Privacy Policy

2. Who We Are

First Leasing UK Limited (Company No. 04401552) is a specialist commercial finance brokerage trading as Scaffold Finance. We arrange hire purchase, finance lease, sale and leaseback, VAT loans, business loans, and insurance premium finance exclusively for UK scaffolding contractors.

First Leasing UK Limited, trading as Scaffold Finance, is an Appointed Representative of WestWon Limited, FRN: 738235. WestWon Limited is authorised and regulated by the Financial Conduct Authority, FRN: 738235. WestWon Limited is an authorised credit broker and not a lender.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Identity and Contact Data

• Full name, job title, and role within the business
• Business name, registered address, and trading address
• Email address, telephone number, and mobile number
• Date of birth, home address, and residential status
• Previous home addresses covering the last three years, where a lender requires a personal credit search
• Companies House entries, including directors and persons with significant control (PSC)

3.2 Financial and Business Data

• Bank statements, management accounts, and year-end financial statements
• Credit history and credit report data, where obtained for the purposes of AML compliance, fraud prevention, or credit assessment in connection with a finance application
• A record of your permission for lenders to carry out a personal credit search, including the wording you agreed to, the date, and how the permission was given
• Details of existing finance facilities, liabilities, and assets
• VAT registration numbers and HMRC correspondence (where relevant)

3.3 Identity Verification Data

• Copies of photographic identification (passport or driving licence)
• Proof of address documentation
• Data obtained through Companies House, the PSC register, and sanctions screening

3.4 Communications Data

• Emails, letters, and written correspondence
• Records of telephone calls, including call recordings
• Notes and records of meetings and conversations

3.5 Technical and Usage Data

• IP address, browser type, and device information
• Pages visited on our website and duration of visits
• Form submissions and document uploads via our website
• Cookie data (see Section 11)

3.6 Marketing Data

• Your marketing preferences and consent status
• Records of email opens, clicks, and engagement where tracked

4. How We Collect Personal Data

We collect personal data in the following ways:

• Directly from you when you contact us by telephone, email, or via our website
• Through our website enquiry forms and document upload facilities
• Through our secure client portal, where you can complete finance applications, upload documents, confirm your details, and give or withdraw permission for credit searches
• From your business’s publicly available information on Companies House
• From credit reference agencies and identity verification services
• From lenders, where they share information with us in connection with an application
• From third-party introducers who refer your business to us
• Through call recordings made during telephone conversations with you

5. How We Use Your Personal Data

We use personal data for the following purposes:

5.1 To Arrange Finance on Your Behalf

We process identity, contact, and financial data to assess your requirements, identify suitable finance products, prepare proposals, and submit applications to lenders on your behalf. This processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract.

5.2 To Comply with Legal and Regulatory Obligations

We are required by law to carry out identity verification and anti-money laundering checks. This includes verifying directors and beneficial owners, screening against sanctions lists, and retaining records for a minimum of five years. This processing is necessary for compliance with a legal obligation.

5.3 To Obtain Your Permission for Credit Searches

Where a lender requires a personal guarantee from a director, that lender will need to check the director’s personal credit file before offering finance. We do not carry out these searches ourselves. We ask for your permission before we put your application to lenders, and we keep a record of that permission: the wording you agreed to, the date, and whether it was given through our client portal, by email, by telephone, or in person. Where we approach more than one lender to obtain the best terms, each lender may carry out its own search. Your permission covers the application in question and any future applications you make through us, and you can withdraw it at any time through the client portal or by contacting us. Withdrawing your permission does not affect applications already with a lender. This processing is based on your consent.

5.4 To Manage Our Business Relationship

We process contact and communications data to manage ongoing relationships, provide updates on applications, respond to queries, and maintain accurate records. This is based on legitimate interests or the performance of a contract.

5.5 To Send Marketing Communications

Where you have provided consent, or where we have an existing business relationship and you have not opted out, we may send you marketing communications including our publications, sector news, and information about our services. You may withdraw consent or opt out at any time by contacting us or clicking the unsubscribe link in any marketing email.

5.6 For Call Recording

We record telephone calls for the purposes of quality assurance, compliance monitoring, and as a record of instructions and agreements. Call recordings are retained for 6 years and are then securely deleted. This processing is based on our legitimate interests in maintaining accurate records and ensuring compliance with our regulatory obligations.

5.7 To Improve Our Website and Services

We use analytics and behavioural data to understand how our website is used and to improve its content and functionality. This includes data collected via Google Analytics 4 (page views and traffic sources), Microsoft Clarity (session recordings and heatmaps), and Brevo (website visit tracking linked to email marketing engagement). This processing is based on legitimate interests and, where cookies or tracking technologies are used, your consent via our cookie controls.

6. Legal Bases for Processing

We rely on the following legal bases under UK GDPR Article 6:

• Contract (Article 6(1)(b)): processing necessary to perform our services or to take steps at your request before entering into a contract.
• Legal obligation (Article 6(1)(c)): processing required to comply with AML legislation, FCA requirements, and other applicable law.
• Legitimate interests (Article 6(1)(f)): processing for our legitimate business interests, including managing client relationships, call recording, maintaining accurate records, fraud prevention, and marketing to existing contacts. We have assessed that our legitimate interests are not overridden by your rights.
• Consent (Article 6(1)(a)): where we rely on consent for personal credit searches by lenders, marketing communications, or the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Sharing Personal Data

We share personal data only where necessary and in accordance with this Notice. We do not sell personal data to third parties.

We may share your personal data with:

• Lenders on our panel: to submit finance applications and obtain decisions on your behalf. Each lender is an independent data controller and will process your data in accordance with their own privacy policy.
• WestWon Limited: as our principal firm, for regulatory oversight and compliance purposes.
• Third-party processors: who provide services to us including CRM, marketing, forms, automation, and website infrastructure (see Section 8).
• Regulatory and law enforcement bodies: including the NCA (where we are required to submit a Suspicious Activity Report), HMRC, the FCA, and the ICO, where we are required to do so by law.
• Introducers: where necessary to confirm or progress an introduction. We do not share more data than is necessary for this purpose.

10. Your Data Protection Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain circumstances (including where it is no longer necessary, or where consent is withdrawn and no other lawful basis applies).
• Right to restriction: to request that we limit our processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used format where processing is based on consent or contract.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.

To exercise any of these rights, please contact Carl Redding at privacy@scaffoldfinance.co.uk. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.

Please note that some rights are subject to exceptions. For example, we may need to retain certain data to comply with our legal and regulatory obligations (such as AML record-keeping requirements) even where a deletion request is made. We will inform you of any applicable exceptions when responding to your request.

11. Cookies

Our website uses cookies and similar tracking technologies. A cookie is a small text file placed on your device when you visit a website.

We use the following types of cookies:

• Strictly necessary cookies: required for the website to function. These cannot be disabled.
• Analytics cookies: used by Google Analytics 4 to collect data about how visitors use the website. These cookies are only set with your consent.
• Functional cookies: used to remember your preferences and improve your experience.

In addition to cookies, our website uses the following tracking technologies:

• Microsoft Clarity: a session recording and heatmapping tool operated by Microsoft Corporation. Clarity records mouse movements, clicks, scrolls, and page interactions to help us understand how visitors use our website. Data is processed in the USA under Standard Contractual Clauses. Clarity may use cookies to identify sessions. For more information, see Microsoft’s Privacy Statement at microsoft.com/privacy.
• Brevo tracking script: a script that tracks website visits and links them to email marketing contacts where a contact has clicked through from a Brevo campaign. Data is processed in the EU. For more information, see Brevo’s Privacy Policy at brevo.com/legal/privacypolicy.

When you visit our website, a cookie consent banner will ask for your permission before any non-essential cookies are set. You may withdraw or change your consent at any time through the cookie settings on our website, or by adjusting your browser settings.

A full Cookie Policy is available on our website at scaffoldfinance.co.uk. Any questions about our use of cookies can be directed to privacy@scaffoldfinance.co.uk.

12. Security

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. Our measures include:

• Use of Cloudflare for website security, DDoS protection, and encrypted data transmission (HTTPS)
• Access controls limiting data access to authorised personnel only
• Use of reputable, security-certified third-party processors
• Secure deletion of data at the end of applicable retention periods

We also have a Data Breach Response Procedure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform affected individuals without undue delay.

13. Complaints

If you have a concern about how we handle your personal data, please contact us in the first instance at privacy@scaffoldfinance.co.uk. We will investigate and respond promptly.

If you remain dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our business, legal obligations, or data processing practices. Material changes will be published on our website with an updated effective date. We recommend checking this Notice periodically.