Who we are
The Loan Hub is the trading name of The Loan Hub Limited, a company registered in Jersey, with its registered office at Regus, First Floor, Liberation Station, Esplanade, St Helier, Jersey, JE2 3AS. We are a loan broker: we help you find finance from our panel of lenders.
We are the “controller” of the personal data described in this policy, which means we decide how and why it is used. We are registered with the Jersey Office of the Information Commissioner (JOIC) under registration number 71171.
For anything about your personal data, contact us at info@theloanhub.co.uk, on +44 1534 744727, or by post to the address above.
This policy explains how we handle personal data under the Data Protection (Jersey) Law 2018. It covers this website and the enquiries and applications you make with us, whether online, by email or by phone.
Information we collect
Information you give us. What we ask for depends on what you need:
- Quote and vehicle sourcing enquiries: your name, email, phone number, the amount or vehicle and budget you have in mind, the purpose of the loan, your jurisdiction and how you heard about us.
- Online loan application: your name and any former names, title, gender, date and place of birth, nationality, marital status, dependants, time on the island, residential status and property value, contact details, current and previous addresses, employment history, bank details, and the loan you want.
- Documents you upload: bank statements, proof of address and photo ID (passport or driving licence). These may show your income, spending and other financial details.
- Emails, calls and meetings: whatever you choose to tell us.
Information from others. When we process a loan application we may receive information from lenders, credit reference agencies and fraud prevention agencies, such as the outcome of credit and identity checks. If a business such as a car dealer refers you to us at your request, it will pass on your contact details and what you're looking for.
Information collected automatically. When you visit the website, our hosting provider logs technical details such as your IP address, browser type and the pages requested. Our forms use Cloudflare Turnstile, which checks browser and device signals to tell people from spam bots. Analytics and advertising cookies are only used if you agree to them (see Cookies).
We don't ask for special category data (such as health information). If you choose to tell us about it, for example to explain the purpose of a loan, we only use it for that purpose.
How we use it and our legal basis
Jersey law requires a legal basis for each use of personal data. These are ours:
| What we do | Information used | Legal basis |
|---|---|---|
| Answering a quote request, vehicle sourcing enquiry, email or call | Name, contact details, the loan or vehicle you're interested in, budget, how you heard about us | Taking steps at your request before entering into a contract (Schedule 2, Part 1, paragraph 2) |
| Arranging a loan: assessing your application, passing it to lenders and supporting you through it | Everything in the online application and the documents you upload | Taking steps at your request before entering into a contract (Schedule 2, Part 1, paragraph 2) |
| Recording enquiries and applications in our CRM so we can follow up and know what we've discussed | Contact details and enquiry or application details | Contract steps, as above, and our legitimate interest in running the business efficiently |
| Checking identity and preventing fraud, including credit reference and fraud prevention searches | Identity, address and financial details | Legitimate interests (ours, lenders' and the public's interest in preventing fraud and irresponsible lending) |
| Keeping records and disclosing information where the law requires it | Whatever the law requires | Legal obligation (Schedule 2, Part 2, paragraph 7) |
| Keeping the website secure and free of spam (server logs, Cloudflare Turnstile) | IP address, browser and device details, pages requested | Legitimate interests (see below) |
| Analytics and advert measurement cookies | Online identifiers, IP address, pages visited, how pages are used | Consent (Schedule 2, Part 1, paragraph 1), which you can withdraw at any time |
| Marketing emails | Name and email address | Consent, only if you have separately opted in |
Our legitimate interests, explained. We keep server logs and use Cloudflare Turnstile because a website that takes financial information has to be protected from attack and spam, and this needs only technical details, not your identity. We check identity and run fraud checks because lenders and we must not arrange credit in someone else's name or for someone who cannot afford it, which protects you as much as us. We record enquiries in our CRM so we can answer you properly and don't lose track of your request. We have weighed these interests against your rights and consider the impact on you to be low and expected. You can object at any time (see Your rights).
Marketing. We will only send you marketing emails if you have separately agreed to receive them. Submitting an enquiry or application does not sign you up. You can unsubscribe at any time.
Do you have to give us your information?
No, but we need the details marked as required on our forms to answer your enquiry, and lenders need the information and documents in an application to consider it. Without them we may not be able to help you or arrange a loan.
Transfers outside Jersey
Some of our service providers hold data outside Jersey. Under Article 66 of the Data Protection (Jersey) Law 2018, we only transfer personal data to a country with an adequate level of protection:
- The UK and the European Economic Area are recognised as adequate.
- The USA: Google, Cloudflare, Resend and HubSpot are certified under the EU-US Data Privacy Framework, which the European Commission has found adequate. For other US providers we rely on that framework where the provider is certified, or on standard contractual clauses (Article 67).
Contact us if you would like more detail about the safeguards for a particular provider.
How long we keep it
We keep personal data only for as long as we need it:
- Enquiries that don't go ahead: while there is a realistic chance of the conversation resuming. We review these at least once a year and delete those that are no longer needed.
- Applications and customer records: for as long as we are helping you, then for as long as legal, tax and regulatory record-keeping rules require.
- Uploaded documents: until your application is concluded, unless the law requires us to keep them longer.
- Server and email delivery logs: for the standard period our hosting and email providers keep them.
- Analytics data: for the period set in our Google Analytics account, no more than 14 months.
You can ask us to delete your data sooner at any time, and we will unless the law requires us to keep it.
Automated decisions
We don't make decisions about you based solely on automated processing. Lenders may use automated credit scoring when they assess an application; the lender's own privacy notice explains how, and you can ask the lender for a person to review a decision.
Your rights
Under the Data Protection (Jersey) Law 2018 you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data or complete incomplete data.
- Erasure: ask us to delete your data where we no longer need it or have no lawful basis to keep it.
- Restriction: ask us to limit how we use your data, for example while a correction is checked.
- Portability: ask for data you gave us in a machine-readable format, or for us to send it to another organisation.
- Objection: object to processing based on legitimate interests. We must then stop unless we have compelling grounds.
- Direct marketing: object to direct marketing at any time. This right is absolute: we will stop.
- Automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you.
- Withdraw consent: where we rely on consent, withdraw it at any time, as easily as you gave it.
To use any of these rights, email info@theloanhub.co.uk or call us. It's free. We will respond within four weeks. If a request is complex we may extend this by up to a further eight weeks, and we'll tell you why within the first four weeks. We may need to confirm your identity before releasing data.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to Jersey's data protection regulator:
Jersey Office of the Information Commissioner (JOIC)2nd Floor, 5 Castle Street, St Helier, Jersey JE2 3BT
+44 (0)1534 716530 · enquiries@jerseyoic.org · jerseyoic.org
You may also have the right to seek a remedy through the courts.
Keeping your data safe
Our website uses an encrypted (HTTPS) connection, access to your data is limited to staff who need it, and we use established providers bound by data processing contracts. No system is completely secure, so if a breach puts your data at high risk we will tell you and the regulator as the law requires.
Children
Our services are for adults aged 18 and over. We don't knowingly collect data from children. If you think a child has given us their details, please contact us and we will delete them.
Changes to this policy
We may update this policy when our services or the law change. The date below shows when it was last updated. If a change significantly affects how we use data we already hold, we will tell you. This policy was last updated on 21 October 2026.