Data Controller: Fullbeam Financial Services Limited
Registered Address: Llys Eirias, Abergele Road, Colwyn Bay, Conwy, Wales, LL29 8BW
ICO Registration Number: ZC230894
Contact Endpoint: dpo@fullbeamfinancialservices.com
1. Welcome and Who We Are
At Fullbeam Financial Services Limited (Fullbeam, we, us, or our), we are committed to looking after your personal data and protecting your privacy.
Fullbeam provides fulfilment services to the motor industry to help lenders distribute their finance products more quickly and efficiently. As part of these services, we deliver finance broking and panel routing to vehicle retailers, commercial clients, and vehicle buyers. We use software tools provided by our technology partner, iVendi Limited, which sit inside a vehicle retailer's online storefront or showroom system. This allows us to look at your finance requirements and connect you with our specialist group of lenders and financial institutions.
Under UK data protection laws, Fullbeam acts as an Independent Data Controller for the personal data we receive, check, and handle to run our business. Being an independent data controller means we are legally responsible for deciding how and why your personal data is used for our credit broking services.
This notice explains how we collect, use, share, and store your personal data, as well as your legal rights under UK law. To help you navigate this notice, our activities are split into clear sections based on whose personal data we are processing:
Section 2: Vehicle Finance Applicants
2. Vehicle Finance Applicants
This section applies to you if you look for vehicle finance, check your finance eligibility, or apply for a vehicle loan through a vehicle retailer’s website or showroom where Fullbeam provides secondary credit broking services.
How We Receive and Share Your Personal Data
We typically receive your personal data through secure computer connections (APIs) when you start a finance check or credit application inside a vehicle retailer’s software.
- The Vehicle Retailer (Primary Credit Broker): The vehicle retailer showing you the vehicle is the primary credit broker. They act as an independent data controller for the personal data held inside their software systems.
- Fullbeam (Secondary Credit Broker): When the vehicle retailer passes your finance query to one (or more) of Fullbeam's specialist panel of lenders, your information travels securely to us. At the point your information is sent to us, Fullbeam acts as an independent data controller for checking and routing your application. We may also contact you as part of an application to request extra personal data or documents that the lender has asked for.
- Direct Contact and Document Collection: As part of processing your application, we or the vehicle retailer (acting on our or the lender’s instructions) may contact you directly to request extra personal data, proof of identity, or supporting documents required.
- Sharing Data Back with the Vehicle Retailer: If you provide personal data or documents directly to us, we may share this information back with the vehicle retailer so they can assist with your vehicle purchase and complete your finance arrangement.
Categories of Personal Data We Process
We collect and use the following types of personal data to check your finance options:
- Identity Data: e.g. full name, title, date of birth, marital status, and residential status.
- Contact Data: e.g. address history, email address, and phone numbers.
- Financial & Employment Data: e.g. annual income, monthly expenditure, employment status, employer name, job title, and bank account details (sort code and account number for direct debit setup).
- Vehicle & Finance Proposal Data: e.g. vehicle details (make, model, registration mark, mileage, price), deposit amount, cash balance, monthly budget, and preferred loan term.
- Credit Eligibility & Search Outcomes: e.g. soft credit search scores, affordability indicators, lending criteria matching results, panel lender decision statuses (approvals, declines, conditional offers), and underwriting notes.
Credit Reference Agencies (CRAs) & Credit Searches
When you run a finance check or submit a credit application, Fullbeam, receiving lenders, and integrated credit bureau data providers (such as Experian, Equifax, or TransUnion) process your personal data to conduct credit and affordability assessments:
- Soft Credit Checks: Initial eligibility checks perform a soft credit search. Soft searches do not affect your credit score and are not visible to other lenders on your credit report.
- Hard Credit Checks: If you proceed to a full credit application with a receiving lender, that lender will perform a hard credit search, which leaves a visible footprint on your credit file.
Why We Use Your Data and Our Legal Reasons
Under UK data protection law, we must have a valid legal reason to use your personal data:
- Checking Credit and Routing Applications: We use your details to run your requested finance eligibility check, check lending rules, and send your application to suitable lenders on our panel. Our legal reasons are Legitimate Interests (running our broking business efficiently) and taking Steps Prior to Entering a Contract with you.
- Automated Decision-Making: Our platform uses automated eligibility engines to match your financial profile against the lending criteria of our panel lenders. These automated checks provide indicative eligibility scores only. Final lending determinations, approvals, or declinatures are made independently by the receiving lenders under their own automated underwriting models and privacy notices.
- Meeting Legal and Regulatory Rules: We use your details to satisfy our official duties under Financial Conduct Authority (FCA) rules, Consumer Duty requirements, and tax reporting laws, as well as to handle legal claims. Our legal reason is Legal Obligation.
- Preventing Fraud: We use your details to verify your identity, prevent financial crime, and check anti-fraud registers. Our legal reasons are Legitimate Interests and Legal Obligation.
Lenders Receiving Your Data
When you check finance options or submit an application, your personal data is routed to receiving financial institutions on the vehicle retailer's panel (including panel lenders facilitated by Fullbeam). The specific lenders receiving your details are presented to you inside the online finance tool before your check or application is submitted.
These lenders receive your information as Independent Data Controllers. They will run their own credit checks and, if you move to a full application, will perform a hard credit search on your credit record. Lenders handle your personal data under their own separate privacy notices, which you can read before signing a final finance contract.
Keeping Your Data Safe and Extra Support
Our systems are built strictly to handle standard identity and financial information needed for vehicle loans.
- Important Warning: For your personal security, please do not share detailed clinical medical records, card numbers, PINs, or passwords in free-text boxes or messaging tools.
- Extra Support: If you need extra support or adjustments for your application (such as needing extra time to review documents or requiring communication in a specific format), the primary organisations to inform are the vehicle retailer or the lender. However, if Fullbeam contacts you directly (for example, to speed up underwriting), please let us know. This allows us to record the operational support you need without storing unnecessary medical details.
3. Business Partners
This section applies to sales staff, directors, account managers, and representatives working for vehicle retailers, commercial clients, software partners, and lenders who deal with Fullbeam.
How We Obtain Your Personal Data
We collect personal data relating to business contacts from a variety of sources, including:
- Direct Interactions: Personal data you provide to us directly during phone calls, email exchanges, commercial negotiations, onboarding forms, or business meetings.
- Our Technology Partner (iVendi Limited): Business contact details and vehicle retailer information passed to us by iVendi Limited when introducing vehicle retailers to Fullbeam's credit broking panel or managing joint commercial accounts.
- Lenders and Financial Institutions: Account contact details shared with us by panel lenders to administer joint broking arrangements.
- Publicly Available and Commercial Sources: Information gathered from public corporate registers (such as the Financial Conduct Authority Financial Services Register and Companies House), vehicle retailer websites, commercial directories, and professional networking platforms (such as LinkedIn).
What Personal Data We Process
- Work Contact Details: Name, job title, corporate email address, work phone number, workplace address, and employer company name.
- Administrative and Communication Records: Email correspondence, meeting notes, call records, commercial contract management files, and administrative notes saved within our corporate tools.
- Regulatory and Due Diligence Details: Directorship status, FCA reference numbers, corporate background checks, and regulatory verification records.
- Commercial & Financial Settlement Data: Bank account details, payment processing records, invoice histories, commission statements, and B2B payout remittance logs.
- Executing Commercial Contracts & Payouts: To manage commercial agreements, administer vehicle payout fund transfers between lenders and vehicle retailer, process fee deductions, and maintain financial audit trails. Our legal reasons are Contractual Performance and Legal Obligation (complying with HMRC tax reporting and corporate accounting rules).
Why We Use Your Data and Our Legal Reasons
- Running Contracts: To administer, execute, and deliver commercial agreements and credit broking service arrangements with vehicle retailers, lenders, and commercial partners. Our legal reason is Contractual Performance.
- Managing Commercial Relationships: To manage day-to-day business accounts, deliver administrative support, communicate service updates, and monitor account performance. Our legal reason is Legitimate Interests (operating and growing our commercial credit broking business).
- Legal and Regulatory Obligations: To conduct mandatory initial and ongoing merchant due diligence, background verification, regulatory checks, and quality monitoring on vehicle retailers in accordance with Financial Conduct Authority (FCA) rules and UK corporate laws. Our legal reason is Legal Obligation.
4. Fullbeam Website Visitors and General Enquiries
This section applies to anyone browsing our main company website [www.fullbeamfinancialservices.com] or sending us general business queries.
How We Obtain Personal Data
We collect personal data relating to website visitors and general enquiries through the following channels:
- Direct Interactions: Personal data you provide to us directly when filling out contact forms on our website or emailing our enquiry channels.
- Automated Website Technologies: Technical usage data collected automatically as you browse our website, using browser server logs, essential session cookies, and web tracking tools.
What Personal Data We Collect
- Enquiry Details: Name, business contact details, company name, and message contents sent through web forms or direct emails.
- Technical Usage Details: Internet Protocol (IP) addresses, browser type, operating system, dynamic web session numbers, and page usage information.
Why We Use Your Data and Our Legal Reasons
Under UK data protection law, we rely on the following legal reasons to process website visitor and general enquiry data:
- Answering Business Queries and Relationship Management: To respond to your questions, manage incoming business requests, and provide information about our services. Our legal reason is Legitimate Interests (operating and growing our credit broking business).
- Website Security and Performance: To monitor website speed, ensure server stability, prevent cyber-attacks, and maintain network security. Our legal reason is Legitimate Interests.
- Essential and Analytics Cookies: Essential cookies required for our website to function load automatically under legal exemptions. Non-essential tracking cookies or site analytics run strictly in accordance with PECR and the Data Use and Access Act 2025 (DUAA), based on your Consent or built-in opt-out choices.
5. Who We Share Your Personal Data With
Fullbeam never sells, rents, or trades your personal data to third parties for marketing. Depending on whether you are a vehicle finance applicant, a business partner, or a website visitor, we share personal data with the following categories of receiving organisations where necessary to deliver our credit broking services, run our business, or comply with UK law:
- Panel Lenders and Finance Providers: Independent data controllers who receive consumer finance application payloads to check affordability, make lending decisions, and manage joint credit broking arrangements with Fullbeam. The specific lenders on a panel are displayed within the software application journey prior to submission.
- Vehicle Retailers: Independent data controllers who receive returned credit eligibility statuses, loan decisions, and application outcomes to complete vehicle sales and assist consumers with finance arrangements.
- Technology and Cloud Infrastructure Providers: Our primary SaaS software provider, iVendi Limited, acts as our main Data Processor hosting our secure UK cloud infrastructure (Amazon Web Services UK), database connections, and technical API gateways under strict data processing agreements. We also use vetted third-party software providers for secure administrative communications, business operations, and web hosting.
- Identity Verification and Anti-Fraud Agencies: Specialist fraud prevention bodies (such as CIFAS) and identity verification providers who cross-reference details to detect financial crime, verify identities, and prevent fraud.
- Professional Advisers and Corporate Services: External auditors, legal advisers, accountants, and insurers who provide professional advice, conduct regulatory audits, or assist with corporate governance.
- Regulators and Law Enforcement: We may share personal data with the Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO), police forces, or fraud prevention agencies (such as CIFAS) when legally required by official demand letters, court orders, or crime prevention laws.
- Payment Gateway Providers and Banking Partners: Vetted payment infrastructure providers (such as iVendi Pay and integrated payment gateways) and UK clearing banks that process commercial payout transfers, direct debits, and financial settlement transactions between lenders, Fullbeam, and vehicle retailers.
6. Moving Data Outside the UK
Our primary databases, credit evaluation systems, and application platforms are stored securely on cloud infrastructure located within the United Kingdom (UK) and the European Economic Area (EEA).
Where we or our service providers process personal data outside the UK or EEA (for example, for remote technical support, cloud utilities, or system maintenance), we ensure that appropriate legal safeguards are enforced under UK data protection laws.
These safeguards include ensuring that the transfer is protected by:
- UK Adequacy Regulations: Transferring personal data to countries officially recognized by the UK Government as providing an adequate level of data protection.
- Approved Contractual Safeguards: Implementing UK-approved Standard Contractual Clauses, International Data Transfer Agreements (IDTAs), or the UK-US Data Bridge to ensure your personal data receives the same high level of protection as it does in the UK.
7. How Long We Keep Your Data
We keep personal data only for as long as necessary to complete our broking work, manage business relationships, or meet legal, regulatory, and tax rules:
- Paid-Out Finance Applications: Retained for 12 years from loan commencement. Because Fullbeam can’t track the exact date an individual finance loan is settled with a lender, this 12-year window covers an average car loan term (6–7 years) plus the required legal limitation window to handle regulatory queries or defend civil claims under the Limitation Act 1980.
- Unpaid or Uncompleted Finance Quotes and Soft Checks: Retained for 12 months, allowing you time to return and finish an incomplete quote without accumulating outdated information.
- Business Partner Personal Data: Retained for the duration of our commercial relationship plus 6 years, to manage accounts and meet UK company laws.
- Sales Leads and Business Prospects: Retained for 24 months from our last contact before being removed.
- Marketing Opt-Out Lists: Retained permanently on an isolated list to ensure we honour your wish not to be contacted.
- Privacy Rights Requests and Incident Logs: Retained for 2 years after a query is closed, to demonstrate legal compliance to the Information Commissioner's Office (ICO).
Once these timeframes pass, your personal data is permanently deleted, overwritten, or anonymised.
8. Your Legal Rights
Under UK data protection law, you have the following rights when Fullbeam acts as the Data Controller for your personal data:
- Right to See Your Data: You can ask for a copy of the personal data Fullbeam holds about you.
- Right to Fix Mistakes: You can ask us to correct inaccurate or incomplete personal data.
- Right to Delete Data: You can ask us to delete your personal data if we do not have an overriding legal or regulatory reason (such as FCA record-keeping rules) to keep it.
- Right to Restrict Data Use: You can ask us to pause using your personal data while accuracy checks or legal disputes are sorted out.
- Right to Object: You can object to us using your data where we rely on legitimate interests or direct marketing.
- Right to Move Your Data: You can ask us to transfer your electronic application details to you or another company.
How to Use Your Rights
To use any of these rights, please write to our Data Protection Officer:
- Email: dpo@fullbeamfinancialservices.com
- Post: Data Protection Officer, Fullbeam Financial Services Limited, Llys Eirias, Abergele Road, Colwyn Bay, LL29 8BW.
- Telephone: 03453141998
What Happens Next
Response Time: We will acknowledge your request right away and provide a full reply within 1 calendar month.
Clarification Notices: Under the Data Use and Access Act 2025, if your request is unclear or very broad, we may ask you to clarify what you need. The 1-month response timer pauses on the day we send the clarification notice and starts again the business day after you reply.
Redirecting Your Request: If your request relates to data held purely inside a vehicle retailer’s or lender's separate system, we will inform you right away and point you to the correct data controller.
9. Questions and Complaints
If you have any questions or concerns about how Fullbeam handles your personal data, please contact us first at dpo@fullbeamfinancialservices.com so we can investigate and help you.
You also have the legal right to make a complaint at any time to the UK data protection regulator:
Organisation: Information Commissioner’s Office (ICO)
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
10. Updates to This Notice
We review this notice at least once a year to make sure it stays up to date with our business, Financial Conduct Authority (FCA) rules, and UK data protection laws. Any changes will be published directly on this page with an updated effective date.
