Your data, in your hands — downloading what we hold about you
Earlier this year we set out to make every UK GDPR right easier to use. The first one we have shipped end-to-end is your right of access under Article 15 — the right to receive a copy of the personal data we hold about you. From this week, every customer can sign in to the portal, open the Account tab, and click Download my data. The system assembles a single JSON file with your profile, preferences, every application and loan, your full audit history, your behavioural-signal aggregate and your consent record, and downloads it immediately.
What’s in the file
The export contains: your profile (name, email, registered date), preferences (language, palette, accessibility settings), consent records (auto-decisioning, marketing), audit log (every login, edit, payment, e-sign, document upload, and any impersonation events by our team), your linked customer record, your applications and loans with their key facts, and an aggregated view of the behavioural signals our decisioning engine sees. It is a single JSON file because that format is structured and machine-readable — easy to inspect in any text editor and easy to share with your accountant or solicitor.
What’s not in the file
We do not include another person’s data — anything that belongs to a joint applicant, a broker or a member of staff is excluded. We do not include the raw image bytes of any ID document you uploaded (we describe them by metadata: type, captured at, verification status). We do not include internal staff notes that are flagged private (these can be requested separately and we review them carefully before release, to protect third-party privacy and our team).
How a delete request works
The right to erasure under Article 17 is more nuanced because we are subject to retention requirements under financial-services law for live loans. You can ask for deletion through Support; we will respond within the 30-day statutory window. If you have an active loan we will explain which categories of data we are required to retain and for how long; everything else we will delete.
For staff: the same pack
If you call us asking for a SAR pack on paper or by email, the staff member dealing with your request will run exactly the same export against your record and attach it to their reply — so a phone request gets you the same data your one-click download would. Our hardship and complaints processes use the same pack too, so the picture is consistent regardless of how you ask.
Why we built it this way
A right that requires you to fill in a form and wait 30 days is a right with friction. Removing the friction is part of taking it seriously. The JSON is the canonical pack — easy to read, easy to attach, easy to audit. If you have any feedback on what’s in the file or what should be added, please contact us.
