Privacy policy

Kriya Finance Limited (“We”, “Us” and “Our”) are committed to protecting and respecting your privacy. We are registered with the Information Commissioner’s Office under registration reference Z2715796 and comply with the Data Protection Act 1988 and the EU General Data Protection Regulations (‘The Acts’). All personal data provided by you through kriya.co or through our online invoice discounting platform (our sites) is dealt with in accordance with the Acts.

This policy (together with our terms of use and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

Purpose of collecting and disclosing your personal data

As a peer-to-peer finance platform we collect information from you and from 3rd parties to allow us to perform our agreement with you and assess your eligibility for our services. We may also need this information to carry out due-diligence on you for financial risk, fraud risk and anti-money laundering purposes. Any processing of your data will be for the purposes of performing the services we’ve agreed to provide to you, or where otherwise identified for some other legitimate purpose. We also collect information from you when you visit our sites.

We may disclose information about you to 3rd parties where it is required in order for us to provide services to you, where we have a legal obligation to do so, or where you have given your consent. Please see the further information below.

More detail around the processing of your data is contained in schedule 1: Record of Processing

Information we may collect

Information we may collect from you includes the following:

• Information you give us. You may give us information about you by filling in forms on our sites or by corresponding with us by phone, e-mail or otherwise, including results of any surveys we carry out. This also includes information you provide when you register with us, sign up to an event or to receive our newsletters, or when you report a problem with our sites. The information you give us may include your name, address, e-mail address, phone number, passwords, financial information, personal descriptions, as well as any identification documents and photographs.
• Information we collect about you. With regard to each of your visits to our sites we may automatically collect the following information:

• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
• Cookies and tracking (see Cookies below).

• Information we receive from other sources. We may receive information about you if you use any of the other websites we operate or the other services we provide. We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies and fraud prevention agencies) and may receive information about you from them.
• Information available from public sources, including government registers, media sources and internet searches. For example, we collect information from Companies House which includes details of a company’s officers and shareholders.
• Information extracted from your accounts package. By integrating our platform with your accounts package, we receive data from your accounts package including debtor and creditors ledgers and contact details which will be used for the purpose of providing you with business finance products.
• Information about your business and any other details regarding your application when you are referred by a third party partner.

Third party data

Where you provide us with personal data relating to your employees, customers or third parties, this will be considered third party data. You are the existing data controller in respect of such data and you should ensure that you have the requisite consent or legitimate purpose to transfer that data to us. Further, you must be able to demonstrate that you are fully compliant with data protection legislation. You have an obligation to be transparent about how you process personal data and as such, should include details of who you share this data with e.g. Kriya.

We process third party data on the basis that we have a legitimate interest in preventing fraud and money laundering to protect our business and to comply with laws that apply to us.

Cookies

Our sites uses cookies to distinguish you from other users of our sites. This helps us to provide you with a good experience when you browse our sites and also allows us to improve our sites. By continuing to browse the sites, you are agreeing to our use of cookies.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our sites. They include, for example, cookies that enable you to log into secure areas of our sites.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our sites when they are using it. This helps us to improve the way our sites work, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to our sites. This enables us to personalise our content for you, greet you by name and remember your preferences.
• Targeting cookies. These cookies record your visit to our sites, the pages you have visited and the links you have followed. We will use this information to make our sites and the advertising displayed on them more relevant to your interests. We may also share this information with third parties for this purpose and for marketing purposes.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our sites.

Barclays Bank UK PLC (Barclays)

If you are a Barclays customer and have been referred to us under our partnership with Barclays we will share your data with them on an ongoing basis throughout the duration of your relationship with us. This will include the following information:

• Financial data including company name, registration details and the product held with us;
• Status of any application with us and whether the account is inactive, or whether trades have been funded;
• Details of any complaints raised you have raised with us;
• Information necessary for the prevention or reporting of money laundering, terrorist financing or financial crime along with details of any applicable remediation plans.

Uses made of the information

Information we hold about you may be used in the following ways:

• to allow us to provide finance products to your business as a seller of invoices or borrower on our platform, (‘Seller’);
• to allow us to provide an investment product to the buyers of invoices or lenders on our platform, (‘Investor’);
• to assess your eligibility for services we or our partners provide;
• to improve our sites and to ensure that content from our sites is presented in the most effective manner for you and for your computer;
• to administer our sites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to allow you to participate in any interactive features of our service, when you choose to do so;
• as part of our efforts to keep our sites safe and secure;
• to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you;
• to make suggestions and recommendations to you and other users of our sites about services that may interest you or them;
• to notify you about changes to our service;
• to verify your identity in order to prevent and detect money laundering and crime; and
• to carry out initial and ongoing regulatory and financial checks against all directors and shareholders of the Seller or Investor company.

Disclosure of your information

We may share your personal information with any member of our group, which means any subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We may share your personal, business or financial information with selected third parties including:

• Advertisers and advertising networks that require the data to select and serve relevant adverts to you that you request from us or that we think may be of interest to you.
• Analytics and search engine providers that assist us in the improvement and optimisation of our sites.
• Credit reference agencies and fraud prevention agencies as set out in the section below.
• Investors on our platform where the data is necessary for them to make a risk or credit decision or where they require it to recover funds from a Seller.
• Providers of extraction software that allow us to integrate and extract your business’ accounts package data.
• Processors of financial data that re-format bank statement information in a more accessible format.
• Brokerages, financial advisers and other providers who may be able to assist you in sourcing financing for your needs.
• Technology companies which provide us with software and solutions to store and process the data we need to operate our platform and manage our products.

We may disclose your personal information to third parties:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If Kriya Finance Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements (including the Kriya Rules where applicable); or to protect the rights, property, or safety of Kriya Finance Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Credit reference and fraud prevention agencies

In addition to the sections above dealing with the use and disclosure of your data, we may also disclose your business and personal data to credit reference agencies and fraud prevention agencies, where we have a legitimate interest in doing so. They may also give us information about you, such as about your financial history, to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity and this may leave a hard search footprint on your credit report. If you sign up as a Seller you will be notified of this during the application process.

The personal data provided to us to complete these checks includes for example, name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details.

Credit Reference Agencies (CRAs)

We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organizations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates.

The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at

• ‍https://www.experian.co.uk/crain
• Equifax: www.equifax.co.uk/crain
• TransUnion: www.transunion.co.uk/

Fraud

If we discover that you have provided us with false or inaccurate information and fraud is identified, your details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information to detect, investigate and prevent crime.

We and other organisations may also access and use the information recorded with fraud prevention agencies to prevent fraud and money laundering for example, when:

• We check details on applications of Sellers or when other organisations check details on applications for credit and credit related or other facilities;
• We manage accounts or facilities for Sellers or when other organisations manage credit accounts or other facilities;
• We or other organisations are recovering debts; and
• Other organisations check details on proposals and claims for insurance.

We and other organisations may access and use from other countries the information recorded by fraud prevention agencies.

We process your data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us.

Please contact us if you want to receive details of the relevant credit reference agencies and fraud prevention agencies.

Automated decision making

We use data and technology solutions to assess commercial and financial risks relating to applications for business finance and to make our business more efficient. This means that when you make an application on behalf of your business (as a Seller or Investor member of our platform) we may include your personal data in any risk models we use to assess that application.

If you are an officer or representative of a Seller, this means we may use your personal data to make an automated decision in respect of whether we offer business finance to a Seller. This processing is necessary for us to be able to offer the services under our agreement with your business.

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact us using the details below.

Consequences of processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details below.

Where we store your personal data

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our sites, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Whenever we or fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

Your rights

The below details the rights that you have, as contained within the Acts. Any exercise of these rights by you will be responded to without undue delay and at the latest within one month of your request:

Access to information

The Acts gives you the right to access information held about you. Your right of access can be exercised in accordance with the Acts.

Correction and deletion

The Acts gives you the right to the rectification of inaccurate data or erasure of personal data in accordance with the Acts.

Restrictions of processing

The Acts gives you the right to obtain restriction of the processing of your personal data in accordance with the Acts.

Right to data portability

The Acts gives you the right to receive your personal data in an accessible format which can be transferred to another data controller in accordance with the Acts.

Right to object

The Acts gives you the right to object to the processing of your data under particular circumstances in accordance with the Acts.

Right to lodge a complaint

If you are dissatisfied with our use of your information or our response to any exercise of your rights you have the right to complain to the Information Commissioner's Office.

Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege) as included in the Acts. For more information or to exercise your data protection rights, please contact us using the contact details below.

Retention of data

We will retain your personal data on our electronic systems for as long as is necessary to provide you with the services under our agreement with you (or with your business) or to enforce our rights under that agreement. We may continue to hold your personal data for up to 6 years after you or your business has ceased using our services to allow us to protect our rights in any legal or regulatory proceedings. We may retain deeds and other security documents containing personal data, such as personal guarantees or debentures, for up to 12 years after you or your business has ceased using our services.

Any hard copy documents containing your personal data will be destroyed securely using a 3rd party service provider once the document is no longer needed in hard copy. We may retain hard copies of legal documents (court documents, security documents and contracts) on our premises or in secure off-site storage provided by 3rd party service providers. The data retention periods for these documents will be either 6 years or 12 years, as set out above.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Marketing and opt outs

You have the right to ask us not to process your personal data for marketing purposes. Contacting you for marketing purposes will be based on our legitimate interest to do so. We will inform you if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by notifying us when we collect your data or when we contact you for marketing purposes. Alternatively, you can also exercise the right at any time by contacting us at legal@kriya.co. The exercise of this right will not affect any contractual requirements with Kriya.

Our sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Changes to our Privacy Policy

We reserve the right to modify this privacy policy or any part of it at any time. If we make any material changes in the way we collect, use, and/or share the personal information that you have voluntarily provided, we will post a notice of the changes in a clear and conspicuous manner on our website.

Contact details for data controller

Kriya Finance Limited (company number 07330525) is registered at Floors 2-5, 48-50 Scrutton Street, London, EC2A 4XQ. legal@kriya.co .

Schedule 1: Record of Processing

We have described the purposes for which you data may be used as per below:

Performance of Contract

We may process your information where it is necessary to enter into a contract with you to provide our products or to perform any obligations we may have under that contract. Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you.

This processing includes but is not limited to us using it to:

• (a) assess and process applications for products or services;
• (b) provide those products and services throughout your relationship with us (calls to us and communications to our helplines may be recorded and monitored for this purpose);
• (c) maintain our relationship with you and for ongoing customer service; and
• (d) communicate with you about your account(s) or the products and services you receive from us.

Legitimate Interest

We may process your information where it is in our legitimate interests do so as an organisation and without prejudicing your interests or fundamental rights and freedoms.

a) We may process your information in the day to day running of our business, to manage our business and financial affairs and to protect our customers, employees and property. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business.

This processing includes but is not limited to us using it to:

• (i) monitor, maintain and improve internal business processes, information and data, technology and communications solutions and services;
• (ii) ensure network and information security, including monitoring authorised users’ access to our information technology for the purpose of preventing cyber-attacks, unauthorised use of our telecommunications systems and websites, prevention or detection of crime and protection of your personal data; and
• (iii) protect our legal rights and interests.

b) It is in our interest as a business to ensure that we provide you with the most appropriate products and services and that we continually develop and improve as an organisation. This may require processing your information to enable us to:

• (i) send you relevant marketing information; and
• (ii) assess the quality of our customer service and to provide staff training. (Calls and communications to us may be recorded and monitored for these purposes).

c) It is in our interest as a business to manage our risk and to determine what products and services we can offer and the terms of those products and services. It is also in our interest to protect our business by preventing financial crime. This processing includes but is not limited to us using it to:

• (i) carry out financial, credit and insurance risk assessments;
• (ii) manage and take decisions about your accounts;
• (iii) carry out checks (in addition to statutory requirements) on customers and potential customers, business partners and associated persons, including performing adverse media checks, screening against external databases and sanctions lists and establishing connections to politically exposed persons;
• (iv) share data with credit reference, fraud prevention agencies and law enforcement agencies;
• (v) trace debtors and recovering outstanding debt; and
• (vi) for risk reporting and risk management.
• Application decisions may be taken based on automated checks of information from credit reference agencies.

Legal Obligation

When you apply for a product (and throughout your relationship with us), we are required by law to collect and process certain personal information about you. Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products to you. This processing includes but is not limited to us using it to:

• a) confirm your identity,
• b) perform checks and monitor transactions and location data for the purpose of preventing and detecting crime and to comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption, and international sanctions;
• c) share data with police, law enforcement, tax authorities or other government and fraud prevention agencies where we have a legal obligation, including reporting suspicious activity and complying with production and court orders;
• d) conduct investigations into breaches of conduct and corporate policies by our employees; and
• e) manage contentious regulatory matters, investigations and litigation.