Privacy Policy

1. Who we are

Commercial Funding Panel (commercialfundingpanel.co.uk) is the data controller for the personal information described in this policy. Commercial Funding Panel is a trading name of DemandVine, operated by , a German sole proprietor (Einzelunternehmer). Because DemandVine is established in Germany and this service is directed at UK business owners, both UK GDPR and EU GDPR apply to how we handle your data — see section 8.

2. What we collect

When you complete our enquiry form, we collect your name, business email, mobile number, company details (including your company registration number, where applicable, and whether your Companies House filings are up to date), and your answers about your finance requirements. We also automatically collect technical information (browser type, IP address, referring page, and UTM campaign parameters) to understand how visitors reach our form.

If you arrived from a Facebook or Instagram advert and you agree to ad measurement cookies, we also record the click identifier Meta adds to the link you followed. Section 6 explains what that is used for and how to refuse it.

3. Why we process your data, and our legal basis

We process your enquiry answers and contact details to assess your eligibility and pass your enquiry to lenders on our panel — this is necessary to take steps you request before entering into a contract with a lender (UK/EU GDPR Article 6(1)(b)).

We process your mobile number, and send you a one-time verification code, on the basis of your explicit consent, given at the point you enter your number (Article 6(1)(a)) — you can withdraw this by not proceeding past that step, or by emailing us at hello@commercialfundingpanel.co.uk. Our verification messages are sent from a send-only number, so replying to one does not reach us.

We process basic technical/analytics data (see section 6) on the basis of our legitimate interest in understanding and improving our enquiry form (Article 6(1)(f)).

4. Mobile number and SMS consent

Your mobile number is used solely to send a one-time verification code confirming you are the owner of the number, and to allow a matched lender to contact you about your enquiry. We do not share your mobile number with any third party for marketing purposes, and the consent you give to receive a verification code is not shared with any third party.

5. Who we share your details with

We share your enquiry details with FCA-authorised lenders on our panel so they can assess and respond to your finance request. We do not sell your data to data brokers, and we do not share it for anyone else's marketing purposes.

We also share limited data with service providers who process it on our behalf, under contract, and only for the purpose stated:

• Amazon Web Services (SNS) — to deliver the SMS verification code to your phone
• Upstash — to temporarily store your verification code while it is active
• Neon (Postgres, EU/Frankfurt) — to durably store your enquiry record
• Companies House — to look up your registered company details, if you search for them
• PostHog (EU-hosted) — to record which step of the form you reached, for the analytics described in section 6
• Google (Google Sheets) — to hold a working copy of your enquiry so that we can respond to it. This copy is restricted to named members of our team and is not published or shared further
• Resend — to email us a copy of any message you send through our contact form
• Vercel — to host this website

Separately from the providers above, if you agree to ad measurement cookies we send Meta Platforms Ireland Limited a record that an enquiry was submitted, so that Meta can tell us which advert led to it. This includes your email address and mobile number in a scrambled (hashed) form that Meta can match against its own records but cannot read back, along with your IP address and browser details. Meta acts as a separate controller for this, not as our processor. If you refuse ad measurement cookies, none of this is sent.

Where a lender on our panel is outside the UK or EU, or a service provider processes data outside the UK/EEA to deliver a message to your phone (as SMS delivery networks require), we take reasonable steps to ensure your data is protected to an equivalent standard.

7. How long we keep your data

We retain enquiry records for up to 12 months, after which they are automatically deleted by an unattended nightly process. If you ask us to delete your data sooner (section 10), we will do so without waiting for that period to end.

8. Which regulator oversees us, and our registration status

Because DemandVine is established in Germany but this service targets UK business owners, we are subject to both UK GDPR (as we offer services to people in the UK) and EU GDPR (as we are established in the EU) — one does not replace the other. In practice, this means both the UK Information Commissioner's Office (ICO) and the relevant German data protection authority (Landesdatenschutzbehörde) have oversight of how we handle your data.

We are in the process of registering with the ICO and appointing a UK GDPR Article 27 representative, as required for a business established outside the UK that serves UK customers. We will publish our ICO registration reference and our UK representative's contact details here once that process is complete.

9. How we protect your data

Data in transit to and from this website is encrypted (HTTPS). Our database provider encrypts stored data at rest as standard. In addition, we separately encrypt the personal details you give us — your name, email address, mobile number and company name — as individual fields before they are stored, so they are unreadable in the database without a key held outside it. Access to our systems is restricted to what is needed to operate the service.

So that we can actually act on your enquiry, a readable working copy is also held in a private spreadsheet (see section 5). It is restricted to named members of our team, never published or shared by link, and deleted when your enquiry record is deleted.

10. Your rights

Under UK and EU GDPR, you have the right to:

• ask what data we hold about you (access)
• ask us to correct inaccurate data (rectification)
• ask us to delete your data (erasure)
• ask us to restrict how we use your data (restriction)
• object to us processing your data on the basis of our legitimate interest
• receive your data in a portable format, where we process it based on your consent or a contract (portability)
• withdraw your consent to the SMS verification step at any time, without affecting anything done before you withdrew it
• withdraw your consent to optional cookies at any time, using the Cookie settings link at the bottom of any page

To exercise any of these rights, email hello@commercialfundingpanel.co.uk. No account or login is required to make this request, and we will not charge you for a straightforward request.

11. How to complain

If you are unhappy with how we have handled your data, please contact us first at hello@commercialfundingpanel.co.uk so we can try to resolve it. You also have the right to complain directly to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in Germany, the data protection authority for the state in which is established.

12. Children's data

This service is for business owners aged 18 and over. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

We may update this policy from time to time, particularly as we complete the ICO registration and UK representative appointment described in section 8. We will update the "Last updated" date above when we do.

14. Related pages

See our Terms & Conditions for the full terms of using this service, including our SMS verification service.