Your Privacy Choices

The rights you can exercise

• Access / know — what personal information we hold about you, where we got it, why we use it, and the categories of recipients we disclosed it to. You can also ask specifically which financing providers received your submission.
• Correct — fix personal information that is inaccurate.
• Delete — have your personal information erased, subject to the exceptions in Limits and exceptions.
• Portability — receive a copy in a portable, machine-readable format.
• Opt out of sale or sharing — stop disclosure of your personal information in exchange for value, and stop sharing for cross-context behavioural advertising.
• Opt out of targeted advertising — stop use of your information to serve you advertising based on activity across sites.
• Limit use of sensitive personal information, where the statute in your state provides that right.
• Appeal — if we decline your request, ask us to reconsider. See Appeals.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lower quality of service for exercising any of these rights.

Global Privacy Control

If your browser or an extension sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt that browser out of sale and sharing of personal information for targeted advertising, in the states where that signal must be honoured. A GPC signal is tied to the browser, not to you personally — to apply an opt-out to your whole record across devices, submit the form below.

Submit a privacy request

Enter at least one of a telephone number or email address so we can locate your record. Use the details you originally gave us.

How we verify you

Before we act on a request to access, correct, delete or export personal information, we take reasonable steps to confirm you are who you say you are — otherwise we would be handing your data to a stranger.

• Usually we match the telephone number or email address you give us against our records and send a confirmation link or code to it.
• For a high-risk request — deletion, or a full export — we may ask for one or two additional pieces of information that we already hold, so that we can match them.
• If we cannot verify you, we will say so and explain what would let us proceed. We will not create or retain extra information about you just for verification beyond what is needed.
• Authorised agents must supply written authority signed by the individual, and we may still verify with that individual directly.
• Opt-out requests — do not sell or share, and targeted advertising — do not require verification and are actioned on receipt.

Timing

• Acknowledgement — within 10 business days of receipt.
• Substantive response — within 45 calendar days. We may extend once by a further 45 days where reasonably necessary, and we will tell you why before the first period ends.
• Opt-out of sale, sharing or targeted advertising — actioned as soon as feasible and in any event within 15 business days.
• No charge, unless a request is manifestly unfounded, excessive or repetitive — in which case we will tell you the reason and any fee before doing the work.

Limits and exceptions

• Suppression records survive deletion. If you have asked us to stop contacting you, we must keep your telephone number and email address on a suppression list indefinitely — that is the only way to keep honouring the opt-out. Deleting everything would put you back in circulation. We will tell you when we retain data for this reason.
• Consent records. We retain the record of consent you gave, and of any revocation, for at least five years as evidence that contact was authorised.
• Legal obligations. We keep what we are required to keep by law, or what we need to detect and prevent fraud, ensure security, or establish, exercise or defend legal claims.
• Providers hold their own copies. Deleting your data from our systems does not delete it from the systems of financing providers who already received it. They are independent controllers. Ask us which providers received your submission — tick the box on the form — and then contact each of them directly. Most are linked from Participating Financing Providers.

Appeals

If we decline your request, we will tell you why in writing and explain how to appeal. To appeal, resubmit the form above with "Appeal a declined request" ticked and the original reference number in the notes, or email privacy@bidmycapital.com with "Appeal" in the subject line.

We will respond to an appeal within 45 days, in writing, setting out our reasoning. If we deny the appeal, you may complain to your state attorney general — several state privacy statutes require us to give you a means of doing so, and we will include the relevant contact details in our response.

Other ways to submit a request

You are not required to use this form. Any of the following works equally well.

For the full picture of what we collect and why, read our Privacy Policy.