Privacy Notice
v1.3 October 2026
HGS Capital Ltd ("HGS Capital", "we", "us", "our") is committed to protecting your personal data and handling it responsibly. This Privacy Notice explains how we collect, use, store and share personal data in connection with our business activities as a commercial finance broker arranging business-purpose property finance.
HGS Capital Ltd is registered in England & Wales under company number 16781975 and is the data controller for the purposes of this Privacy Notice.
HGS Capital is a separate company from HGS Consultancy Ltd (company number 17455190), which provides development management services and has the same director. Each company is a separate data controller with its own privacy notice. We do not share personal data between the two companies, except where you are dealing with both on the same matter and sharing is necessary for that matter.
1. Who We Are
HGS Capital Ltd
32 Lambrook Terrace
Fulham
London
SW6 6TG
Email: privacy@hgscapital.co.uk
Website: www.hgscapital.co.uk
Telephone: +44 7885 609988
HGS Capital is registered with the Information Commissioner's Office under registration number ZC015898.
2. Scope
This Privacy Notice applies to personal data we collect in the course of:
responding to enquiries
assessing finance requirements
sourcing and arranging finance
carrying out AML / KYC and compliance checks
dealing with introducers, lenders, solicitors, valuers and other professional parties
maintaining our records and complying with legal and regulatory obligations
This notice applies to borrowers, guarantors, directors, shareholders, beneficial owners, introducers, professional contacts and other individuals whose personal data is provided to us.
3. How We Collect Personal Data
We collect personal data in the following ways:
directly from you, including by email, telephone, video call, WhatsApp and other messaging services, meetings, and forms you complete during an enquiry or transaction
from notes and transcripts of our calls and meetings with you (see section 9)
from third parties, including introducers, lenders, solicitors, valuers and other professional advisers involved in a transaction
from publicly available sources, including Companies House and other relevant databases
from loan documents you share with us, such as offer letters, statements and portfolio schedules, and from public records such as charges registered at Companies House and HM Land Registry
from identity verification, AML and fraud prevention providers
Where personal data is provided to us by a third party, we expect that they have the appropriate authority to share that data.
4. Personal Data
The personal data we collect, whether obtained directly or from third parties, may include:
Identity and contact information
name
date of birth
residential address
email address
telephone number
Professional and business information
employment details
company directorships
shareholdings and beneficial ownership information
Financial and transaction information
financial background
source of funds and source of wealth
credit history disclosures
details of the property and finance requirement
details of your existing loans, whether or not we arranged them, such as the lender, loan amount, interest rate and the dates your fixed rate, early repayment charges and loan term end
Verification and compliance information
identification documents
proof of address
AML / KYC checks
sanctions and PEP screening results
Correspondence and call records
emails, letters and message threads
notes and transcripts of calls and meetings
We may also receive information from third parties including:
introducers
lenders and funders
solicitors
valuers and professional advisers
Companies House
identity verification providers
publicly available sources.
5. How We Use Personal Data
We use personal data for the following purposes:
to assess your enquiry and determine whether we may be able to assist
to source indicative terms or agreements in principle
to package, present and progress finance applications
to verify identity and carry out AML, KYC, sanctions and related checks
to assess transaction structure, borrower profile and lender suitability
to communicate with you and relevant third parties involved in the transaction
to keep a record of your existing loans so we can contact you before a fixed rate, early repayment charge period or loan term ends, to discuss your options
to maintain internal records and an audit trail
to keep accurate records of calls, meetings and correspondence
to manage our business operations and professional relationships
to comply with legal, regulatory and professional obligations
to establish, exercise or defend legal claims where necessary
6. Data Processing
We process personal data on one or more of the following lawful bases:
Contract: where processing is necessary to take steps at your request or to perform our agreement with you
Legal obligation: where processing is required to comply with AML, fraud prevention, record-keeping or other legal obligations
Legitimate interests: where processing is necessary for our legitimate interests in assessing, arranging and managing finance transactions, keeping accurate records of our work, keeping in touch with clients about their existing loans before key dates, and operating our business, provided those interests are not overridden by your rights
Consent: where consent is required by law, including for certain marketing communications
7. Special Category Data & Criminal Offence Data
In some cases, we may process limited information relating to politically exposed person status, sanctions exposure, adverse media, criminal convictions or ongoing investigations where this is relevant to AML, fraud prevention or lender due diligence requirements.
We only process this information where permitted by law and where it is necessary for compliance, fraud prevention, substantial public interest, or the establishment, exercise or defence of legal claims.
8. Sharing Personal Data
We may share personal data where reasonably necessary with:
prospective and actual lenders, funders and their agents
solicitors, valuers, surveyors, quantity surveyors, title insurers and other professional advisers
AML/KYC, sanctions, fraud prevention, identity verification and credit reference providers
introducers and referrers, where relevant to the transaction
accountants, auditors, insurers and compliance advisers
regulators, law enforcement agencies, courts or other authorities where required by law
service providers who process personal data on our behalf (see section 9)
We only share personal data where it is necessary for the relevant purpose and on a need-to-know basis.
9. Service Providers & AI Tools
We use the following service providers to run our business. Microsoft, Granola and Sage act as our data processors: they process personal data on our instructions, under contract terms that require them to keep it secure. Dropbox, Doist, Anthropic and NameScan provide their services to us under their own terms and act as independent controllers of the personal data they process; their own privacy notices explain how they use it.
Microsoft (Microsoft 365): email, calendar and documents
Dropbox: storage of client files and records
Doist (Todoist): task management
Granola: notes and transcripts of calls and meetings
Anthropic (Claude): AI assistant used to help summarise correspondence and calls, organise records and prepare drafts
NameScan: sanctions, PEP and adverse media screening
Sage: accounting and invoicing
We use AI-assisted tools to help with administration only. Advice, recommendations and decisions are made by us, and we review AI-assisted output before relying on it. We do not make decisions about you based solely on automated processing. Decisions on whether to lend are made by the lender, not by us.
We may use a note-taking tool to transcribe calls and meetings so that we have an accurate record of what was discussed. We do not make audio recordings of calls unless we tell you first. If you would prefer a call not to be transcribed, please tell us and we will take notes by hand instead.
We may change these providers from time to time. An up-to-date list is available on request.
10. International Transfers
Some of our service providers are based in, or process data in, the United States. Where we transfer personal data outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or on appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Providers that act under their own terms are responsible for the safeguards on their own transfers, as their privacy notices describe.
11. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These include access controls, multi-factor authentication, encrypted connections, secure cloud storage and restricted access to confidential files. Connections between our systems use authorised access that we can revoke at any time.
12. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, regulatory, accounting, AML and record-keeping obligations.
In most cases, transaction and client records, including correspondence and call notes and transcripts, are retained for six years following completion of the transaction or closure of the matter, unless a longer period is required by law or justified by the circumstances. Records kept to meet anti-money laundering obligations are kept for at least five years after the business relationship ends. This aligns with our engagement letter and AML policy.
Details of your existing loans that we keep to contact you about them are used for that purpose while the loan is live and you remain our client. When a loan is repaid or refinanced elsewhere, or you ask us not to contact you about it, we stop using it for that purpose. It is then kept only as part of your client record, for the period above.
13. Your Rights
Subject to applicable law, you may have the right to:
request access to your personal data
request correction of inaccurate or incomplete personal data
request erasure of your personal data
request restriction of processing
object to processing based on legitimate interests
request transfer of your personal data to you or another provider
withdraw consent where processing is based on consent
complain to us about how we have handled your personal data (see section 17)
These rights are not absolute and may be limited where we are required to retain or process data for legal, regulatory or legitimate business reasons.
To exercise any of these rights, please contact us using the details below. We will normally respond within one month.
14. Marketing and Renewal Contacts
We may occasionally send marketing or business updates where you have consented, where you have an existing professional relationship with us, or where otherwise permitted by law. You can opt out of marketing communications at any time.
Where we hold details of one of your loans, we may contact you before its fixed rate, early repayment charge period or term ends, to discuss your options. You can ask us to stop at any time by replying to any such message or emailing privacy@hgscapital.co.uk, and every renewal contact will say how. Stopping these contacts does not affect any service you have asked us for.
15. Cookies & Website Data
If you use our website, we may collect limited technical information such as IP address, browser type, device information and website usage data through cookies or analytics tools. Any such use will be limited to website operation, security and performance monitoring.
A separate cookie notice may be provided on the website where required.
16. Contact Us
If you have any questions about this Privacy Notice or how we process personal data, please contact:
17. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so that we have the opportunity to address your concerns. You can raise a complaint by email, by telephone or in writing. We will acknowledge it promptly, look into it without undue delay, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: www.ico.org.uk
Telephone: 0303 123 1113
18. Changes to this Notice
We may update this Privacy Notice from time to time to reflect changes in our business, legal requirements or data processing practices. The latest version will be made available on request and, where appropriate, published on our website.