Privacy Notice

1. Introduction

Graphene Funding Ltd ("Graphene", "we", "us" or "our") is committed to protecting and respecting your privacy.

This Privacy Notice explains how we collect, use, store, share and protect personal information when you:

• visit our website;
• contact us regarding our services;
• engage us to assist with a funding requirement;
• receive marketing communications from us; or
• otherwise interact with our business.

We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection laws.

2. About us

Graphene Funding Ltd is a real estate debt advisory business that assists property investors, developers, businesses and other borrowers in identifying, structuring and arranging suitable funding solutions.

Graphene Funding Ltd is a company incorporated in England and Wales with company number 15629247. Its registered office is:

Our Manchester Office is:

For the purposes of UK data protection legislation, Graphene Funding Ltd is the controller of the personal data described in this Privacy Notice.

Graphene Funding Ltd is registered with the Information Commissioner’s Office ("ICO") under registration reference ZB681322.

We are not a lender and do not make lending or credit decisions. Funding decisions are made independently by the relevant lender, investor, bank, debt fund or other funding provider.

3. Information we collect

Depending on the nature of our relationship with you, we may collect, use and store the following categories of information.

Identity information

• name;
• date of birth;
• nationality;
• passport, driving licence or other identification details; and
• director, shareholder and beneficial ownership information.

Contact information

• postal address;
• email address; and
• telephone number.

Professional and business information

• occupation and employment information;
• business activities;
• directorships and ownership interests;
• company and group structure information; and
• information about professional advisers and representatives.

Financial and credit information

• income details;
• asset and liability information;
• net worth information;
• bank statements;
• management accounts and financial statements;
• credit information;
• funding requirements;
• source of wealth and source of funds information; and
• personal guarantee information.

Property information

• property and asset schedules;
• ownership details;
• development information;
• tenancy and occupational information;
• valuation information; and
• property-related income and expenditure.

Transaction information

• facility requirements;
• business plans and financial projections;
• transaction structures;
• transaction correspondence and meeting notes;
• due diligence information;
• professional reports and advice; and
• documents produced or received in connection with a funding enquiry or transaction.

Technical and website information

• internet protocol address;
• browser type and version;
• device information;
• website performance and aggregate usage information, where analytics has been accepted;
• the analytics preference stored in your browser; and
• marketing and communication preferences.

4. How we collect information

We may collect information directly from you when you:

• contact us using the email address or telephone details published on our website;
• contact us by social media or another communication channel;
• provide information relating to a potential funding requirement;
• engage us to provide debt advisory services;
• attend a meeting or communicate with our personnel; or
• subscribe to receive marketing communications.

We may also receive information from third parties and public sources, including:

• lenders and funding providers;
• introducers, brokers and other intermediaries;
• solicitors and legal advisers;
• accountants and tax advisers;
• surveyors and valuers;
• credit reference and fraud prevention agencies;
• identity verification and due diligence providers;
• Companies House, HM Land Registry and other public registers;
• publicly available sources; and
• individuals acting on behalf of a corporate client or transaction party.

If you provide personal data relating to another individual, you should ensure that you are authorised to do so and, where appropriate, that the individual has been directed to this Privacy Notice.

5. Corporate and transaction information

A significant proportion of the information we receive relates to companies, partnerships, trusts, property assets, investment vehicles and commercial transactions.

Information relating solely to a corporate entity does not necessarily constitute personal data under UK data protection law.

However, corporate records may contain personal data relating to directors, shareholders, beneficial owners, guarantors, employees, tenants, sole traders, professional advisers and other identifiable individuals. Where transaction documentation contains personal data, we will process that information in accordance with this Privacy Notice.

6. How we use personal information

We may use personal information to:

• respond to enquiries;
• understand and assess funding requirements;
• identify potential funding providers and finance options;
• structure, present and help arrange finance transactions;
• prepare and review transaction materials;
• communicate with clients, lenders, introducers and professional advisers;
• manage current and prospective business relationships;
• verify identity and undertake due diligence;
• prevent and detect fraud, misuse and financial crime;
• manage complaints, disputes and legal claims;
• comply with applicable legal obligations;
• operate, secure and improve our business, systems, services and website;
• maintain records and carry out internal administration; and
• send marketing communications where permitted by law.

7. Lender introductions and transaction assessments

Where you engage us to identify or arrange funding, we may review and analyse information relating to you, your business, property assets, proposed transaction and associated individuals.

Where appropriate, we may share relevant information with prospective lenders, debt funds, investors and other funding providers so that they can consider whether finance may be available and assess a proposed transaction.

These organisations will generally act as independent controllers of any personal data they receive and will process that information in accordance with their own privacy notices and legal obligations.

Any decision whether to provide funding remains the responsibility of the relevant lender or funding provider.

8. Use of artificial intelligence and technology-assisted tools

We may use secure artificial intelligence ("AI") systems and other technology-assisted tools to support the delivery of our services and the operation of our business.

These tools may assist our personnel in reviewing, analysing, summarising, organising and processing information provided in connection with funding enquiries, real estate transactions, corporate structures and client relationships.

For example, such tools may be used to:

• analyse financial, corporate and property-related information;
• review, summarise and organise transaction documents;
• extract and identify relevant information within documents and datasets;
• assist with assessing funding requirements and potential finance structures;
• prepare, review and format summaries, reports, correspondence and transaction-related documentation;
• support internal administration, quality control and operational processes; and
• improve the efficiency and consistency of our services.

AI and technology-assisted tools are used solely to assist our personnel with the analysis and processing of information relating to specific enquiries and transactions. They do not replace human oversight, professional judgement or decision-making.

We do not make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.

Personal data supplied to us in connection with a funding enquiry, client relationship or transaction will be processed using AI only for the specific analysis or other defined task for which the tool is being used. Graphene Funding Ltd will not use, or permit its AI service providers to use, that information to train AI models.

Where third-party technology providers process personal data on our behalf, we take appropriate steps to assess those providers and require appropriate contractual, technical and organisational safeguards. These arrangements must ensure that the information is used only to provide the specific analysis or service requested by us and is not used for AI model training.

9. Who we share information with

Where reasonably necessary for the purposes described in this Privacy Notice, we may share personal information with:

• banks, building societies and other lending institutions;
• challenger banks, specialist lenders and alternative finance providers;
• bridging and development finance providers;
• debt funds, institutional investors and other funding providers;
• introducers, brokers and transaction counterparties;
• valuers, surveyors and monitoring surveyors;
• solicitors and other legal advisers;
• accountants, tax advisers and other professional advisers;
• insurers and insurance brokers;
• credit reference, fraud prevention, identity verification and due diligence providers;
• cloud hosting, email, communications, CRM, document management and other technology providers;
• AI and document-processing providers;
• website hosting and analytics providers;
• IT support and cybersecurity providers;
• our insurers, auditors and other business advisers;
• a purchaser, investor or successor in connection with a proposed sale, investment, restructuring or transfer of all or part of our business; and
• regulators, courts, law enforcement agencies, public authorities and other parties where disclosure is required or permitted by law.

We require service providers acting on our behalf to process personal data only for authorised purposes and to maintain appropriate data protection and security arrangements.

10. Lawful bases for processing

The lawful basis we rely upon depends on the purpose and circumstances of the processing. We may rely on one or more of the following bases.

Contract and pre-contractual steps

Processing may be necessary to perform a contract with you or to take steps at your request before entering into a contract.

Legitimate interests

Processing may be necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your interests, rights or freedoms. These interests may include providing real estate debt advisory services, assessing and presenting funding opportunities, managing business relationships, preventing fraud, protecting our business, improving our services and operating efficiently.

Legal obligation

Processing may be necessary for us to comply with a legal obligation.

Consent

We may rely on consent where this is appropriate or required, including for certain marketing, analytics or special category processing. Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

11. Special category personal data

We do not ordinarily seek to collect special category personal data.

However, such information may occasionally be included in documents or information provided to us. This may include information about health or personal circumstances where relevant to a proposed transaction or a person’s communication or support needs.

Where we process special category personal data, we will do so only where an appropriate lawful basis and an additional condition under applicable data protection law are available. Where required, we will obtain explicit consent.

12. Marketing communications

We may send information about our services, market updates, industry insights, events and other business-related matters where permitted by law.

We may rely on consent or, where permitted, our legitimate interests to send marketing communications. We will take account of applicable electronic marketing requirements.

You may opt out at any time by clicking the unsubscribe link in an email or contacting us at contact@graphenefunding.co.uk.

Opting out of marketing will not affect service-related or transaction-related communications.

13. International transfers

Some organisations that process personal data for us or receive personal data in connection with a transaction may be located outside the United Kingdom.

Where we transfer personal data outside the United Kingdom, we will take steps required by applicable data protection law. Depending on the destination and circumstances, these may include relying on UK adequacy regulations, using approved contractual safeguards, carrying out relevant risk assessments or relying on another lawful transfer mechanism.

14. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, tax, accounting, reporting and record-keeping requirements and establishing, exercising or defending legal claims.

When determining an appropriate retention period, we consider:

• the nature, volume and sensitivity of the information;
• the purposes for which it is processed;
• whether a transaction completes and the duration of our relationship;
• contractual, legal and record-keeping requirements;
• applicable limitation periods;
• fraud prevention and security requirements;
• potential complaints, disputes or claims; and
• whether the purpose can be achieved by other means.

When personal data is no longer required, it will be securely deleted, destroyed or anonymised.

15. Information security

We maintain appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, disclosure, access or misuse.

Our measures may include access controls, secure cloud-based systems, encryption where appropriate, personnel procedures, supplier due diligence, system monitoring and incident-management arrangements.

Access to personal data is limited to personnel and service providers who have a business need to access it and who are subject to appropriate confidentiality obligations.

16. Your rights

Depending on the circumstances, your rights under UK data protection law may include the right to:

• request access to your personal data;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data;
• ask us to restrict the processing of personal data;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive certain personal data in a structured, commonly used and machine-readable format, and ask us to transfer it to another organisation;
• withdraw consent where we rely on consent; and
• raise a complaint with the ICO.

These rights are subject to legal conditions and exemptions. We may need to retain or continue processing certain information where permitted or required by law.

You will not normally be required to pay a fee to exercise your rights. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, where permitted by law.

We may ask for information needed to confirm your identity and clarify your request. We will respond within the period required by applicable law.

17. Cookies and website analytics

Our website uses local browser storage to remember whether you have accepted or rejected website analytics. This preference is not used to track you and is necessary to respect the choice you make. It remains in your browser until you change your choice or clear your browser data.

If you accept analytics, the website loads Cloudflare Web Analytics. This privacy-focused service helps us understand aggregate page visits and website performance so that we can improve the site. Cloudflare states that Web Analytics does not collect or use visitors’ personal data.

The analytics beacon is not loaded unless you select “Accept analytics”. If you reject analytics, it remains disabled. We do not use advertising or behavioural-targeting cookies.

You can change your decision at any time by selecting “Privacy choices” in the website footer. Further information about Cloudflare’s handling of information is available in its privacy policy.

18. Links to other websites

Our website may contain links to websites operated by third parties. We do not control those websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of each website you visit.

19. Contacting us

If you have any questions about this Privacy Notice, wish to exercise your rights or would like further information about how we process personal data, please contact:

Email: contact@graphenefunding.co.uk
Company number: 15629247
ICO registration reference: ZB681322

Registered office: Westminster House, 10 Westminster Road, Macclesfield, Cheshire, SK10 1BX.

20. Complaints

We hope that we can resolve any concern about how we process your personal information. Please contact us first at contact@graphenefunding.co.uk.

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection matters. Information about making a complaint is available on the ICO website.

Our ICO registration reference is ZB681322.

21. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our business, services, legal requirements or data processing practices. The latest version will be published on our website.