INTRODUCTION
Choosing to enter into a relationship with GOCAP means you've placed a great deal of trust in us. In sharing your personal information, we hope you will benefit from a tailored and convenient experience. With trust comes responsibility and we take this responsibility very seriously.
This Privacy Notice helps you to understand how we use your personal information, who we share it with and the rights that you have. For more information on your rights and how to exercise them, head straight to the Your Rights section later in this document.
This Privacy Notice applies to any engagement you have with GOCAP or if you otherwise share your personal information with us, for example if you contact us with a query or we send you any marketing communications.
We change the terms of this Privacy Notice from time to time and you should check it regularly. The last updated date is shown at the end of the document. If we make any material changes, we will take steps to bring it to your attention.
By 'We' or 'Us', we refer to our firm, GOCAP LTD which uses the trading name 'GOCAP'. We are registered in England and Wales at the Registered Address: Finchley Park, Emmet Hall Lane, Laddingford, Kent ME18 6BG.
By 'You', 'your' or 'yours' we mean the user of this website and the individual/customer that may seek to access, or has accessed, our services.
We are Authorised and Regulated by the Financial Conduct Authority. Our Firm Reference Number is 958804 and you can check our registration by visiting https://register.fca.org.uk/s/ .
For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, GOCAP LTD is generally the controller of the personal data described in this Privacy Notice. This means that we decide why and how that personal data is processed.
Some of the organisations that provide services to us act as our processors and process personal data only on our documented instructions. Other organisations, including credit reference agencies, may act as separate controllers because they determine their own purposes and means of processing. We explain these arrangements in the "Recipients of Personal Data" section.
We are registered with the Information Commissioner's Office, Registration Number: ZA874067.
Customers can contact us using the information provided below:
Our Privacy Policy concerns the website and our internal systems, controls and processes in how your personal data is used. Your privacy is very important, and we have set out below how we process any personal data collected from, or provided by you.
We may process your personal data for the following purposes:
| Basis | Description |
|---|---|
| Contract | This is where we process your information to fulfil a contractual arrangement we have made with you. |
| Consent | This is where we have asked you to provide explicit permission to process your data for a particular purpose. |
| Legitimate Interest | This is where we rely on our interests as a reason for processing, generally this is to provide you with the best products and service in the most secure and appropriate way. |
| Legal Obligation | This is where we have a statutory or other legal obligation to process the information, such as for the investigation of crime or to meet responsible lending criteria. |
The lawful basis we use depends on the particular processing activity.
We generally process identity, contact, financial and application information because it is necessary to take steps at your request before entering into a credit agreement and, if an agreement is entered into, to perform that agreement.
We process information for creditworthiness and affordability assessments because it is necessary to take steps at your request before entering into a credit agreement, to comply with our legal and regulatory responsible-lending obligations, and where applicable for our legitimate interests in making responsible, consistent and fraud-resistant lending decisions.
We process and share information with credit reference and identity-verification providers where necessary to take steps before entering into a contract, to comply with legal and regulatory obligations, and for our legitimate interests in verifying application information and preventing fraud and financial crime.
Access to your payment account information through Open Banking will only take place after you actively authorise the relevant regulated Open Banking provider to access the accounts you select.
Your authorisation of the Open Banking connection is separate from the lawful basis on which GOCAP subsequently uses the information received. GOCAP generally processes the information to take steps at your request before entering into a credit agreement, to comply with responsible lending obligations, and for our legitimate interests in assessing affordability and preventing fraud.
You are not required to connect an account unless we tell you that the information is necessary to assess your application. If you do not provide information that is required for our assessment, we may be unable to complete your application or offer you credit.
Where you choose to allow us to connect to a third-party salary or employment-information service, the connection will be initiated only after you have completed the provider's authorisation or consent process.
GOCAP will use the information received to verify information supplied in your application, assess affordability, prevent fraud and comply with responsible lending obligations. Our lawful bases will generally be taking steps at your request before entering into a contract, compliance with legal obligations and our legitimate interests in verifying the accuracy of applications.
We may verify that an email address or mobile telephone number is valid, active, deliverable, associated with the information provided and not displaying indicators of fraud or misuse. We do this where necessary to take steps before entering into a contract and for our legitimate interests in preventing fraud, maintaining accurate contact information and communicating securely with applicants and customers.
We rely on consent only where consent is the appropriate UK GDPR lawful basis, for example for certain marketing activities or the voluntary recording of some special-category information. Where a third-party service requires you to authorise access to an account or data source, that authorisation does not necessarily mean that consent is GOCAP's UK GDPR lawful basis for all subsequent processing.
To withdraw consent, please see the contact information detailed within this Policy. Should consent be withdrawn for a particular purpose that we are relying on that consent to perform, we may be unable to provide you with our services or may be unable to tailor our services to your needs which may subsequently impact the service we provide.
Should you wish to unsubscribe from any marketing methods, you may do so by selecting the 'unsubscribe' link or by contacting us using the contact information described within this Policy.
We may receive special-category personal data where you voluntarily tell us about health, disability or other circumstances so that we can understand your needs, provide an appropriate service adjustment, support a vulnerable customer or manage an account fairly.
Where appropriate, we may ask for your explicit consent. In some circumstances, we may process this information without consent where the processing is necessary for reasons of substantial public interest under the Data Protection Act 2018, including safeguarding an individual's economic wellbeing, preventing fraud or complying with regulatory requirements, or where the information has been provided by you during the application process or updated by you in MyAccount. We will record only information that is relevant and proportionate.
We will not generally share information about a vulnerability or health condition with another organisation unless this is necessary to provide the requested support, administer the account, protect an individual, comply with the law, or you have authorised the sharing.
Where an identity-verification process uses facial images, liveness checks or facial comparison, an image is not necessarily biometric special-category data in every circumstance. It becomes biometric special-category data where it is processed through specific technical means for the purpose of uniquely identifying an individual. Before using such processing, we will identify the applicable condition under Article 9 UK GDPR, complete any required assessment and provide additional privacy information where appropriate.
You may provide us with your identity, contact and financial data by completing online forms or by corresponding directly with us via post, email or otherwise. This includes the personal data you provide when you:
You may also provide personal data when you:
Depending on the service used, the information collected may include:
When opening an account with us, we will ask for various pieces of information from you. This includes everything from your name and address, to your date of birth, email address (which will be the primary communication channel throughout the term of an Agreement) and more. Every piece of information we collect has its purpose. The table below explains how we use your information.
| Purpose / Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| To register you as a new customer |
|
Performance of a contract. |
|
Application administration and document creation To receive and administer your application; transfer information into application forms, pre-contract information and a proposed credit agreement; allow you to review and correct that information; and issue contractual documents. |
|
Taking steps at your request before entering into a contract; performance of a contract; compliance with legal obligations. |
|
Credit-reference and identity assessment To search credit-reference records, confirm your identity and address, check the accuracy of application information, detect fraud and assess creditworthiness. |
|
Taking steps at your request before entering into a contract; compliance with legal obligations; legitimate interests in responsible lending, identity verification and fraud prevention. |
|
Open Banking affordability assessment To obtain account and transaction information from accounts you select; identify income, expenditure, commitments, returned payments, gambling or other transaction categories where relevant; assess affordability; verify information provided in your application; and detect possible fraud or inconsistencies. |
|
Taking steps at your request before entering into a contract; compliance with legal and regulatory obligations; legitimate interests in responsible lending and fraud prevention. The bank connection itself requires your active authorisation through the Open Banking provider. |
|
Salary and employment verification To obtain consented salary, payroll, employment or income information; verify information provided in your application; identify inconsistencies; assess affordability; and prevent fraud. |
|
Taking steps at your request before entering into a contract; compliance with legal and regulatory obligations; legitimate interests in verifying applications and preventing fraud. |
|
Email address and telephone number verification To verify that contact details are valid, deliverable or active; identify possible errors, disposable addresses, virtual or high-risk numbers, recent changes, inconsistencies or fraud indicators; and enable secure communication. |
|
Taking steps at your request before entering into a contract; legitimate interests in preventing fraud, maintaining accurate records and communicating securely. |
|
Digital data capture through Yoti To collect or verify application information and transfer selected verified data into GOCAP's application journey and proposed credit agreement, reducing manual re-entry and helping us confirm that information is accurate. |
|
Taking steps at your request before entering into a contract; compliance with legal obligations; legitimate interests in accurate data capture, identity verification and fraud prevention. |
|
To manage our relationship with you Including notifying you about changes to our terms or Privacy Policy. |
|
Performance of a contract; necessary to comply with a legal obligation. |
|
To administer and protect our business and website Including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data. |
|
Legitimate interest (running our business, IT administration, network security, fraud prevention and business reorganisation); necessary to comply with a legal obligation. |
|
To deliver relevant website content and advertising To measure or understand the effectiveness of advertising. |
|
Legitimate interest (to study how customers use our products and services, develop them, grow our business and inform our marketing strategy). |
|
To use data analytics To improve our website, products, services, marketing, customer relationships and experiences. |
|
Legitimate interest (to define customer types, keep our website relevant, develop our business and inform our marketing strategy). |
|
To make suggestions and recommendations About goods or services that may be of interest to you. |
|
Consent. |
Applicants will be able to review and correct the information shown in the application and credit agreement before entering into the agreement.
We may obtain personal data about you from the following sources. The precise providers used may change. Where a provider is involved directly in an application journey, we will identify that provider at or before the point when information is collected or shared.
The provider-specific sections below (Open Banking and AccountScore, Yoti, Salary/Payroll and Employment Data, Verification of Contact Details, and Credit Reference Agencies) describe the main third-party sources from which we obtain personal data, together with the information involved and the reasons for obtaining it.
If you choose or are asked to provide information through Open Banking, you will be directed to an Open Banking journey provided through Equifax and its AccountScore and ConsentsOnline services, with the contracting entity being part of the Equifax group.
You will be asked to select your bank or account provider and complete its authentication process. GOCAP will not receive your online banking password or security credentials.
You control which available accounts are connected. The Open Banking provider may obtain account identifiers, balances and transaction information from the connected accounts. GOCAP receives raw transaction data, categorised transaction data and scores from this service. Up to 12 months of transaction history and up to 24 months of income data may be obtained.
We may use this information to:
Transaction categorisation may involve assigning transactions to categories such as income, housing costs, credit commitments, utilities, transfers, cash withdrawals, gambling or other spending types. A transaction category does not necessarily establish the exact purpose of an individual transaction, and relevant information may be reviewed or corrected where appropriate.
In relation to this service, AccountScore acts as a Data Controller.
Where you separately authorise continuing access, we may obtain updated account information during the term of your agreement to monitor salary, affordability or account servicing. We will clearly explain the duration and purpose of that access before you authorise it.
You may withdraw the relevant Open Banking authorisation through the provider or your bank, although this will not affect processing that lawfully occurred before withdrawal.
We use Yoti technology to collect, verify or transfer information into parts of our application journey and proposed credit agreement.
Depending on the particular Yoti service used, you may be asked to enter information, share selected information from a Yoti account or provide an identity document or other evidence.
Yoti may process the information on our behalf as a processor or, for some Yoti services, may process certain information as a separate controller. The role applying to your journey will be explained through the relevant Yoti privacy information presented during that journey.
Information returned to GOCAP may include verified identity attributes, information extracted from a document, the result of a verification check and information required to populate your application or proposed credit agreement.
We will use that information to:
You must review the information transferred into your application and credit agreement and tell us if anything is incorrect before entering into the agreement.
Where the Yoti journey involves a facial image, selfie, liveness check or facial comparison, GOCAP does not use facial images or biometric templates received through Yoti to identify you independently or for any purpose other than completing the relevant verification process.
[CONFIRM CONTRACTUALLY AND TECHNICALLY BEFORE RELYING ON THE ABOVE STATEMENT]
The controller or processor role that applies to your journey will be explained through the relevant Yoti privacy information. Where Yoti is unavailable to you, we will email you a PDF version for you to sign and return.
Where this option is available, we may invite you to use a third-party salary, payroll or income-verification provider to share verified salary, payroll, employment or income information with us.
The provider will explain what information it accesses, the source of that information and the authorisation that it requires from you. Depending on the service, the information may come from an employer, payroll platform, employment database, bank account, tax-related information source or another source identified to you during the journey.
We may receive:
We use the information to verify your application, assess affordability, meet responsible-lending obligations and identify possible fraud.
We will not obtain salary information through this service unless you complete the provider's authorisation process. However, where verified salary or income information is reasonably required to assess your application, we may be unable to proceed if you do not provide it through this service or another acceptable method.
We will identify the specific provider, and the information it accesses, at or before the point at which you are asked to use the service.
We may use a contact-verification provider to check the email address and mobile telephone number supplied in your application.
These checks may involve an outbound electronic connection, validation request, one-time passcode, confirmation link, network enquiry or other technical verification.
Depending on the service, the provider may return information indicating:
Unless we tell you otherwise, these technical checks do not give the provider access to the contents of your emails, text messages or telephone calls.
We use the results to correct errors, communicate securely, confirm possession or control of contact details and prevent fraud or impersonation. The specific check carried out may range from a simple deliverability check to more complex subscriber matching or SIM-swap analysis, and we will use only what is necessary and proportionate to verify your contact details.
Throughout the provision of our service, we may need to disclose personal data to third parties. We have contracts in place with suppliers that help us to ensure the security and privacy of your personal information. These contracts are reviewed and updated regularly and in accordance with data-protection laws.
The categories of recipients of personal data are as follows:
We may also share your personal data with third-party funding partners, purchasers, assignees, transferees, securitisation vehicles, trustees, backup servicers, successor servicers, fund managers, administrators, custodians, auditors and professional advisers where this is necessary in connection with the funding, sale, transfer, assignment, securitisation, administration, servicing, collection or enforcement of your loan or any amounts you owe us.
In order to process your application, we will carry out credit-reference, identity and fraud checks with the principal UK Credit Reference Agencies, being TransUnion International UK Limited, Equifax Limited and Experian Limited.
We will supply personal information to the Credit Reference Agencies, including your name, date of birth, current and previous addresses and other application information. We may also provide information such as income, employment information, contact details and the amount and type of credit requested.
We may use Credit Reference Agency products and data blocks, such as CallValidate and CallReport, to verify your identity and assess your creditworthiness and affordability.
The Credit Reference Agencies will match that information against records they hold and may return:
We will use this information to:
We will continue to exchange information about you with the Credit Reference Agencies while you have a relationship with us, and we will report information about your account and its performance to them, including your settled accounts.
If you borrow and do not repay in full or on time, the Credit Reference Agencies will record the outstanding debt. This information may be supplied to other organisations by the Credit Reference Agencies.
We may also carry out periodic searches during your relationship with us to ensure your ongoing creditworthiness and affordability, and to enable us to apply appropriate pre-arrears measures and forbearance where needed.
Where we carry out a credit-application search, the Credit Reference Agencies may place a search footprint on your credit file. A credit-application search may be visible to other organisations and may be considered when they assess future applications.
Where we carry out an identity-only or quotation search, the effect and visibility of that search may differ. We will identify the relevant type of search in the application journey where required.
If you make a joint application or tell us about a spouse, partner or other person with whom you have a financial association, your records may be linked. You should discuss this with that person and make them aware of this Privacy Notice before providing their information.
Further information about how TransUnion, Equifax and Experian use and share personal data, their retention periods and your rights is contained in the Credit Reference Agency Information Notice ("CRAIN"). Current links to the applicable CRAIN and to the TransUnion, Equifax and Experian privacy information will be made available through our website and application journey.
Google Analytics is a service provided by Google, Inc. ("Google"). Google Analytics uses cookies to help us analyse how users use our website and mobile site.
The information generated by these cookies, including your truncated IP address, is transmitted to and stored by Google on servers in the United States.
Google will use this information for the purpose of evaluating your, and other users', use of our website, compiling reports for us on website activity and providing other services relating to website activity and internet usage.
The Google Analytics advertising features we use, and the insights they provide, are:
Please note that Google receives your truncated IP address. This is sufficient for Google to identify approximately the country from which you are visiting our sites or accessing our website, but is not sufficient to identify you, your computer or your mobile device individually.
You can find more information in Google's privacy information.
To opt out of analysis by Google Analytics on our website and other websites, please visit: https://tools.google.com/dlpage/gaoptout .
Some of our service providers, or members of their corporate groups, may store or access personal data outside the United Kingdom.
Where personal data is transferred to a country that is not covered by UK adequacy regulations, we will ensure that an appropriate transfer mechanism is in place. This may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another mechanism permitted by UK data-protection law.
Where required, we will also assess whether additional technical, contractual or organisational safeguards are necessary. Further information about the relevant safeguards is available by contacting us.
We use automated systems and profiling to help assess applications consistently, quickly and responsibly.
The information considered may include:
Our systems may compare this information with our lending criteria and calculate risk, affordability, identity or fraud indicators.
These indicators may affect:
Decisions about your application are generally made by solely automated means. Such a decision may have a legal or similarly significant effect on you, including declining an application or determining the amount, term, interest rate or other terms on which credit is offered.
We carry out this processing where it is necessary for entering into or performing a contract with you, subject to the safeguards required by data-protection law.
A person with authority to change the outcome will carry out a meaningful review where manual intervention is required for any reason. This may include circumstances where further information is needed, where you are or may be a vulnerable customer, or where our internal processes or Financial Conduct Authority regulatory requirements otherwise require human involvement.
Where a decision is made solely by automated means and has a legal or similarly significant effect, you may contact us to:
A request for human review does not guarantee that the original decision will change, but the review will be carried out by a person with appropriate authority and capability.
| Right | Description |
|---|---|
| Right to access | The right of access, commonly referred to as subject access, gives you the right to obtain a copy of your personal data as well as other supplementary information. It helps you understand how and why we are using your data and check that we are using it lawfully. |
| Right to rectification | You have the right to have inaccurate personal data rectified. You may also be able to have incomplete personal data completed, although this will depend on the purposes for the processing. We may ask you for evidence to show that the information is inaccurate. This may involve providing a supplementary statement to the incomplete data. |
| Right to erasure | In certain circumstances, you may ask us to erase your personal data. This right is not absolute. We may retain information where it remains necessary to comply with a legal or regulatory obligation, establish or defend legal claims, prevent fraud, maintain necessary account records or for another lawful reason. We will explain any applicable exception when responding to your request. |
| Right to restrict processing | In certain circumstances, you may ask us to restrict the processing of your personal data. Restriction generally means that we may retain the information but will not use it for most purposes while the restriction applies. This right may apply, for example, while we investigate a challenge to the accuracy of information or an objection to processing. |
| Right to data portability | You have the right to obtain and reuse your personal data for your own purposes across different services. This allows personal data to be copied or transferred from one IT environment to another safely and securely, without affecting the usability of the data. |
| Right to object | Under certain circumstances, you have the right to object to the processing of your personal data. Where we rely on legitimate interests, you may object to the processing on grounds relating to your particular situation. We may continue processing where we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is required for legal claims. You have an absolute right to object to processing for direct-marketing purposes. |
| Rights in relation to automated decision-making and profiling | We may use automated means and profiling to assess applications. Your rights in relation to this processing, and how to request human intervention, express your view and challenge a decision, are explained in the Automated Decision-Making and Profiling section above. |
| Right to be informed | You have the right to be informed about the collection and use of your personal data. Your right to be informed forms part of this Privacy Policy and includes the purposes for processing your data, our retention periods and who your information may be shared with. |
The above rights may be limited in some circumstances. For example, this may apply if fulfilling your request would reveal personal information about another person, if you ask us to delete information that we are required to retain by law, or if we have compelling legitimate interests to keep it.
We will let you know if that is the case and will then only use your information for the relevant permitted purposes. You may also be unable to continue using our services if you ask us to stop processing personal information that is necessary for us to provide those services.
In the context of your personal data, you have the right to lodge a complaint with the supervisory authority, the Information Commissioner's Office (ICO).
We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.
If you would like to make a complaint, please see our Complaint Policy.
We will only retain your personal data for as long as is necessary to fulfil our obligations under the provision of our services and for any purposes necessary to satisfy legal, accounting or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, and whether those purposes can be achieved through other means, taking into account applicable legal requirements.
The periods applied to particular records will depend on their purpose. Our retention schedule includes, or will identify, periods for:
Where possible, the published notice states the actual retention period. For example:
A copy of our detailed retention schedule, or further information about a particular category of information, is available on request.
By law, we are required to retain certain information about our customers. This information will be held securely and only for the purposes required by law.
You have the right to access your personal information, commonly known as making a Subject Access Request (SAR). This means you are entitled to obtain:
Our security procedures mean that we may request proof of identity before disclosing personal information in response to a request.
A third party may make a request on your behalf. We will require appropriate evidence that the third party is authorised to act for you. This may include written authority or a Power of Attorney.
If you make a request electronically, we will normally provide the information in a commonly used electronic format unless you request otherwise.
We may extend the time to respond by up to a further two months where your request is complex or where multiple requests have been made. If this is necessary, we will notify you within one month of receiving your request and explain the reasons for the extension.
We will respond to your Subject Access Request without undue delay and, in any event, within one month of receipt. The one-month period begins on the day after your request is received and ends on the corresponding calendar date in the following month.
Where appropriate, we may request proof of identity before responding. Any identification requested will be proportionate to the nature of your request and only where necessary to verify your identity.
In the vast majority of cases, there is no charge for responding to a Subject Access Request.
However, where a request is manifestly unfounded or excessive, we may charge a reasonable fee to cover the administrative costs of complying with the request.
A reasonable administrative fee may also apply where additional copies of information are requested after the initial copy has been provided.
A cookie is a small file of letters and numbers that is downloaded onto your computer or other device when you visit a website.
Cookies are used by many websites and can perform a variety of functions, such as remembering your preferences and helping website owners understand how visitors use their websites.
We use cookies on our website.
For more information about how we use cookies, please see our Cookies Policy.
Our website may contain links to other websites of interest.
Once you leave our website using one of these links, please note that we have no control over the other website. We cannot therefore be responsible for the protection and privacy of any information that you provide whilst visiting those websites, and such websites are not governed by this Privacy Notice.
You should exercise caution and review the privacy policy applicable to any website you visit.
Any changes we make to this Privacy Policy in the future will be published on our website and, where appropriate, notified to you by email.
This Privacy Policy was last updated on Wednesday, 29 July 2026.
Where we transfer, assign, sell or securitise your loan or any rights relating to it, GOCAP may continue to administer and service your loan unless we notify you otherwise. Any such sharing will be limited to what is necessary and will be carried out in accordance with applicable data-protection law.
We may share information with third parties to whom we choose to sell, transfer or merge parts of our business or assets. Alternatively, we may seek to acquire other businesses or merge with them. If such a change occurs, your personal data will continue to be used in the manner described in this Privacy Policy.
Some recipients act as processors and are contractually required to process personal data only on our instructions. Credit Reference Agencies and certain other providers may act as independent controllers for some processing.
Where a provider acts as an independent controller, its own privacy notice will explain its processing and your rights in relation to that provider.