing does not.

Your employer

Your employer confirms your employment and pay, and processes deductions you have authorised. It does not see your wider financial history, your score, or which lenders you approached.

Service providers

Providers that deliver a one-time code, verify an identity or move a payment see what they need for that task. Which providers are in use is configured by the platform administrator and recorded.

Nobody else

We do not sell your information, and we do not share it for advertising.

How it is separated

Separation is enforced by the system rather than by policy. One organisation cannot read another’s records even when supplying an identifier directly, a borrower reads only their own, and an unauthenticated request reads nothing at all. That behaviour is covered by automated tests that run on every change.

How long it is kept

Your audit trail and your consent records are permanent. They cannot be edited or deleted — not by us, not by an administrator, and not through a database client, because the database itself refuses the operation. That is deliberate: a record of what you agreed to is only worth having if it cannot be quietly changed afterwards, and the same is true of a record of who read your file.

Other records are kept for as long as needed for the purpose above and then for retention period to be confirmed .

What you can do

See your own record

Your audit trail and your consents are in your account. You do not need to ask us for them.

Correct something wrong

You can raise a dispute on incorrect personal or income information, missing payments, incorrect balances, unauthorised or incorrect deductions, duplicate transactions and incorrect repayment statuses. The issue is routed to whoever is responsible for it, and the investigation and its outcome are recorded. A correction is added beside the original rather than replacing it, so the history stays intact.

Withdraw a permission

Standing permissions — sharing your information, authorising a deduction — can be withdrawn from your account. The permission ends; the record that it existed, and until when, remains.

Ask us anything else

Write to info@creditrefpro.com. Your rights to access, correction, deletion, portability and objection, and where to complain if we get it wrong, depend on applicable data protection law to be confirmed .

Security

Access is limited by role and by organisation. Sensitive actions need a one-time code. Provider credentials are encrypted and are never shown back on screen once saved. When we call a provider we record which provider, which endpoint, how long it took, whether it worked and which record it concerned — and never the credentials or the contents of the message.

Money

CreditRefPro does not provide loan funds, accept deposits, hold customer money, guarantee repayment or collect debts. There is no account here holding anything of yours. Funds move directly between you, your lender, your employer and any payment provider involved.

Changes

When this notice changes we will update the date at the top. Where a change affects what you have already agreed to, you will be asked to confirm again rather than being taken to have accepted it silently.