Last updated: October 2026
Photolease Limited is committed to protecting and respecting your privacy.
This notice explains how we collect and use your personal data, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.
Who we are
Photolease Limited (“Photolease”, “we”, “us”) is the controller of the personal data described in this notice.
Registered office: Ground Floor, 31 Kentish Town Road, London, United Kingdom, NW1 8NL
You can contact our privacy officer at info@photolease.co.uk.
Information we may collect about you
Depending on your relationship with us, we may collect and process:
- Identity and contact details – name, home and business address, date of birth, email address and telephone number, and the results of identity verification checks or copies of identification documents
- Business details – company or trading name, trading address, ownership and structure
- Information about other individuals connected to the application – such as directors, partners, guarantors and, where relevant to our anti-money laundering checks, beneficial owners
- Financial information – bank statements, company accounts, income and affordability information, and bank account details for collecting payments
- Credit information – credit history, credit scores and other information from credit reference agencies
- Fraud prevention information – results of fraud and identity checks
- Agreement information – details of the equipment financed, payments made and how your agreement is conducted, including any arrears, default and recovery activity
- Correspondence – emails, letters, and recordings and notes of telephone calls with you or with others acting on your behalf
- Website information – IP address, device and browser information, and how you use our website (see Cookies below)
Where we get your information. Some information comes directly from you. We also receive information from brokers, introducers and equipment suppliers who arrange or refer your application; from other applicants, directors, partners or guarantors connected to it; from your professional advisers; and from credit reference agencies, fraud prevention agencies, Companies House, HM Land Registry and other publicly available sources.
If you provide us with personal information about another individual, such as a director, partner or guarantor, please ensure they are aware of this privacy notice.
Do you have to provide it? You do not have to give us your personal data. However, we need it to assess your application and to enter into and manage an agreement with you. If you do not provide it, we may be unable to offer you finance.
Credit reference and fraud prevention agencies
When you apply to us, we will carry out searches with one or more credit reference agencies. These searches may cover your business and, where relevant, you as a sole trader, partner, director or guarantor. The agencies will record our search, and other lenders may be able to see it.
While your agreement is in place, we may share information with credit reference agencies about the agreement and how it is conducted. This includes payments made, missed payments, arrears and defaults. The agencies may share this information with other organisations to assess creditworthiness, verify identity, prevent fraud and trace debtors. If you make a joint application or tell us about a financial associate, your records may be linked.
We may also check your details with fraud prevention agencies. If fraud is identified, the agencies will record it, and this may result in others refusing to provide services, finance or employment.
The credit reference agencies have published a Credit Reference Agency Information Notice (CRAIN), which explains how they use and share personal data. It is available at www.experian.co.uk/crain.
How we use your information and our lawful bases
We use your information to assess your application, enter into and manage your agreement, and meet our legal and regulatory obligations. We may combine information you give us with information from other sources for these purposes.
| Purpose | Lawful basis |
| Assessing your application, entering into and managing your agreement, and collecting payments | Performance of a contract, or steps taken at your request before entering into one |
| Managing arrears, recovering debts and enforcing our legal rights | Our legitimate interests in recovering sums due to us and protecting and enforcing our legal rights; and, where applicable, legal obligation |
| Credit searches, fraud prevention and reporting to credit reference agencies | Our legitimate interests in lending responsibly and preventing fraud and financial crime |
| Meeting regulatory, anti-money laundering, tax and record-keeping requirements | Legal obligation |
| Running and improving our business, our systems and our website | Our legitimate interests |
| Sending marketing emails | Your consent or our legitimate interests (see Marketing below) |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more detail.
We record telephone calls to and from our offices. We do this to keep an accurate record of what was discussed, for staff training and quality monitoring, to meet our regulatory obligations, and to help resolve complaints or disputes. We rely on our legitimate interests and, where applicable, our legal obligations for this.
All credit decisions are made by our staff. We do not make decisions about you based solely on automated processing.
Marketing
We occasionally send email updates about our products and services, and only where the law permits. For individuals, sole traders and certain partnerships, we will send electronic marketing where you have consented or where the “soft opt-in” applies, for example where you have previously bought or negotiated to buy similar products or services from us and were given the opportunity to opt out. For corporate subscribers, such as limited companies and LLPs, we may send marketing where permitted by law and rely on our legitimate interests where personal data is involved.
You have the right to object to marketing at any time. Every email includes an unsubscribe link, or you can email us at info@photolease.co.uk.
We use a third-party email marketing platform to send these emails. It records whether emails are opened and which links are clicked, which helps us understand what is of interest to our customers.
Who we share your information with
We may share your personal information with:
- Credit reference agencies – to carry out credit searches and to report on how your agreement is conducted
- Fraud prevention agencies – to prevent and detect fraud
- Aryza – to manage your finance agreement throughout its lifecycle
- Aquis Insurance – to ensure suitable protection of the asset financed
- Bacs Payment Schemes – to collect direct debits from customer bank accounts
We may also share your information with selected third parties, including:
- Business partners, suppliers and sub-contractors for the performance of any contract we enter into with you, including any data processor we engage
- Providers of approved AI-enabled productivity and analysis tools, which our staff may use to assist with tasks such as reviewing documents, analysing information and preparing correspondence. Where personal data is processed through these services, we require appropriate contractual and technical safeguards governing its use, including restrictions on the use of our data for model training
- Our email marketing platform provider, to send marketing emails on our behalf
- Analytics providers that help us improve and optimise our website
We may disclose your personal information to other third parties:
- If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of that business or those assets
- If we are under a duty to disclose or share your personal data to comply with a legal obligation; to enforce or apply our terms and conditions and other agreements; or to protect the rights, property or safety of Photolease, our customers or others. This includes exchanging information with other companies and organisations for fraud prevention and credit risk reduction
Transfers outside the UK
Some of our service providers, including our AI tool, email marketing and website analytics providers, may store or process your data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum approved by the Information Commissioner’s Office. You can contact us for more information about these safeguards.
How we protect your information
We store your information on secure systems and use appropriate technical and organisational measures to protect it against unauthorised access, loss or damage. These include internal data protection policies, staff training, access controls, regular reviews of our processing and data protection impact assessments where needed.
No method of transmission over the internet is completely secure, but once we have received your information we use strict procedures and security features to prevent unauthorised access.
How long we keep your information
We keep personal data relating to an agreement for six years after the agreement ends. If your application does not proceed, we keep your data for two years from the date of the application, unless we need to keep it for longer for fraud prevention, regulatory, complaint or legal purposes. We may keep data for longer where the law requires it or where it is needed to bring or defend a legal claim.
Your rights
Under data protection law you have the following rights over your personal data. Some apply only in certain circumstances.
- Access – to request a copy of the personal data we hold about you. This is normally free and we will respond within one month.
- Rectification – to have inaccurate or incomplete data corrected.
- Erasure – to have your data deleted, for example where it is no longer needed for the purpose it was collected, or where you withdraw consent and there is no other lawful basis for keeping it.
- Restriction – to ask us to limit how we use your data, for example while we check its accuracy.
- Portability – to receive data you have given us in a reusable format, or have it transferred to another organisation.
- Objection – to object to processing based on our legitimate interests, and to object to direct marketing at any time.
- Withdrawing consent – where we rely on your consent, to withdraw it at any time. This does not affect processing already carried out.
- Automated decision-making – not to be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions.
To exercise any of these rights, contact our privacy officer at info@photolease.co.uk.
Complaints
If you have a concern about how we handle your data, we would welcome the opportunity to resolve it. Please contact our privacy officer at info@photolease.co.uk.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint.
Cookies
Cookies are small files placed on your device when you visit a website. We use them to make our website work and to understand how visitors use it so we can improve it.
| Cookie | Type | Purpose |
| WordPress | Essential | Runs and manages the content of our website |
| Google Analytics | Analytics | Helps us understand how visitors interact with our website so we can improve it |
Essential cookies are needed for the website to work. We only set analytics cookies if you agree to them through our cookie banner, and you can change your choice at any time. You can also block or delete cookies through your browser settings, although some parts of the website may not work properly if you do.
Google Analytics may process data outside the UK (see Transfers outside the UK above).
Changes to this privacy notice
We may update this privacy notice from time to time. The date at the top of this notice shows when it was last updated. Where we make significant changes, we will take reasonable steps to bring them to your attention.
Links to other websites
Our website may contain links to the websites of our partners and other organisations. These websites have their own privacy policies, and we are not responsible for them. Please check those policies before you submit any personal data to those websites.