Data Protection_external_2026

Data Protection

We recognise that the correct and lawful treatment of personal data will maintain confidence in our organisation, and we are committed to protecting the personal data of the small business owners and investors who use our platform, as well as the personal data of our Circlers. Protecting the confidentiality and integrity of personal data is a critical responsibility that we take seriously at all times.

In the UK, our data protection officer is responsible for overseeing our Data Protection Policy and developing related policies and privacy guidelines - that individual can be reached at dataprotection@fundingcircle.com.

Personal Data Protection Principles

We are committed to the following principles relating to processing of personal data, which require Personal Data to be:

● collected and processed lawfully, fairly and in a transparent manner, including with explicit consent from the data subject where specifically required by law;

● collected only for specified, explicit and legitimate purposes;

● adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;

● accurate and where necessary kept up to date;

● not kept in a form which permits identification of individuals for longer than is necessary for the purposes for which the data is processed;

● processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;

● not transferred to another country without appropriate safeguards being in place; and

● made available to individuals and allow individuals to exercise certain rights in relation to their personal data;

Our products and services are designed to protect our customers’ right to privacy. Our standard terms involving the collection, use, sharing and retention of user data including data transferred to third parties, user notification and consent are set forth in our privacy policies and cookie policies:

UK Cookie Policy

Third Parties

Where personal data is shared with third parties we require all third parties to respect the security of customer personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Data Security

We have put in place appropriate security measures to prevent customer personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to customer personal data to those employees, agents, contractors and other third parties who have a business need to know. We have put in place procedures to deal with any suspected personal data breach and will notify customers and any applicable regulator of a breach where we are legally required to do so. For more information see: [insert link to InfoSec statements]

We may amend our privacy policies from time to time to comply with applicable laws and regulations or to meet our changing business requirements. We encourage all customers to periodically review these policies for the latest information on our privacy practices. We comply with our legal and regulatory obligations on notifying customers and regulators of data breaches.

Training and Systems Review

All Circlers are responsible for ensuring that they comply with our Data Protection Policy. We commit to ensuring that all Circlers regularly undergo data protection specific training that complies with applicable data protection laws and regulations. We regularly test our systems and processes to assess compliance. We encourage system and process owners to comply with our Data Protection Policy and verify the presence of adequate governance controls and resources for the proper use and protection of personal data.

Governance

Our Corporate Governance Framework oversees the management of data protection and privacy risk in line with our risk appetite. Operational governance is provided across the Three Lines of Defence model, with continuous oversight and monitoring, including in respect of incidents and responses, identification and remediation of vulnerabilities, and redress of internal and external audit findings and business change management. This allows us to act quickly if we need to strengthen due to industry or regulatory requirements. Data protection and privacy key performance indicators are regularly reviewed by the Funding Circle Management Risk Committee and the Funding Circle Board Audit and Risk Committee.