Data & privacy

Calls to and from Credicorp Limited are recorded. We do this for staff training, to monitor and improve service quality, and to keep an accurate record of what was discussed and agreed.

Keeping a recording protects you as well as us: if there is ever a question about what was said — for example, an arrangement we agreed or instructions you gave — the recording is an impartial record we can both rely on.

Our Audio Recording page explains the practice in full, and our Privacy Policy sets out how recordings are stored, who can access them and how long they are kept. Recording also supports the checks we run when we verify it is really you on the phone.

Open this answer →

You have the right to ask us to delete the personal information we hold about you — often called the right to erasure or the "right to be forgotten" under the UK GDPR. We honour it. But erasure is not absolute: some records we are legally required to keep for a set period, and this article explains, honestly, what can and cannot be erased and when.

How to make the request

Use the General Support Enquiry form on our Forms & Requests page and tell us you are making an erasure request, or contact our privacy team directly. We will verify your identity first — this protects you from someone else asking us to delete or expose your records — and then act on the request within the statutory time limit.

What we can delete

Where we are holding data only because you consented, or for a purpose that no longer applies, we will erase it on request. Common examples include marketing-contact data and information tied to an enquiry that did not lead to a loan. If you simply want marketing to stop, you do not need a full erasure request — you can withdraw consent per channel in your preferences.

What we usually cannot delete straight away

• A live loan. While an agreement is active we have to keep the records needed to administer it and to meet our legal and regulatory obligations.
• Loan and repayment history. After the agreement ends, lending and repayment records — including data shared with business credit reference agencies — are retained for a defined period so other lenders see an accurate picture. See how long we keep your records for the timescales.
• Anti-money-laundering and identity records. The law requires us to keep these for a set period after our relationship ends.

When a record falls under one of these exceptions, we will tell you which exception applies and when the data will become eligible for deletion, rather than simply refusing.

Your other data rights

Erasure is one of several rights. You can also ask for a copy of your data through a subject access request, ask us to correct anything inaccurate, and object to certain uses. Our Privacy Policy sets out the full list and how we handle each one.

A note on credit reference data

We cannot unilaterally erase records held by a business credit reference agency about your company; those are governed by the agency's own retention rules. What we can do is correct anything we have reported inaccurately and ask the agency to update it — see what we share with business credit reference agencies.

Open this answer →

You have the right to ask for a copy of the personal information we hold about you — known as a subject access request.

To make one, contact our privacy team or use the General Support form, telling us it is a data request. We will verify your identity and respond within the statutory time limit. The 'Your rights' section of our Privacy Policy explains the process and the other rights you have over your data.

Open this answer →

If you choose to share your business bank statements by Open Banking, it helps to know exactly what you are consenting to, how long it lasts, and how to switch it off. This article covers the consent rules and your right to revoke. For whether to use Open Banking at all, see what Open Banking is and is it safe.

What you are consenting to

Open Banking access is read-only. When you connect, you authorise a regulated Account Information Service Provider (AISP) to let us read the transaction history on the account — up to 12 months back — so we can assess the company's affordability. We never see your online banking password, because you authenticate on your own bank's screen. The connection cannot move money: we do not take a payment from your account without your separate, per-payment authorisation at the time.

Consent expires automatically every 90 days

Under FCA rules, an Open Banking access consent expires automatically after 90 days. If we still need access at that point, you will be asked to re-authorise before the 90 days elapse. If you do not re-authorise, the connection simply lapses and we stop receiving data. This 90-day cycle is built into the framework to keep you in control — access cannot quietly run forever.

How to revoke at any time

You do not have to wait for the 90 days to run out. You can revoke an Open Banking connection at any time, with immediate effect, in either of two places:

• the Connections panel in your customer portal; or
• your bank's own app, where connected third parties can be managed and removed.

Once revoked, we stop receiving data straight away.

Revoking does not affect a signed loan

This matters: revoking an Open Banking connection does not affect any loan you have already signed. The agreement continues on the terms you accepted, and your repayments are unchanged. Revocation only stops future data sharing; it is not a way to cancel a loan, and it is never held against you.

The provider is regulated too

The AISP that carries the connection is authorised by the FCA in its own right and is subject to the same data-protection regime as us, following the standards published by the Open Banking Implementation Entity under the Payment Services Regulations 2017. If you would rather not connect at all, you can upload PDF or CSV statements instead — the decision uses the same information. Our Privacy Policy explains how the data is handled once we receive it.

Open this answer →

We use business credit reference agencies to help assess companies and to report how loans are run. Because some people worry a business application will mark their personal credit file, this article sets out exactly what is shared, with whom, and the difference between a soft and a hard search.

Which agencies

We work with business credit reference agencies — Experian Business, Creditsafe and Equifax Business. They hold commercial credit information about UK companies, separate from the consumer agencies that hold personal files.

Soft search vs hard search

• Soft search. Eligibility checks and our on-site calculator perform a soft search. A soft search is visible to you and to us, but not to other lenders, and it does not affect any credit score. You can see whether you are likely to qualify without leaving a mark.
• Hard search. A full application performs a hard search at the point you submit it, after you have explicitly agreed. A hard search leaves a footprint visible to other lenders for a period. Several hard searches in a short space of time can read as financial stress, so it is worth applying only when you intend to proceed.

What we report while the loan runs

Once a loan is live, the company's repayment performance can be reported to the business agencies. Payments made on time build the company's record of good account management; missed payments or arrears may also be reported against the company. After the account is settled and closed, it stays on the company's business file for a period so other business lenders see the full picture — see how long we keep your records.

What is not a personal credit search

The identity and anti-money-laundering check we run on the signing director is a verification step, not a personal credit search. We do not record this loan, or the application, against the director's personal consumer credit file with Experian, Equifax or TransUnion. For the fuller answer, see will applying for a Credicorp loan affect my credit file.

Seeing and correcting the data

A company can request a copy of its own business credit file from any of the business agencies, and you have a statutory right to ask an agency to correct anything inaccurate. If you think we have reported something wrong about the company, raise it through the General Support Enquiry form on our Forms & Requests page and we will investigate and, if needed, ask the agency to update the record. Our Privacy Policy explains how we use credit reference data in full.

Open this answer →

This is lending to your company, not to you personally, so it is the company's credit position we look at — not the director's personal consumer credit file. Here is exactly how that works.

Checks when you apply

When the company applies, we carry out two things: a business credit check on the company (using business credit reference agencies) and an identity check on the director to confirm who we are dealing with and to meet our anti-money-laundering obligations. The identity check is a verification step; it is not a personal lending search and is not recorded as one.

We do not record this loan, or the application for it, against the director's personal consumer credit file with Experian, Equifax or TransUnion. Borrowing with us will not show up when you next apply for a personal mortgage, card or loan.

The company's business credit file

The loan and how it is run can be reported to business credit reference agencies — Experian Business, Creditsafe and Equifax Business. That means:

• payments made on time build the company's record of good account management;
• missed payments or arrears may also be reported against the company;
• after the account is settled and closed it stays on the company's business file for a period so other business lenders can see the full picture.

How to see the file

A company can check its own business credit file with any of the business agencies above. A director can separately check their personal file with Experian, Equifax or TransUnion at any time — each must give free access under data-protection law, and looking at your own file never affects it.

If something looks wrong

If you think we have reported something incorrectly about the company, please raise it — the General Support Enquiry form on our Forms & Requests page is the right place to start. We will investigate and, if a correction is needed, ask the relevant agency to update the record. Our Privacy Policy sets out in full how we use credit reference data and your rights over it.

Open this answer →