Data Protection Policy
UK GDPR · Data Protection Act 2018 · PECR. How we protect the personal data entrusted to us by customers, partners and staff. For a plain summary of how we use your data, see our Privacy Notice.
OneCloud Pvt Ltd trading as FundingNearMe · Company no. 16991609 · ICO ZC130857 · Last updated 6 November 2026
| Data controller | OneCloud Pvt Ltd, trading as FundingNearMe |
| Company number | 16991609 (registered in England and Wales) |
| Registered office | Jhumat House, 160 London Road, Barking, IG11 8BB |
| ICO registration | ZC130857 |
| Data protection contact | Data Protection Lead, hello@servingfoxes.co.uk · 020 8097 8468 |
1. Purpose, scope and legal framework
This policy explains how OneCloud Pvt Ltd, trading as FundingNearMe, collects, uses, shares, protects and disposes of personal data in line with UK data protection law. Compliance is mandatory for everyone within its scope: all directors, employees, contractors, agents, introducers, temporary staff and volunteers who handle personal data on our behalf, wherever they work.
It covers all personal data we process in any format (digital, paper, phone recordings, WhatsApp and other messaging, CRM and email) about prospective and existing customers (including directors and named contacts), website visitors, guarantors named in applications, partners' staff, and our own employees, applicants and contractors.
It is based on the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the Data (Use and Access) Act 2025, and guidance from the Information Commissioner's Office (ICO).
2. Roles, responsibilities and definitions
| Role | Responsibilities |
|---|---|
| Board of Directors | Approves this policy, resources compliance, receives an annual data protection report, signs off high-risk processing |
| Data Protection Lead | Maintains the Record of Processing Activities, handles rights requests and complaints, manages breaches, runs impact assessments, reviews supplier contracts, liaises with the ICO, delivers training |
| IT / systems owner | Access control, encryption, backups, device management, security incident response |
| All staff and contractors | Follow this policy, complete training, report breaches and rights requests immediately, ask when unsure |
We are not currently required to appoint a statutory Data Protection Officer, because our core activities do not involve large-scale monitoring or large-scale special category data. The Board reassesses this each year.
Our role. We are a controller for our own customer, lead, marketing and HR data. When we pass a customer's details to a lender, that lender usually becomes a separate controller. Software and service providers we use (such as CRM, telephony, email, website hosting and company lookup) are our processors.
3. Data protection principles
| Principle | What it means at FundingNearMe |
|---|---|
| Lawfulness, fairness and transparency | Every activity has a lawful basis. Forms, call scripts and WhatsApp replies explain or link to our Privacy Notice. We never mislead people about who we are or that we are paid commission by lenders. |
| Purpose limitation | Data collected for one enquiry is used for that enquiry and related servicing. Using it for anything else needs a compatible purpose or consent and must respect marketing rules. |
| Data minimisation | We collect only what an eligibility check or application genuinely needs. We do not ask for bank details or ID "just in case". |
| Accuracy | We confirm details with the customer before submitting to a lender, and correct errors promptly. |
| Storage limitation | We keep data only for the periods in section 8, then delete or anonymise it. |
| Integrity and confidentiality | We protect data with appropriate technical and organisational measures (section 7). |
| Accountability | We keep records of processing, lawful basis assessments, impact assessments, consents, contracts, training and breaches. |
4. Personal data we process and lawful bases
| Activity | Typical personal data | Lawful basis |
|---|---|---|
| Eligibility checks and enquiries (website, phone, email, WhatsApp) | Name, business name, phone, email, postcode, Companies House number, eligibility check answers | Steps prior to a contract at the person's request; legitimate interests for business contacts |
| Business finance introductions | Directors' and guarantors' details, address history, ID documents, bank statements, credit history, financial information | Steps prior to a contract; legal obligation for anti-money laundering checks |
| Call recording | Voice, call content | Legitimate interests (callers are told at the start) |
| Complaints | Contact details, complaint details, correspondence | Contract; legal obligation |
| Marketing | Name, email, phone, business name, preferences | Consent or legitimate interests, subject to PECR |
| Website and cookies | IP address, device data, cookie identifiers, analytics | Consent for non-essential cookies |
| Reviews and testimonials | Name, business, review content | Consent before publishing |
| HR and recruitment | CVs, contracts, payroll, right-to-work, absence, performance | Contract, legal obligation, legitimate interests |
Legitimate interests. Before relying on legitimate interests we complete a Legitimate Interests Assessment (purpose, necessity and balancing tests).
Consent. Consent must be freely given, specific, informed and unambiguous, given by a clear positive action (no pre-ticked boxes), recorded, and as easy to withdraw as to give.
Special category data. We do not ask for health or other sensitive data for finance introductions. If a customer tells us about their circumstances so we can support them, we record it only with explicit consent, restrict access, and never send it over WhatsApp or unencrypted email.
Criminal offence data. Finance applications may ask about unspent convictions. We process this only for that application, under a DPA 2018 Schedule 1 condition.
Automated decisions. We do not make decisions with legal or similarly significant effects based solely on automated processing. Lenders may; their privacy notices explain this.
5. Sharing, processors and international transfers
We share personal data only with recipients who need it to deliver what the customer asked for, under a written agreement:
- Lenders and finance providers on our panel (separate controllers)
- Credit reference and fraud prevention agencies, usually through the lender
- Regulators and ombudsmen where required
- IT and service providers such as CRM, telephony and call recording, email, cloud storage, e-signature, WhatsApp Business, website hosting and form handling, company lookup and analytics (our processors)
- Professional advisers, auditors and insurers; police, HMRC or courts where the law requires
We never sell personal data, and we do not share leads with third parties for their own marketing without consent. We send only the data a recipient needs, use secure portals or encrypted email for ID and bank documents, have Article 28 contracts with every processor, carry out due diligence before onboarding suppliers, and check that leads from introducers were collected lawfully.
International transfers. Personal data may only leave the UK where the destination has UK adequacy regulations, an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place with a transfer risk assessment, or a specific Article 49 exception applies.
6. Individuals' rights
Any request about personal data, however it arrives, is passed to the Data Protection Lead the same working day. We support the rights to be informed, access, rectification, erasure, restriction, portability, objection (including stopping direct marketing immediately), and rights around automated decision-making.
- We verify identity proportionately and do not demand excessive ID.
- We respond without undue delay and within one month, extendable by two further months for complex requests (we tell the person within the first month).
- Requests are free unless manifestly unfounded or excessive, and every request is logged.
We acknowledge data protection complaints within 30 days, investigate them, and tell the person the outcome and their right to complain to the ICO (ico.org.uk, 0303 123 1113).
7. Security and personal data breaches
We protect personal data with measures proportionate to the risk, including multi-factor authentication on email, CRM, cloud storage and telephony; role-based access; encryption of devices and stored data; encrypted transfer of ID and bank documents; company-managed devices; WhatsApp Business only on company accounts; clear desk and screen locking; confidential shredding; regular patching, anti-malware and tested backups; removal of leavers' access on their last day; and an annual review against Cyber Essentials as a minimum.
Any suspected breach is reported to the Data Protection Lead immediately. We contain it, assess the risk, notify the ICO within 72 hours where there is a risk to individuals, tell affected individuals without undue delay where the risk is high, notify affected partners, and record every breach in our breach log.
8. Retention
| Record | Retention period |
|---|---|
| Enquiries and eligibility checks that did not proceed | 12 months from last contact |
| Finance files | 6 years after completion; AML / ID records 5 years after the relationship ends |
| Call recordings | 12 months, or until a complaint is closed plus 6 years |
| Complaints | 6 years after closure |
| Marketing consent and suppression list | While marketing continues; suppression list kept so opt-outs are honoured |
| Website analytics | 14 months |
| Unsuccessful job applicants | 6 months after the decision |
| Employee records | 6 years after employment ends |
9. Marketing
- Limited companies and LLPs: emails and texts are permitted without prior consent if the person is identified, the message is relevant to their role, and every message has a simple opt-out.
- Sole traders and partnerships: only with prior consent, or under the "soft opt-in" for existing customers, with an opt-out at collection and in every message.
- Calls: we screen every number against TPS, CTPS and our own suppression list and never call registered numbers without specific consent. We never make automated calls without specific prior consent, and always display our caller ID.
- We honour opt-outs within 48 hours.
10. Privacy by design and governance
We consider data protection at the start of any new service, system, supplier or campaign. A Data Protection Impact Assessment is completed before introducing new technology such as automated lead scoring or any other high-risk processing. If a high risk cannot be reduced, we consult the ICO first.
We pay the ICO data protection fee annually, train all staff at induction and every year (sales and call teams also complete PECR training), and review this policy every 12 months or sooner if the law, ICO guidance or our services change. Breaching this policy may lead to disciplinary action, and deliberately or recklessly obtaining or disclosing personal data without authority can be a criminal offence under section 170 of the Data Protection Act 2018.