Privacy notice

Who is responsible for your information

Credovo Technologies Limited, registered in the Dubai International Financial Centre under licence number 11722, operates this website and platform. This notice covers information we process to operate those services. You can contact us at [email protected] or at the registered address shown on this page.

Credovo Technologies Limited is not a lender. A lender, broker, solicitor or verification provider may be independently responsible for information it processes for its own purposes. Its privacy notice applies to that processing; the relevant provider will be identified during your application.

Information we handle

We handle account and contact details, application information, property addresses and valuations, requested borrowing, company details, and correspondence. Where you provide documents, these may include tenancy agreements, redemption statements and other evidence supporting your application.

Identity and company checks may involve identity documents, facial verification, dates of birth, director and beneficial-owner information, and sanctions or politically exposed person screening. Verification providers may process biometric information as explained in their notices and the verification journey.

If you choose to connect a bank account, the authorised connection may provide account details, balances and transactions for the checks explained to you, including income, rental history or available funds. We also process technical information needed to operate and protect the service, such as IP addresses, session records and security logs.

Where information comes from

Information may come from you, a broker or business representative acting for you, connected financial institutions, identity-verification services, company registries and property-data providers. If you supply information about another person, you must have authority to do so and make this notice available to them.

Why we use information

We use information to create and secure accounts, process applications, verify identity and company details, assess property and financial information, provide requested services, communicate with you, investigate complaints, prevent misuse and maintain records.

Where applicable data-protection law requires a lawful basis, we rely on steps requested before entering a contract or performance of a contract, legal obligations, and legitimate interests in operating a secure service and preventing fraud. We use consent where required, including for particular connections or sensitive-data processing. Additional legal conditions apply to sensitive information; the relevant check will explain its purpose and requirements.

We also evaluate property-valuation tools using property characteristics and valuation results. These evaluation records are separate from lending decisions and do not include borrower identity or bank-account data in the model input.

Automated tools and application decisions

The platform uses automated calculations and checks, including property estimates, loan-to-value calculations, identity verification and indicative mortgage illustrations. An illustration or decision in principle is not a binding mortgage offer. Final lending terms are subject to the lender’s assessment.

If you believe an automated result is wrong, contact [email protected] with your application reference. You may ask for an explanation, correct inaccurate information and request human review where applicable law gives you that right.

Sharing and international processing

We share information as needed with service providers supporting hosting, account security, email, identity and company checks, banking connections, property reports and document processing. We may also share relevant information with the lender, your authorised broker or solicitor, professional advisers, and authorities where legally required.

The company is established in the DIFC and the service supports UK applications. Information may be processed in other countries by service providers. Where cross-border transfer restrictions apply, the transfer must use a permitted mechanism and appropriate safeguards. Contact us for information about the recipients and safeguards relevant to your application.

Retention and security

We retain information for as long as needed for its purpose, including managing your account or application, meeting applicable recordkeeping obligations, handling disputes and preventing fraud. Retention depends on the type of record and applicable requirements; ask us for the period or criteria relevant to your information.

Deleting a draft application does not necessarily delete every associated record. Activity and property-model evaluation records may be retained separately, and legal obligations may require some records to be kept. Access controls and technical protections help safeguard information, but no online service can guarantee absolute security.

Your rights and how to contact us

Depending on the law that applies, you may request access, correction, deletion, restriction, portability or object to certain processing. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. Withdrawing a connection or refusing information needed for a check may prevent us from completing that service.

Send requests to [email protected]. Tell us what you need and include an application reference where relevant; do not email passwords or full bank credentials. We may need to verify your identity before responding. We respond within the period required by applicable law.

Complaints and changes

You can raise a privacy concern with us and, where applicable, with the DIFC Commissioner of Data Protection or the UK Information Commissioner’s Office. You do not have to complete our complaints process before exercising a right to complain to a regulator.

We may update this notice as the service or legal requirements change. The date above identifies the latest version.