Privacy, GDPR & Cookie Policy

Last Updated: 13 July 2026

Company Name: Stepinto Group Ltd ("we", "us", "our")

Registered Office Address: 61 Bridge Street, Kington, HR5 3DJ

Company Registration Number: 10780880

ICO Registration Number: C1982808

Contact Email: hello@stepintogroup.com

1. Introduction & Overview

Stepinto Group Ltd is committed to protecting and respecting your privacy. This policy explains how we collect, process, store, and share personal data when you visit our website, interact with our social media advertisements, or use our telephone-assisted business finance qualification and introduction services.

We operate as a Data Controller under the UK GDPR (General Data Protection Regulation) and the Data (Use and Access) Act 2025.

2. The Data We Collect

We collect, use, and store different kinds of personal and business data, which we group as follows:

• Identity Data: First name, last name, and business title/position.
• Contact Data: Email address, telephone number, and trading/registered business addresses.
• Financial & Business Data: Trading history, annual turnover, required loan amounts, bank statement metrics, and funding purposes established during our qualification calls.
• Technical & Usage Data: Your IP address, browser type, device information, and data regarding how you interact with our online lead forms and landing pages.

3. How We Process Your Data (Lawful Basis)

Under the UK GDPR, we must have a valid lawful basis to process your data. The table below outlines how we use your data depending on whether you are a B2B (Corporate) or B2C (Consumer/Sole Trader) applicant:

4. Data Sharing & Third-Party Brokers

Stepinto Group Ltd is a data intermediary. To fulfill your request for financing options, we share your data with trusted partners:

• Selected Finance Brokers: Once we establish your requirements via a form submission or a qualification call, we securely transmit your data to third-party commercial finance brokers within our network.
• Regulatory Transfer of Responsibility: The moments your data is transferred to a partner broker, they become an independent Data Controller of that data. They and their ultimate lending panels may perform commercial or personal credit checks via credit reference agencies (e.g., Experian, Equifax), which may leave a footprint on your credit files.
• No Selling of Data: We never sell, rent, or lease your personal data to external marketing brokers or third parties unrelated to your commercial finance inquiry.

5. Cookies and Tracking Technologies (PECR Compliance)

Our website uses cookies and similar tracking pixels (including the Meta Pixel and Google Analytics tags) to analyze traffic and measure ad performance.

• Strictly Necessary Cookies: Loaded automatically to make our forms and website function safely.
• Marketing and Analytical Cookies: Blocked by default. These tracking tools will never load onto your device or track your web activity unless you explicitly click "Accept All" or "Allow Marketing Cookies" on our interactive pop-up Cookie Banner.
• How to Opt-Out: You can clear, block, or manage your cookie preferences at any absolute time via your web browser settings.

6. Marketing Communications & Opt-Out Rights

If you have submitted your details, we or our partner brokers may contact you via SMS or email regarding your inquiry. You possess an absolute right to halt these communications at any time:

• SMS: Text back the word "STOP" to immediately opt-out of text marketing.
• Email: Click the "Unsubscribe" link present at the bottom of any email we send.
• Suppression: When you opt out, your data is moved to a permanent internal suppression list to ensure our CRM software automatically blocks any future outreach to your number or email.

7. Data Retention

We only keep your personal data for as long as necessary to fulfill the purposes we collected it for. Unconverted leads or data from inquiries that do not progress are safely deleted or anonymized after 12 months. Data required for financial transparency, commission tracking, or regulatory audit compliance is safely archived for up to 6 years.

8. Your Statutory Rights Under UK GDPR

You have specific legal rights regarding your personal data, including:

• The Right of Access (Subject Access Request): You can ask us for a copy of all personal data we hold about you at any time.
• The Right to Erasure ("Right to be Forgotten"): You can request that we delete your data from our active systems.
• The Right to Rectification: You can demand that we correct inaccurate or incomplete data.

9. Formal Complaints Handling Process

In strict compliance with the Data (Use and Access) Act 2025, Stepinto Group Ltd maintains an organized internal procedure for data complaints:

• If you believe we have mishandled your data, you must submit a formal complaint via email to: hello@stepintogroup.com.
• We will formally acknowledge receipt of your data complaint within 30 days.
• We will investigate your claim thoroughly and notify you of our findings and the actions taken to remedy the issue without undue delay.
• If you remain unsatisfied with our response, you have the legal right to escalate the matter and lodge a formal complaint directly with the Information Commissioner's Office (ICO Complaints Portal).