Privacy notice addendum: LOE onboarding

Effective: 11 September 2026.

This addendum describes the personal data processing that occurs specifically in the Letter of Engagement (LOE) onboarding flow at bedrockfinance.co.uk/onboarding. It supplements our privacy policy and should be read alongside it.

What personal data we collect in the LOE flow

When you complete the LOE onboarding steps, we collect:

• Identity: full name, company name, director or guarantor name.
• Contact: email address, telephone number.
• Business: company registration number, registered address.
• Deal context: finance type, business sector, indicative facility amount.
• Qualification answers: whether other brokers are engaged, and target completion timeline.
• Clickwrap acceptance evidence: the SHA-256 hash of the LOE text you agreed to, the LOE version, the date and time of acceptance, your IP address at acceptance, and your browser user-agent string, captured automatically when you click “Accept and Proceed”.
• Session data: an anti-bot verification token, captured automatically during the onboarding session.

We do not collect payment details, passport or identity documents, or biometric data in this flow.

How we use this data

• To carry out the pre-contractual and contractual steps you have requested, specifically to arrange commercial finance on your behalf under the Letter of Engagement (lawful basis: contract).
• To maintain an evidentiary record of your acceptance of the LOE for dispute resolution and compliance purposes (lawful basis: legitimate interests).
• To transmit your contact and deal data to our CRM platform for lead management and case progression (lawful basis: contract).
• To send you a confirmation email with a copy of the LOE you accepted (lawful basis: contract).
• To notify Bedrock's operations team of your acceptance so we can begin work on your case (lawful basis: legitimate interests).

Retention

We retain your personal data, including the clickwrap evidence record, for six years from the date you accept the LOE, in line with the limitation period for contract claims under the Limitation Act 1980. If the facility subsequently completes and a fee is invoiced, the retention period runs from the date of that invoice. If you withdraw before a facility is arranged, we still retain your data for the same six-year period, because the evidence record remains relevant to any potential future dispute. After that, your data is securely deleted.

Sharing with third parties

We share your personal data with:

• Prospective lenders and funders: contact details, company details, and deal context, to obtain indicative terms and credit decisions on your behalf.
• Our CRM platform: name, contact details, company details, deal context, and LOE acceptance details, to create and manage your case record and store evidence of LOE acceptance.
• Resend (our transactional email provider): your email address and the content of the confirmation email, to deliver it.
• Cloudflare (anti-bot protection): browser-level data during the onboarding session, to verify you are a genuine human user.

We do not sell your personal data. We do not transfer your data outside the UK/EEA except to providers subject to adequacy decisions or standard contractual clauses.

Your rights

Under UK GDPR you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure, subject to our legal obligation to retain the clickwrap evidence record for the six-year limitation period.
• Object to processing based on legitimate interests.
• Request restriction of processing in certain circumstances.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@bedrockfinance.co.uk.

Data controller

Bedrock Commercial Finance Limited, company number 17407283, registered in England and Wales. Contact: info@bedrockfinance.co.uk.