Privacy Policy

Who we are
We are MexLucky plc (“we”, “us”, “our”, “Spark”) and are in business as an intermediary/broking service to provide SME businesses with debt. Our company number is 13182103 and our registered office is: The Stables at the Grove, Pipers Lane, Harpenden, Herts, AL5 1AJ. Our Information Commissioners Office (“ICO”) reference is ZA887039.

Spark is the controller and responsible for your personal data. This means that we are responsible for deciding how we hold and use personal information about you. This privacy and cookie policy (“the Policy”) explains how we collect, use and share any personal data that you provide to us and any personal data that we collect in the course of operating our business (the “Personal Data”)

What personal information do we collect
Personal data means any information about an individual from which that person can be identified and which we have in our possession or control. It does not include data where the identity has been removed.

We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together follows:
- Identity data: includes first name, maiden name, last name, marital status, title, date of birth, gender, passport (copy), driving licence (copy) and utility bills (copy);
- Contact data: includes residential address, billing address, email address and telephone numbers;
- Financial data: includes bank details, details of your income and outgoings, statements of assets and liabilities;
- Background data: includes education and employment history;
- Transaction data: includes details about products, services you have arranged via Spark, including usage of our “Online Platform” (when you visit our website we will record your IP address.) and tracking pixels used to gather information on email communications;
- Marketing and communications data: includes your preferences in receiving marketing from us and our third parties and your communication preferences; and
-Information about your health, including medical conditions, particularly where you are classified as a vulnerable individual as a result of your medical condition.

We also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. This may be derived from your personal data but is not considered Personal Data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate location data to derive the percentage of customers accessing our services in a given geographical location. We will treat Aggregated Data as your Personal Data if it can directly or indirectly identify you, in accordance with this privacy notice.

Accuracy and failure to provide personal data
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Where we need to collect personal data by law, or under our terms of service or other contract, and you fail to provide that data when requested, we may not be able to fulfil our contractual obligations. In this case, we may have to cancel the relevant service or contract, but we will notify you if this is the case at the time.

How is your personal data collected?
We use different methods to collect data from and about you including through:
- Direct interactions with you. You may give us your personal data by registering on our online platform, by completing a contact form or by corresponding with us via post, phone, email or otherwise. You may also provide personal data by your use of our website (sparkfinance.co.uk);
- Direct interactions with companies (borrowers) and their advisors. Where a credit proposal is being prepared by a company, or their advisors, they may provide your personal data directly to us;
- Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources such as Companies House; and
- Introducers and other businesses where we have a trading relationship.

Basis for processing personal data
We will only use your Personal Data where we have a lawful basis for doing so. Our lawful basis will be one of more or the following:
- Consent: you have given clear consent to process personal data for a specific purpose. You can withdraw your consent as described later;
- Contract: the processing is necessary to initiate or complete a contract between us;
- Legal obligation: the processing is necessary for you to comply with the law (excluding contractual obligations); and
- Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests.
‍
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

How we use your personal data
We will process your personal information for the following reasons:
- to provide debt to UK businesses, specifically in identifying the best source of finance based on your (and the borrowing entity’s) circumstances and present information to prospective lenders;
- to engage in marketing and business development activity in relation to our services;
- to confirm your affordability for the financial requirement we are seeking finance for;
- to share with our professional advisors and to establish, exercise or defend our legal rights or for the purpose of legal proceedings;
- to comply with our anti-money laundering and know your client requirements;
- to meet our regulatory responsibilities
- record and monitor your use of our websites, or our Online Platform or our other online services for our business purposes which may include analysis of usage, measurement of site performance and generation of marketing reports;use it for our legitimate business interests, such as undertaking business research, direct marketing, analysis, managing the operation of our websites, our Online Platform and our business. When we process your Personal Data for our legitimate interests, we make sure to consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate business interests do not automatically override your interests - we will not use your Personal Data for activities where our interests are overridden by the impact on you. If you have any concerns, you have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see the section titled "What are your rights?" below;
- use it to look into any complaints or queries you may have; and
- use it to prevent and respond to actual or potential fraud or illegal activities.

In the event that we buy or sell any business or assets, or substantially all of our assets are acquired by a third party, we may share your Personal Data to the prospective buyer, and in the event of an acquisition, Personal Data held by us about our clients will be one of the transferred assets.

Automated decision making (“ADM”)
ADM takes place when a computer system uses information to make a decision without human intervention. We are allowed to use ADM in the following circumstances:
- where we have notified you of the decision and given you 21 days to request a reconsideration;
- where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights; or
- in limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

Why might we share your information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the contractual relationship with you or where we have another legitimate interest in doing so. Third-party service providers may process personal information about you for the following purposes:
- the most suitable lenders on our panel (a full list of which is available by contacting info@sparkfinance.co.uk);
- Our IT hosting and maintenance, this information is located on servers within the European Union; and
- to the extent required by law, regulation or court order, for example, if we are under a duty to disclose your Personal Data in order to comply with any legal obligation.

Security of personal data
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.

How long we keep your information
How long we hold your personal data for will vary and will depend principally on:
- the purpose for which we are using your Personal Data – we will need to keep the information for as long as is necessary for the relevant purpose; and
- legal obligations – laws or regulations may set a minimum period for which we have to keep your personal data.

International transfers
We do not transfer your personal data outside the European Economic Area (EEA).

What are your rights?
You have the right to lodge a complaint with the ICO, in respect of our processing of your personal data. Information can be found at www.ICO.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

You have rights under data protection laws to request from us access to (commonly known as a “data subject access request”), rectification of, or erasure of your personal data. You also have the right to request the restriction of any processing or to object to our processing of your personal data, including withdrawal of consent. Finally, you have the right to data portability. Please use the contact details below to exercise your rights. You can find more information about your rights at www.ICO.org.uk.

Changes to the privacy & cookies notice
This version was last updated on 23/08/23 and historic versions can be obtained by contacting us at info@sparkfinance.co.uk

‍Contact
You can contact info@sparkfinance.co.uk for any purpose in relation to privacy and your personal data, including making a complaint. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Please note that we digitally record all telephone conversations.

Cookies – an introduction
In order to collect the information as described in this policy, we may use cookies and similar technology on our website and emails. A cookie is a small file which is sent to your browser and stored on your computer’s hard drive, mobile phone or other device.

You can set your browser to notify you when you receive a cookie. This enables you to decide if you want to accept it or not. However, some of the services and features offered through websites may not function properly if your cookies are disabled.

Cookies can be first-party or third-party cookies:
- First party cookies – cookies that the website you are visiting (or link you are clicking) places on your computer.
- Third party cookies – cookies placed on your computer through the website but by third parties, such as, Google.

The cookies placed on our website
First party cookies:
‍Strictly necessary cookies – These cookies are essential to enable you to move around the website and use its features. They are deleted when you close the browser.
Functionality cookies – These cookies allow the website to remember choices you make (such as your user name, language or the region you are in), provide enhanced, more personal features and facilitate the use of security features such as two-factor authentication. These cookies can also be used to remember changes you have made to text size, fonts and other parts of web pages that you can customise. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites.

‍Third party cookies:
‍We use Google analytics (“GA”) in order to better understand our users’ needs and to optimize our service and your experience. GA is a technology service that monitors usage and helps us better understand our users experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.). This enables us to build and maintain our service with user feedback. GA uses cookies and other technologies to collect data on our users’ behaviour and their devices, device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). GA stores this information in a pseudonymised user profile. Neither GA nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see GA’s privacy policy by clicking on this link https://policies.google.com/privacy?hl=en-US.

Document tracking cookies – Some documents we send clients use cookies to track engagement with our documents. These cookies are also paired to individual email addresses and therefore make it possible for us to identify the activities of the individual who the email address is registered to.

We may combine information from these types of cookies and technologies with information about you from any other source.

Cookie consent and opting out
We assume that you are happy for us to place cookies on your device. However, you may refuse to accept most cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of our website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our website.

In order to opt out of cookies (apart from strictly necessary cookies), you will need to click on the relevant box on the website.

If you are located in the European Economic Area (“EEA”) and use our website, when you arrive on our website a pop-up message will appear notifying you that we use cookies on our website. You will be deemed to have provided consent to this Policy if you continue browsing our website. If you, or another user of your device, wish to withdraw your consent at any time, you can do so by altering your browser settings otherwise we will assume that you are happy to receive cookies from our website. For more information please visit www.allaboutcookies.org and www.youronlinechoices.com/uk/.