Privacy policy

Who we are

MerchantHQ is published by Best Business Loans Ltd, registered in England and Wales (company number 16833937), registered office Cust Hall, Toppesfield, Halstead, Essex CO9 4EB. For UK GDPR we are the data controller.

What we collect

• Business data. Trading name, sector, monthly card volume, average transaction value, current acquirer (if any).
• Contact data. Name, email, phone.
• High-risk vertical declarations. Where applicable (CBD, vape, adult, firearms, gambling) so we route only to acquirers that accept the category.
• Server logs. IP, user agent, URL, timestamp. Retained 30 days.
• Cookies. Essential (form session, consent state). Analytics and marketing cookies only with consent.

Why we collect it

• To match you to acquirers, brokers or direct partners that fit your sector and volume.
• To pass your enquiry to the partner(s) you select.
• Where you tell us on the quote form that you also want business funding or working capital, to pass those details to our funding partner, an independent UK finance broker, so they can contact you about funding options.
• To improve match quality over time.

Lawful bases

Quote-form submissions and partner introductions: contract performance and legitimate interest. Marketing: consent (opt in). Server logs and essential cookies: legitimate interest (running the site).

Who we share with

• Acquirers, brokers and direct partners you select. They become independent data controllers from that point.
• Our funding partner (an independent UK finance broker), only where you ask for business funding on the quote form. They become an independent data controller from that point.
• Hosting and infrastructure (Cloudflare).
• Email and CRM providers used to operate the site.
• Awin (where you click an Awin-tagged sign-up link), limited to a referral identifier.

We do not sell personal data. We do not pass data to advertisers or data brokers.

International transfers

Some of our processors (for example Cloudflare, Google and, depending on region, our database and email providers) may process personal data outside the UK and European Economic Area. Where they do, we rely on an adequacy decision or on the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards, so your data receives an equivalent level of protection.

Retention

• Quote requests that did not progress: 90 days.
• Partner introductions made: 6 years (commercial record-keeping).
• Email correspondence: 3 years.
• Marketing opt-outs: indefinitely.

Your rights

Access, rectification, erasure, restriction, objection, portability. Email [email protected] to exercise any of these. Or complain to the ICO at ico.org.uk.