Privacy Policy

Introduction

Boshhh Group Limited is committed to protecting your privacy and handling personal data lawfully, transparently, and securely in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, share, and retain personal data when you interact with our websites, platforms, services, and tools.

By accessing our website or using our services, you acknowledge that you have been provided with this Privacy Policy and understand how your personal data is processed as described below.

Who we are

Boshhh Group Limited is a UK-based fintech and data services provider. We offer technology and analytics tools to regulated organisations, service providers, and consumers, including affordability assessment, open banking insights, data verification, identity checks, and related intelligence services.

For the purposes of UK data protection law, Boshhh Group Limited acts as a data controller where it determines how and why personal data is processed, and as a data processor where it processes data strictly on the documented instructions of a third party.

Our registered address is 253 Monton Road, Eccles, Manchester, England, M30 9PS. Data protection enquiries can be sent to privacy@boshhhgroup.com.

How we collect personal data

We collect personal data directly from you when you interact with our website, request information, download materials, contact our teams, or use our services. We may also receive personal data indirectly from third-party organisations that use our services, for example where a provider uses our tools as part of their own assessment or verification process.

Where permitted by law and relevant to the service provided, we may receive data from regulated sources such as credit reference agencies, identity verification providers, or secure open banking connections authorised by you. We also collect limited technical data through cookies, logs, and security monitoring tools.

Categories of personal data we process

Depending on the service, we may process identity and contact details, account and service usage information, financial and transactional data obtained via open banking, credit or affordability indicators, verification results, identification documents and biometric data where required for functionality, technical information such as IP address and device type, and communication or preference data.

We process only the personal data necessary for the relevant purpose.

Purposes of processing

We process personal data to provide and operate our services, including affordability, eligibility, verification, and compliance checks. We use data to manage enquiries, customer relationships, platform security, fraud prevention, and misuse detection, and to comply with legal and regulatory obligations.

Where appropriate, and subject to user choice, we may review information to identify other claims or related services that an individual may be eligible for. Any such review is limited to closely related services and is not required to access core functionality.

Lawful bases for processing

We rely on contractual necessity where processing is required to provide services requested by the user. We rely on legitimate interests where processing is necessary to operate, secure, and improve our services, provided those interests are not overridden by the individual’s rights and freedoms. Where we rely on legitimate interests, we assess the impact of our processing on individuals’ rights and freedoms and document those assessments in line with UK GDPR requirements.

We rely on legal obligations where processing is required to comply with applicable laws or regulatory requirements.

Where consent is required, for example for optional eligibility reviews or communications, consent is obtained separately, is freely given, informed, and unambiguous, and can be withdrawn at any time.

Existing data relationships and third-party use

In some circumstances, personal data is obtained indirectly where a third party uses our services as part of their own process. In these cases, the third party determines the purpose of the initial processing, and Boshhh Group Limited acts as either a processor or an independent controller depending on the service.

Where Boshhh Group Limited acts as an independent controller, this Privacy Policy applies. Where we act as a processor, we process data only on documented instructions and in accordance with applicable data protection obligations.

Sharing personal data

We may share personal data with technology and infrastructure providers that support our platform, such as cloud hosting, analytics, communications, and security providers. We may share data with regulated organisations or clients where necessary to deliver a service, for example sharing verification or affordability outcomes.

We may also share data with credit reference agencies, fraud prevention services, or identity verification providers where relevant and permitted by law. We may disclose data to regulators, law enforcement, or professional advisers where required.

We do not sell personal data.

Open banking data

Where you authorise access via open banking, access is secure, encrypted, read-only, and time-limited. Only the data necessary for the stated purpose is retrieved. Live access is not maintained unless explicitly authorised. Historic data may be retained in accordance with our data retention policy and regulatory requirements.

We use secure open banking technology provided by Finexer LTD, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (firm reference number 925695) as an Authorised Payment Institution to provide account information services and payment initiation services. Finexer LTD enables regulated access to bank account information on our behalf in accordance with applicable open banking standards.

Open banking data is processed in line with applicable regulations and industry standards.

Data retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, taking into account legal, regulatory, and operational requirements. Enquiry and sales-related data is typically retained for up to twelve months. Customer, assessment, and verification data may be retained for longer periods where required by regulation or to establish, exercise, or defend legal claims.

Open banking and transactional data is retained for the minimum period necessary. Marketing and preference records are retained until withdrawn. Data is securely deleted or anonymised when no longer required.

Your rights

You have the right to access your personal data, request correction of inaccurate or incomplete data, request deletion in certain circumstances, restrict processing, and object to processing where we rely on legitimate interests. Where processing is based on consent, you have the right to withdraw that consent at any time.

You may also request data portability where applicable. Requests can be made by contacting privacy@boshhhgroup.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

Automated decision-making

Some services involve automated processing, including profiling, to support affordability, eligibility, or verification outcomes. Where decisions are based solely on automated processing and have legal or similarly significant effects, individuals have the right to request human intervention, express their view, and contest the decision.

International data transfers

Where personal data is transferred outside the United Kingdom, appropriate safeguards are applied, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include access controls, encryption, monitoring, and staff training, and are reviewed regularly to ensure ongoing effectiveness.

External links

Our websites may contain links to third-party sites or services. We are not responsible for their privacy practices and encourage users to review the relevant privacy policies.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be published with a revised effective date. We encourage users to review the policy periodically.

Contact us

If you have any questions about this Privacy Policy or how personal data is handled, please contact privacy@boshhhgroup.com. For general support enquiries, contact help@boshhhgroup.com.