Privacy policy

Who we are

MerchantHQ is published by Best Business Loans Ltd, registered in England and Wales (company number 16833937), registered office Cust Hall, Toppesfield, Halstead, Essex CO9 4EB. For UK GDPR we are the data controller.

What we collect

• Business data. Trading name, sector, monthly card volume, average transaction value, current acquirer (if any).
• Contact data. Name, email, phone.
• High-risk vertical declarations. Where applicable (CBD, vape, adult, firearms, gambling) so your enquiry goes to a broker partner that can place that category.
• Funding details. Only if you ask for business funding on the quote form: the amount you need, your total monthly turnover, your date of birth and your home address. We only pass these on after you tick the funding consent box.
• Credit and fraud-prevention data. Where you ask for business funding and tick the funding consent box, our funding providers (currently iwoca) share your information with credit reference agencies to run soft credit and identity checks, which do not affect your credit score. They also share it with fraud prevention agencies. If they spot fraud, you or others could be refused services, finance or employment.
• Server logs. IP, user agent, URL, timestamp. Retained 30 days.
• Cookies. Essential (form session, consent state). Analytics and marketing cookies only with consent.

Why we collect it

• To pass your quote-form enquiry to our card-payments broker partner (Merchant Advice Service, or Fena for peptide businesses), which contacts you about quotes from acquirers that fit your sector and volume.
• To pass your enquiry to the partner(s) you select.
• Where you ask for business funding on the quote form and tick the funding consent box, to pass those details to our funding providers (currently iwoca), so they can show you credit offers and carry out the credit and fraud-prevention checks described above.
• To improve match quality over time.

Lawful bases

Quote-form submissions and partner introductions: contract performance and legitimate interest. Sharing your details with our funding providers: your permission, given by ticking the funding consent box. Marketing: consent (opt in). Server logs and essential cookies: legitimate interest (running the site).

Who we share with

• Our card-payments broker partner (Merchant Advice Service, or Fena for peptide businesses), which receives every quote-form enquiry and pays us a fee for each introduction. It becomes an independent data controller from that point.
• Our funding providers, only where you ask for business funding on the quote form and tick the funding consent box. Our funding provider is currently iwoca, which becomes an independent data controller from that point. See iwoca's privacy policy.
• Credit reference agencies and fraud prevention agencies, through our funding providers, where you ask for business funding, to assess your application and to help prevent fraud and money laundering.
• Hosting and infrastructure (Cloudflare).
• Our database (Supabase), which stores quote-form enquiries, including answers saved as you go through the form, and our email providers (Resend and Google), which deliver enquiry emails to our team and broker partner, and FormSubmit, which sends a backup copy of each quote-form enquiry to our team only.
• Analytics, only if you accept cookies: Google Analytics, Microsoft Clarity (page and session analytics) and Zuko (form analytics). If you reject cookies, none of these load, apart from Google's cookieless consent-mode signals.
• A cookieless page-visit counter run by our web partner Rank4AI, which records the page, referrer and browser type and sets no cookies, and Companies House, which we query to look up your company.
• Email and CRM providers used to operate the site.
• Meta Platforms Ireland Ltd (Meta Pixel), only if you accept marketing cookies, to measure how our advertising on Facebook and Instagram performs and to attribute quote enquiries. See the cookie policy.
• YouTube (Google LLC), only if you press play on one of our videos: the video then loads from YouTube's privacy-enhanced address and YouTube receives your IP address and browser details under its own privacy policy. Nothing loads from YouTube before you press play.
• Awin (where you click an Awin-tagged sign-up link), limited to a referral identifier.

We do not sell personal data and we do not pass it to data brokers. The only advertising company that receives data from this site is Meta, and only through the Meta Pixel if you accept marketing cookies.

International transfers

Some of our processors (for example Cloudflare, Google and, depending on region, our database and email providers) may process personal data outside the UK and European Economic Area. Where they do, we rely on an adequacy decision or on the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards, so your data receives an equivalent level of protection.

Retention

• Quote requests that did not progress: 90 days.
• Partner introductions made: 6 years (commercial record-keeping).
• Email correspondence: 3 years.
• Marketing opt-outs: indefinitely.

Your rights

Access, rectification, erasure, restriction, objection, portability. Email privacy@merchanthq.co.uk to exercise any of these. Or complain to the ICO at ico.org.uk.