Privacy Policy

This Privacy Policy explains how Steller Investment & Finance Solution LTD (trading as Steller Finance) ("Steller Finance", "we", "us" or "our") collects, uses, stores and shares personal data and your rights under applicable UK data protection laws (including the Data Protection Act 2018 and other related legislation). This Policy applies to personal data processed in connection with our Website (stellerfinance.co.uk), our Services and any communications between you and us.

1. Controller

Steller Investment & Finance Solution LTD is the data controller for personal data collected through our Website and Services. Contact details:
Address: 22 Gunnersbury Crescent, Acton, London, United Kingdom, W3 9AA
Email: loans@stellerfinance.co.uk
Phone: +44 020 3951 2735

2. Data We Collect

• Identity data: name, date of birth, gender.
• Contact data: postal address, email address, telephone numbers.
• Financial data: bank account details, payment card details, income details, salary, employer and tax information.
• Transaction data: details of products and services you have enquired about or obtained, loan amounts, repayment history.
• Credit and fraud data: credit history, credit scores, results of searches from credit reference agencies, fraud prevention records.
• Identity verification data: passport, driving licence, national ID, utility bills or other documentation used for KYC/AML checks.
• Technical and usage data: IP address, device information, browser type, pages viewed on the Website, cookies and other tracking technologies.
• Communications data: correspondence and call recordings when you contact us for support or complaints.
• Sensitive data: in limited circumstances we may process special category data (e.g., health details in relation to certain hardship claims). We will only process such data where lawful and necessary and with appropriate safeguards.

3. Sources of Personal Data

• Lenders and partner firms.
• Credit reference agencies (e.g., Experian, Equifax, TransUnion).
• Fraud prevention agencies and sanctions lists.
• Publicly available sources (e.g., Companies House).
• Payment processors and banks.

4. Purposes and Legal Bases for Processing

We process personal data for the following purposes, relying on the legal bases indicated:

• 4.1 To provide and administer Services (Contractual necessity): processing is necessary to perform the Service you request, such as submitting applications to lenders, managing your application and communicating with lenders.
• 4.2 Credit and affordability assessments (Contractual necessity and/or Consent): necessary to assess your eligibility for credit and perform affordability and creditworthiness checks with credit reference agencies.
• 4.3 Identity verification, AML and fraud prevention (Legal obligation and/or Legitimate interests): to comply with anti-money laundering legislation, sanctions screening and to prevent fraud.
• 4.4 Marketing communications (Consent and/or Legitimate interests): where you have consented, we may send you marketing by email or SMS; in other cases we may rely on legitimate interests to send relevant non-electronic marketing with an opportunity to opt out. We will always respect your marketing preferences.
• 4.5 Customer service, complaints handling and dispute resolution (Contractual necessity and Legitimate interests): to respond to enquiries, manage complaints and improve our services.
• 4.6 Legal and regulatory compliance (Legal obligation): to comply with laws, regulatory requirements (including FCA obligations), tax authorities, law enforcement and court orders.
• 4.7 Analytics and website improvement (Legitimate interests): to analyse Website usage, improve functionality and security, and monitor performance.
• 4.8 Record-keeping and accounting (Legal obligation and Legitimate interests): to maintain business records, fulfil accounting obligations and to establish, exercise or defend legal claims.

5. Credit Checks and Automated Decision Making

5.1 Credit reference agencies: When assessing an application we may share personal data with credit reference agencies (CRAs). CRAs will supply information such as credit scores and public records to lenders and will record searches on credit files which may be visible to other organisations and affect credit scores.

5.2 Automated decisions: Some aspects of credit assessment by lenders may involve automated decision-making and profiling. We will advise you where automated decision-making is used and provide information on your rights in relation to such processing. Where required by law, we will obtain your explicit consent before processing that results in a solely automated decision producing legal or similarly significant effect.

6. Sharing Personal Data

We will share personal data with third parties where necessary for the performance of Services or where required by law, including:

• Lenders and their agents (for application processing and credit decisions).
• Credit reference and fraud prevention agencies.
• Payment processors and banks (for payment and disbursement).
• Professional advisers, auditors and service providers who assist us in delivering Services.
• Regulators, law enforcement agencies and tax authorities where legally required.
• Third parties involved in disputes, legal proceedings or collections where applicable.

We require third parties to handle personal data securely and only for specified purposes. Where third parties process data on our behalf, they will do so under written contracts and appropriate safeguards.

7. International Transfers

We may transfer personal data to countries outside the UK (including the EEA, or to service providers operating in jurisdictions such as the United States). Where transfers occur, we will ensure appropriate safeguards are in place, such as:

• Use of UK/UK-approved Standard Contractual Clauses;
• Transfers to countries with adequacy decisions;
• Binding corporate rules or other lawful transfer mechanisms.

We will ensure onward transfer safeguards are documented and available on request.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including to meet legal, regulatory and accounting requirements. Typical retention periods may include:

• Application records: for the period required by FCA rules and for at least 6 years after the end of a business relationship.
• Transaction and payment records: for statutory accounting and tax purposes, usually 6 years.
• Marketing data: until consent is withdrawn or on an opt-out request.
• Complaint and regulatory records: for at least the period required by regulatory rules (commonly several years).

Specific retention periods will be determined based on the nature of the data and legal obligations. Please contact us for details of exact retention durations.

9. Your Legal Rights

Under UK data protection law you have the following rights in relation to personal data we hold about you (subject to applicable exemptions):

• Right of access: obtain copies of your personal data and information about how it is processed.
• Right to rectification: require us to correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of personal data where processing is no longer necessary or where you withdraw consent, subject to legal exceptions.
• Right to restrict processing: request restriction of processing in certain circumstances.
• Right to data portability: receive personal data you provided to us in a structured, commonly used and machine-readable format.
• Right to object: object to processing based on legitimate interests or direct marketing.
• Rights with respect to automated decision-making and profiling: where decisions are based solely on automated processing, request human intervention or contest the decision, where applicable.

To exercise any of these rights please contact our Data Protection Contact at: [INSERT CONTACT EMAIL/ADDRESS]. We will respond within one month of receipt of the request (or longer where permitted by law) and may require identity verification.

10. Cookies, Tracking and Electronic Communications

10.1 Cookies

We use cookies and similar technologies to operate and provide our Website, to understand usage patterns and to personalise content. Our Cookie Policy (link) explains the types of cookies used, their purpose and how to manage preferences.

10.2 Electronic marketing (PECR)

When sending marketing communications by electronic means (email, SMS) we will comply with the Privacy and Electronic Communications Regulations (PECR). We will only send direct electronic marketing where we have consent or where a legitimate interest applies and you have been given an opt-out.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. Measures include encryption, access controls, secure servers and staff training. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

12. Children and Minors

Our Services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us so we can promptly delete the data and take appropriate steps.

13. Marketing and Communications Preferences

You may opt out of receiving marketing at any time by following the unsubscribe instructions in the communication or by contacting us at [INSERT CONTACT]. Even if you opt out of marketing, we may still send you non-marketing transactional messages about your account or applications.

14. Complaints

If you have a complaint about how we process your personal data, please contact our Data Protection Contact in the first instance at [INSERT]. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk.

15. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. We will publish the updated policy on the Website with the effective date. Where changes are material, we will notify impacted users.

16. Contact Information

Data Protection Contact / Privacy Officer: [INSERT NAME OR TITLE]
Email: [INSERT]
Postal address: [INSERT REGISTERED OFFICE ADDRESS]
Phone: [INSERT]

17. Automated Decision Making and Profiling

Some lenders may use automated decision-making or profiling to assess creditworthiness or affordability. We will notify you where such processing is in place and provide information about the logic and the potential impact of the processing. You may request human review of such decisions when permitted.

18. International Users

If you are accessing our Services from outside the UK, please note that data transferred to and processed in the UK will be subject to UK data protection laws. By using our Services you consent to the transfer of your personal data to the UK and other jurisdictions where we operate or where our service providers are located.

19. Third-Party Links

Our Website may contain links to third-party websites. This Privacy Policy only applies to data collected by Steller Finance. We are not responsible for the privacy practices of third-party sites and you should review their privacy policies.

20. Legal Basis for Processing Summary

• Contractual necessity: processing to perform a contract or take steps at your request prior to entering into a contract (e.g., processing an application).
• Legal obligation: processing to comply with legal obligations (e.g., AML, tax, regulatory obligations).
• Legitimate interests: processing necessary for our legitimate interests (e.g., fraud prevention, internal analytics), balanced against your rights.
• Consent: where you have provided consent (e.g., for marketing or certain cookies). You may withdraw consent at any time.

21. Retention and Disposal

We retain personal data only for as long as necessary. When data is no longer required we securely delete or anonymise it in accordance with our data retention policy and legal obligations.

22. Data Protection Impact Assessments (DPIAs)

We conduct DPIAs where processing is likely to result in high risk to individuals’ rights and freedoms (for example, large-scale profiling). DPIAs help identify and mitigate privacy risks.

23. Data Processors

We use third-party data processors to provide certain services (hosting, analytics, payment processing). Where we engage processors, we have contracts in place requiring them to implement appropriate security measures and to process personal data only on our instructions.

24. Security Breach Notification

In the event of a personal data breach affecting your data, we will comply with our legal obligations to report the breach to the ICO where required and, where the breach is likely to result in a high risk to individuals’ rights and freedoms, we will notify affected individuals without undue delay.

25. Contact and Queries

If you have questions about this Privacy Policy, wish to exercise your rights, or wish to make a complaint, contact our Data Protection Contact:
Email: loans@stellerfinance.co.uk
Address: 22 Gunnersbury Crescent, Acton, London, United Kingdom, W3 9AA
Phone: +44 020 3951 2735