GDPR

We are fully GDPR compliant

u3man complies in full with the UK GDPR and the EU General Data Protection Regulation. Personal data is collected for one stated purpose, kept only as long as that purpose needs, and is not sold.

Privacy contact: info@u3man.be. This notice sits alongside the Privacy policy and the Terms and conditions.

What we are — and what we are not

u3man is not a credit lender and is not a credit broker. We do not underwrite a credit card and we do not set a credit limit.

If you apply, you are applying for a credit card with a credit limit for a business. We retain your personal data and the business data, and we pass them to a chosen merchant. That merchant acquires the credit facility. We do not keep the data for any other purpose.

Credit checks

u3man does not run credit checks. The merchant does, after we have passed the application across.

• A soft credit check using your personal details. This uses the personal information on the form. It is not normally visible to other lenders.
• A hard credit check on the business details. This uses the company information on the form. Other lenders can see a hard check, and it can affect the business credit file.

Those searches are the merchant’s responsibility under data protection law. We tell you about them here so the hand-over is clear before you apply.

Roles

u3man is the controller of the personal data while we hold the application and pass it on. The chosen merchant is a separate controller of the data it receives, and of the soft check, the hard check, and any credit agreement that follows.

Email delivery of the enquiry to info@u3man.be uses a processor (Bird). The processor only handles the message so it can be delivered. We do not allow it to use the contents for its own purposes.

Marketing

We reserve the right to send marketing by email, phone or post to the contact details on the application. The purpose is limited to the business credit card and related services for the business. We do not use the data to market unrelated products, and we do not pass contact details to anyone else for their own marketing.

The lawful basis is legitimate interests where the law allows marketing to a business, and consent where electronic marketing to an individual requires it. You have the right to object, including the absolute right to object to direct marketing. Email info@u3man.be, use the unsubscribe link, or refuse on a call. We stop marketing once we have that request. Objecting does not affect the credit card application.

Your GDPR rights

• To be told what we hold and why, which is this notice and the privacy policy.
• To receive a copy of your personal data.
• To correct data that is wrong.
• To have data erased when we no longer need it to pass the application or to show what we sent.
• To restrict or object to our use of it.
• To ask for the data in a portable form.
• Not to be subject to a solely automated decision by u3man. We do not make the credit decision.

Write to info@u3man.be. We will answer within one month. If the merchant already holds a copy, we will tell you, and you can use the same rights with the merchant about the credit checks and the card.

You can complain to a supervisory authority without coming to us first. In the UK that is the Information Commissioner’s Office (ico.org.uk). In Belgium that is the Data Protection Authority (dataprotectionauthority.be).

Consent

By applying you consent to your personal data and the business data being submitted to the merchant and to other third parties we use, and to being contacted by them, for the purpose of obtaining the credit card. You can withdraw that consent by emailing info@u3man.be. Withdrawal does not affect a disclosure that has already been made. The merchant then handles the data under its own notice.

Temporary password

We generate a temporary password for your account and pass it to you. You need to change it. We do not store the new password you set, and that password is not part of the application we keep or pass on.

Security and retention

Access to an application is limited to handling it and passing it to the merchant and the third parties used to obtain the card. We delete the application, or strip it of identifiers, within 12 months after the enquiry is closed, unless the law tells us to keep it longer.