Privacy policy

‍

Where the provision of certain personal data is required for us to provide a service, we will indicate this. If you choose not to provide it, we may be unable to provide the service requested.

4. How We Collect Your Personal Data

We collect personal data from the following sources:

Directly from you, when you:

• Register for an account or use our services
• Submit invoices, bank account details, or other documents
• Contact us by email, phone, or through the Website

Automatically, when you use the Website:

• Device and browser information, IP address, and usage data collected via cookies and analytics tools (see Section 13)

From third-party data sources — we receive personal data about directors, persons of significant control, and your Engaging Entity from the following sources. This is disclosed under Article 14 UK GDPR:

‍

6c. Phone Verification — Secondary Processing by Prelude

We use DING NEGOCE SAS (trading as Prelude) to verify your phone number during onboarding. Prelude acts as our processor for the verification service itself. However, under their terms, Prelude may also use your phone number and IP address as an independent controller for their own fraud prevention and algorithm improvement purposes. This secondary processing is carried out by Prelude under their own privacy notice: https://www.prelude.so/privacy.

6d. Credit Reference Agencies and Data Sources

As a responsible lender, we are required to assess the creditworthiness of our customers before providing services. We receive personal data about directors and persons of significant control from Creditsafe Group, Wiserfunding Limited, and Companies House (see Section 4).

If you would like contact details for these organisations so that you can access the data they hold about you, please contact us at hello@kikin.io.

6e. Other Permitted Disclosures

We may also share your personal data:

• With professional advisers (lawyers, auditors, insurers) where necessary for the conduct of our business
• In connection with a business transaction such as a merger, sale, financing, or reorganisation, subject to confidentiality obligations
• With law enforcement, regulators, or courts where required by law or to detect and prevent fraud and financial crime
• With investors or funders where required under funding arrangements, subject to appropriate confidentiality obligations

7. International Transfers

Some of the third parties listed in Section 6 are located outside the UK. Where we transfer your personal data to a country that does not have an adequacy decision from the UK, we ensure an appropriate safeguard is in place:

• UK Addendum to EU Standard Contractual Clauses (UK Addendum) — ICO-approved under s.119A(1) DPA 2018
• UK International Data Transfer Agreement (UK IDTA) — the alternative ICO-approved transfer mechanism
• UK-US Data Bridge — the UK extension to the EU-US Data Privacy Framework (DPF) for transfers to US organisations that have self-certified under the framework

Transfers to EU/EEA countries (including Ireland, Germany, France, and Belgium) are covered by the UK's adequacy decision for the EEA and require no additional mechanism.

You can request further information about the specific safeguards applied to any particular transfer by contacting us at hello@kikin.io.

8. Credit Reference Checks

As a responsible lender, Kikin has a legal obligation to assess the creditworthiness and suitability of our customers before providing services.

We share information with and receive information from credit reference agencies and other third-party data providers as part of this assessment. These providers give us information about a customer's or prospective customer's credit history and financial standing.

For details of the specific credit reference agencies we use and how to access the information they hold about you, please contact us at hello@kikin.io.

9. Marketing and Advertising

From time to time we may contact you with information about our products and services.

Where you are an individual subscriber with a non-corporate email address and we have not previously provided services to you, we will obtain your consent before sending marketing emails. You may withdraw consent at any time without affecting the lawfulness of any processing before withdrawal.

Where consent is not required under applicable law (for example, marketing to corporate email addresses, or to existing customers who have not opted out), we rely on our legitimate interests in promoting our services. We consider this proportionate and not prejudicial to your interests.

You can opt out of marketing at any time by clicking the unsubscribe link in any marketing email or by contacting us at hello@kikin.io.

10. Security

We implement appropriate technical and organisational measures — including encryption, access controls, and regular security reviews — to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure.

All personal information we collect is stored on secure servers. We will never send you unsolicited communications requesting your account password, bank account details, national identification numbers, or any other credentials.

11. Your Rights

Under UK data protection law, you have the following rights in relation to the personal data we hold about you: