Privacy policy

Cash Train loans are provided by Credicorp Limited (company number 16093826), registered in England & Wales at Suite AU31848, 9 Skyport Drive, Harmondsworth, West Drayton UB7 0LB.

The Cash Train brand and website are operated by CM Beyer Limited (company number 17009212). CM Beyer Limited and Credicorp Limited are joint data controllers for personal data collected through the Cash Train website and application process.

For all data protection enquiries: [email protected]

Depending on how you interact with us, we may collect:

• Identity data: first name, last name, date of birth, gender (where disclosed)
• Contact data: email address, UK mobile number, home postal address
• Financial data: monthly income (net), monthly outgoings and existing credit commitments, bank account details (sort code and account number, for loan disbursement and direct debit), Open Banking transaction data (where you provide consent)
• Application data: loan amount requested, term, purpose of loan, employment status, residential status
• Credit data: information returned from soft and hard credit searches with credit reference agencies
• Account data: login credentials, account settings, repayment history, correspondence records
• Device and usage data: IP address, browser type, pages visited, time on site — collected via anonymised analytics that do not use cookies or identify you personally

We collect only what we need. We do not require you to provide data that is not relevant to your loan application.

We use your personal data for the following purposes:

4.1 Soft search: When you request a quote, we perform a soft credit search with one or more credit reference agencies (CRAs). This search is visible on your own credit report when you view it, but it is not visible to other lenders and has no impact on your credit score.

4.2 Hard search: If you proceed to a full application after accepting a personalised offer, we will conduct a full credit search. This will be recorded on your credit file and is visible to other lenders. We will always tell you before a hard search is conducted.

4.3 The credit reference agencies we use may include Experian, Equifax and TransUnion. They will each receive a record of our search whether or not your application is successful. They use this data in the way described in their own privacy notices, which can be found at experian.co.uk, equifax.co.uk, and transunion.co.uk.

4.4 During the life of your loan, we will report your repayment behaviour to credit reference agencies. On-time payments may improve your credit score; missed payments or default will be recorded and may harm it.

With your explicit consent, we may use a regulated Open Banking provider to retrieve read-only access to your personal current account transaction history. We use this data to verify your income and outgoings as part of our affordability assessment.

We never see or store your online banking login credentials. Our Open Banking partner is separately authorised by the FCA as an Account Information Service Provider (AISP).

You can withdraw your Open Banking consent at any time through your bank’s connected apps or third-party access settings. Withdrawing consent after your loan has been issued will not affect your loan agreement.

We may share your personal data with:

• Credicorp Limited / CM Beyer Limited — as joint controllers, data is shared between entities as needed to provide the service
• Credit reference agencies — Experian, Equifax, TransUnion — for credit checks and ongoing reporting
• Open Banking providers — FCA-authorised, for read-only access to transaction data with your consent
• Fraud prevention agencies — to prevent, detect and investigate fraud
• HMRC and other regulators — where we are legally required to disclose
• Debt collection agencies — in the event of default, where necessary to recover outstanding amounts
• Technology and payment processors — who process data on our behalf under data processing agreements, including our banking partner for direct debit collection
• The Financial Ombudsman Service — if you raise a complaint that is referred to them

We never sell your personal data to third-party marketers or data brokers.

We retain your data for the following periods:

• Application and loan data: 7 years from the end of your loan (required by financial services regulations)
• Marketing consent records: until you withdraw consent, plus 2 years from withdrawal to maintain an audit record of your consent and its withdrawal in accordance with our accountability obligations under UK GDPR Article 5(2)
• Website analytics data: 26 months (anonymised, no personal identifiers)
• Complaint records: 3 years from resolution (in line with financial services complaint-handling best practice)

After the applicable retention period, your data is securely deleted or anonymised.

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data, subject to our legal retention obligations
• Right to restrict processing — ask us to pause processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests, including direct marketing
• Rights related to automated decision-making — where we use automated decisioning, you can request human review of any decision that significantly affects you

To exercise any of these rights, email [email protected]. We will respond within one month.

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We use automated systems to assess loan applications, including credit scoring and affordability modelling. These systems analyse data including your credit history, income, outgoings and the loan amount you have requested to reach an initial decision.

If you are declined based solely on automated processing, you have the right under UK GDPR Article 22 to request human review of that decision. Contact us at [email protected] to request a manual review.

Our website uses strictly necessary cookies only (for session management and security). We do not use advertising cookies, retargeting cookies, or any cookies that track your behaviour for commercial purposes.

We use a privacy-respecting analytics tool that does not set cookies and does not process personal data. See our Cookie Policy for full details.

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (256-bit encryption). Access to personal data is restricted to authorised personnel only, on a strict need-to-know basis, and is logged.

If you suspect your account has been compromised or you wish to report a security concern, contact us at [email protected] immediately.

We may update this policy when required by changes in law, regulation, or our data practices. Where changes are material, we will notify you by email or by a prominent notice on our website at least 30 days before the change takes effect. The date at the top of this page always shows the most recent revision.