Privacy Policy

Angel Property Finance

Version 1.0 | Dated: 20 July 2026 | Next scheduled review: July 2027

1. Who we are

Angel Property Finance is part of the APF Topco Limited group of companies.

This policy is issued by Angel Property Finance, the trading name of Angel Property Finance Limited (company number 13720740) and APF SPV1 Limited (company number 16271194) — the group companies that decide how and why your personal data is processed in connection with our lending business, together "Angel Property Finance", "we", "us", or "our". Angel Property Finance Limited is registered with the Information Commissioner's Office under registration number ZB290776.

APF Topco Limited is the ultimate holding company of the group. APF Mezz Limited (company number 16728326) and APF Renovations Limited (company number 17080617) are internal funding vehicles within the group and do not hold facility agreements directly with borrowers. None of these three entities itself carries out the processing described in this policy, and none is a controller of your personal data for these purposes.

This policy explains what personal data we collect, why, how we use it — including our use of automated tools and AI, and credit and identity checks — and who we share it with, including our credit reference agency and our third-party mortgage brokerage partner.

This policy applies to prospective and existing borrowers, guarantors, directors and beneficial owners of corporate borrowers, and other individuals connected with an application or facility we provide.

2. Data Protection Officer / contact

Our Data Protection Officer (or the person responsible for data protection matters) is: Wayne Davies contactable at [email protected]

3. How we use AI and automated tools

As part of assessing applications, verifying identity, and preventing fraud, we use a combination of automated tools and, in places, artificial intelligence (AI) to support our processes. This includes:

automated identity and document verification tools (e.g. Infotrack & CreditSafe) used to check identity documents and biometric data;
automated financial data analysis tools (e.g. Armalytix) used to review bank transaction and affordability information;
credit reference and identity data obtained via Creditsafe (see Section 4);
automated risk-scoring and red/amber/green risk indicators used to help our underwriters assess an application consistently.

These tools support our staff in making decisions — they do not replace human judgement. See Section 11 for how this applies specifically to automated decision-making and profiling, and your rights in relation to it.

More detail regarding TransUnion's activities are available at www.transunion.co.uk/CRAIN

4. Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 742313).

TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 737740).

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

Creditsafe Privacy / Transparency Notice: www.creditsafe.com/gb/en/legal/transparency-notice-customer-supplier.html
TransUnion Bureau Privacy Notice: www.transunion.co.uk/legal/privacy-centre/pc-bureau

5. Legal basis for processing personal data

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:

Performance of a contract — where processing is necessary to deliver services or meet contractual obligations, including obligations involving Creditsafe and TransUnion.
Legal obligation — where processing is required to comply with applicable laws, regulatory requirements, or statutory obligations (for example, anti-money laundering checks).
Legitimate interests — where processing is necessary for legitimate business purposes such as system security, fraud prevention, risk management, audit, and compliance, and where such interests do not override the rights and freedoms of individuals.
Consent — where required by law, and where individuals have been provided with a clear choice and the ability to withdraw consent at any time.

Where legitimate interests are relied upon, appropriate assessments are conducted to ensure that the rights and freedoms of data subjects are protected.

6. Legitimate interests we pursue

Where we rely on legitimate interests, these include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and using information obtained via credit reference agencies (including Creditsafe and TransUnion data) for creditworthiness assessment and fraud prevention. These interests are balanced against the rights and freedoms of individuals, with appropriate safeguards in place.

7. Sources of personal data

We may collect personal data about you from:

you directly, through your loan application and supporting documents;
brokers or introducers who refer you or your business to us, including our third-party mortgage brokerage partner;
your professional advisers (for example accountants or solicitors), where relevant and with appropriate permission;
publicly available sources (for example Companies House, HM Land Registry, and other public registers);
credit reference agencies (CRAs), including Creditsafe and TransUnion, where required for credit, identity, or affordability checks; and
third-party service providers used to support onboarding, due diligence, valuation, and compliance processes (for example Infotrack and Armalytix).

8. Who we share your data with

We may share personal data with:

our third-party mortgage brokerage partner(s), where they are involved in introducing or supporting your application & refinance – Debtor Days Limited
credit reference agencies, including Creditsafe and TransUnion, for credit, identity, and affordability checks;
solicitors, valuers, and quantity surveyors instructed in connection with your facility;
other business partners and third-party service providers who support our lending, onboarding, and compliance processes;
regulators (including the Financial Conduct Authority and the Information Commissioner's Office) and law enforcement bodies, where required; and
our professional advisers.

Where data is shared outside the UK, appropriate safeguards will apply (see Section 9).

9. International data transfers

We do not transfer, store, or process personal data outside of the United Kingdom. All personal data is handled exclusively within the UK and is not accessed by individuals, employees, or third-party providers located outside of the UK. As such, no international data transfer safeguards are currently required.

10. Data retention

We retain personal data for as long as necessary to provide our services, meet our legal and regulatory obligations (including record-keeping requirements under the Money Laundering Regulations 2017), and to establish, exercise, or defend legal claims. [Insert your specific retention periods, e.g. 5 years from the end of the business relationship for AML records.]

11. Automated decision-making and profiling

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.

If you have questions about the tools we use, or would like to request human review of a decision, please contact us using the details in Section 2.

12. Your rights

Under UK data protection law, you have the right to:

request access to the personal data we hold about you;
request correction of inaccurate personal data;
request erasure of your personal data, in certain circumstances;
request restriction of processing, in certain circumstances;
object to processing based on legitimate interests;
request data portability, where applicable; and
not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, save as set out in Section 11.

To exercise any of these rights, please contact us using the details in Section 2. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you have concerns about how we process your personal data.

13. Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, proportionate to the nature of the data we hold.

14. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our processes, the tools and providers we use, or legal and regulatory requirements. The date at the top of this policy shows when it was last updated.