Privacy & Cookies

We are firmly committed to keeping your personal details private, even if this means that, sometimes, we may not be able to serve you as quickly as you might wish. We make simple, strong statements about privacy so you can be clear about our commitment to you.

Privacy Policy

We treat the privacy of our customers and website users very seriously and we take appropriate security measures to safeguard your privacy. This Privacy Policy explains how we protect and manage any Personal Data that you share with us and that we hold about you, including how we collect, process, protect and share that data.

Who we are

We are Credit Reporting Agency Limited of 20-21 Lemon Street, Truro, TR1 2LS.

Some of our Key Promises
  1. We will never sell your personal details or your email address to anyone for marketing purposes.
  2. We will never disclose your personal details to anyone unless we have your permission to do so, or if we are compelled to do so by Court Order, or if we are required to do so because of an investigation of suspected fraudulent use of your personal data by either the Police or by members of fraud prevention agencies.
  3. We do not store the personal information you provide when you use our Credit Score Estimator service.
  4. You may opt out or opt back in to receive our marketing emails at any time. Every marketing email we send contains a simple one-click ability to opt out.

How We Obtain Your Personal Data

Information Provided by You

You provide us with Personal Data when you register to use our services on our website. This includes your name, current and previous addresses, date of birth, email address, payment/card details and your password. We use this information in order to manage, provide and administer our credit reporting services to you.

We may also keep information contained in any correspondence you may have with us by post, email, or message through the Expert Help section. We may also record telephone calls, but only if we tell you at the start of the call and not otherwise. If we do not record a telephone conversation with you, we may keep brief details of the contents of your call on our files.

Each time you visit our website we obtain information about the device you use to access our services, your location and your IP address.

Information We Get from Other Sources

When you register to use our services, you agree to our Terms and Conditions. In agreeing to our Terms and Conditions, you agree to appoint us (Credit Reporting Agency Limited) as your attorney for the specific purposes of the exercising of your statutory rights to obtain details of all information held about you at any or all UK Credit Reference Agencies and, when requested by you to act on your behalf, to dispute items at any or all UK Credit Reference Agencies.

The UK Credit Reference Agencies are Equifax, Experian and TransUnion.

We supplement the information that you provide with information received from third parties, such as the Royal Mail Postcode Address File, which helps confirm your address and to put it into a format that helps us to retrieve your Credit Report more easily from the Credit Reference Agencies.

To obtain your Credit Report we need to supply the Credit Reference Agencies with your name, current and previous addresses and date of birth. In return, the Credit Reference Agencies provide us with information that they hold about you, which would be routinely provided to a lender if they searched you. That information has been provided to the Credit Reference Agencies from a combination of public sources (such as Electoral Roll information and Court Information about judgments and insolvencies) and private sources (such as your account payment history from lenders or others, which they have in turn obtained with your consent). We pass information to Experian to provide you with your credit report and quotes tailored to your needs should you elect to utilise either the 'Compare Credit Cards' or 'Compare Loans' sections of our website when logged in.

The Credit Reference Agencies are reputable companies that operate in accordance with the General Data Protection Regulation (UK GDPR), but we can take no responsibility for the accuracy or completeness of the information that each provides on your Credit Report, nor for the data processing activities of the Credit Reference Agencies, over which we have no influence or control.

The Personal Data that each Credit Reference Agency holds about you is subject to an independent Privacy Policy published by that Credit Reference Agency.

We also obtain postcode-level information – sometimes called geodemographic data – from Cameo (provided by Eurodirect Marketing, part of the TransUnion group) and from Censation (provided by AFD Software). This data does not contain your Personal Data.

Legitimate Interest

We have a legitimate interest to process your Personal Data as when you sign up to use our services you appoint us as your attorney for the specific purposes of exercising your statutory rights to obtain details held about you from the Credit Reference Agencies, and the processing of this data is necessary to enable us to provide credit reporting services to you and, when requested by you, to act on your behalf to dispute items on your Credit Reports.

How We Use Your Personal Information

Your Personal Data is used to administer and manage your account with us. Your IP address, details of the device you use and your location are used to help identify you, to prevent fraudulent use of our services, to diagnose problems with our servers, and to administer our website.

We do not share your Personal Data with any third party, other than for necessary purposes and for the purposes of fraud prevention. For instance, we need to give your name address and date of birth to the Credit Reference Agencies when we search you. We also need to give your email address to trusted service providers to enable us to email you, or to confirm the deliverability of your email address from time to time. We stress that we will never sell your Personal Data, or your email address to anyone for marketing purposes, at any time, nor allow any third party to use your email address for any other purpose.

The information you give when you use our Credit Score Estimator Service is used to calculate the scores presented to you and is not stored.

To help prevent abuse of our services and fraud, we share information about you and the use of our services (but not your Credit Report data) with trusted service providers and fraud prevention agencies strictly to enable them and us to detect, prevent and otherwise address unlawful or suspected fraudulent internet activity on our own websites and on websites owned and operated by others. We have security measures in place to take reasonable precautions to protect the loss, misuse and alteration of the information under our control. These include the issue and use of passwords, powerful encryption and computer firewalls to guard against hacking. No data transmission over the internet can be entirely secure, so we cannot guarantee the security of your Personal Data when in transit between you and us. From time to time we may have to suspend services whilst we investigate any attempted breach of security. You are obligated, under the Terms and Conditions you agree to abide by when you use our services, to report any suspected breach to us immediately. We also take reasonable security measures to protect your Personal Data in storage.

Your Payment/Card details are used to enable us to manage your subscription with us. We act as controller and data processor in regard to the processing of your subscriptions either by continuous credit card authority, by PayPal or by Direct Debit.

We undertake at all times to protect your Personal Data in accordance with our terms and conditions and in a manner that is consistent with the requirements of the General Data Protection Regulation (UK GDPR) concerning data protection.

Do We Use Your Personal Data for Marketing Purposes?

Any information that you choose to give us will not be used for marketing purposes by any third party. Only if you consent to us doing so when you register to use our services, at our discretion we may send you occasional email messages to alert you to known or potential changes to your Credit Report that we think you may wish to become aware of, whether you are a current subscriber to our services or not. If you wish to opt out of receiving such messages from us you, you can do so at any time by clicking on the appropriate link at the foot of each email.

Authentication – Endeavouring to Ensure that We Only Provide Your Personal Data to You

If you use our instant, online authentication system, amongst other things we will ask you questions based on your Credit Report. The responses you give are stored and used for the processing of the authentication, for monitoring purposes and for fraud prevention.

We may also use the authentication services provided by a Credit Reference Agency to complement our own authentication processes. In such cases,

  • a search will be carried out with a Credit Reference Agency for the specific purposes of verifying your identity,
  • the Credit Reference Agency may check the details that it supplies against any particulars on any database (public or otherwise) to which the Credit Reference Agency has access in order to verify your identity,
  • the Credit Reference Agency will retain a record of the search, and
  • we will advise you which Credit Reference Agency we have used for this purpose.

From time to time we may need to take further steps to confirm your identity. The reason is always to try to ensure that we are releasing your Credit Report only to you. The information we require will vary depending on the depth of our investigation. For example, we may ask you to provide any or all of original bank statements, credit card statements and utility bills, addressed to you at your current and previous addresses, and on occasion, government issued identification such as a copy of your passport details or driving licence. We do not extract any information from the documents you provide, all your data is kept confidential whilst being processed and are returned to you after being used to verify your addresses.

Postcode Based and Other Aggregated Information

Demographic and profile data are also collected at our website. This information is not held on an individual basis. We use this data to tailor your experience at our site, showing content that we think you might be interested in, and displaying the content according to your preferences. We may also use your Personal Data for credit scoring and other statistical analysis, but only on an aggregated basis with the personal data of many other customers, and in such a way that your Personal Data can never be identified from the outcome of our analysis.

We do not pass your personal information to any third party except when under compulsion of law or with your consent to do so.

Links to Other Websites

Our website contains links to other websites. Credit Reporting Agency Limited is not responsible for the privacy practices or the content of such websites.

Sharing Information

We will keep information about you confidential. We will only disclose your information with other third parties as explained in this Privacy Policy, or with your authority or your express consent, with the exception of the following:

Categories of Third Parties
  • Regulatory authorities to comply with any legal and regulatory issues and disclosures;
  • Fraud prevention agencies for the purposes of investigating suspected fraud and fraud prevention;
  • Email or mail service providers who provide a fulfilment service for us, on the understanding that they will keep information confidential;
  • Anyone to whom we may transfer our rights and duties under any agreement we may have with you; and
  • Legal or crime prevention agencies and/or to satisfy any regulatory request if we are under a legal duty to do so
  • If you have been referred to our service via an affiliate link your data will be used for transactional purposes to facilitate the partner relationship
Transfer of your personal Data outside of the European Economic Area (EEA)

We do not currently transfer your Personal Data outside the EEA, other than for fraud prevention checks where the receiver has agreed to provide the same or similar protection as we do, and that they will only use your Personal Data in accordance with our instructions. If in the future we transfer your Personal Data outside of the EEA for reasons other than fraud prevention checks, then, in accordance with the terms of this Privacy Policy, we will make sure that the receiver agrees to provide the same or similar protection as we do and that they only use your Personal Data in accordance with our instructions.

How long do you keep information about me?

We keep information in line with our data retention policy. The retention periods are in line with the length of time we need to keep your Personal Data in order to manage and administer our services to you. The retention periods vary to take into account our need to meet any legal, statutory and regulatory obligations and can vary for individual customers and for different reasons. In general, we do not keep information for longer than we deem necessary. Your Credit Report is constantly changing so we consider it to be out of date when one month old, at which time, in the absence of any dispute or legal challenge, we will erase it. In the absence of any compelling reason not to do so, your Personal Data will be removed from our databases within six years after the date of closure of your account with us. In all cases our need to use your Personal Data is reassessed on a regular basis and information that is no longer required is disposed of.

What happens if Credit Reporting Agency Limited changes hands?

We may, from time to time, expand or reduce our business activities and this may involve the sale and/or the transfer of control of all or part of our business. Any Personal Data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use that data only for the same purposes for which it was originally collected by us.

In the event that any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes. When contacted you will not, however, be given the choice to have your data deleted or withheld from the new owner or controller.

Data Subject Rights

Subject Access Requests

The General Data Protection Regulation (UK GDPR) grants you the right to access particular Personal Data that we hold about you. This is referred to as a Subject Access Request. We shall respond promptly to any Subject Access Request received, and always within one month from the point of receiving the request and all necessary information from you. Our formal response shall include details of the Personal Data that we hold about you, including the following:

  • Sources from which we acquired the information;
  • The purposes for processing the information, and
  • Persons or entities with whom we are sharing the information.

Please note that unless you are a registered customer of ours, we are unlikely to hold any Personal Data for you. If you wish to exercise your Subject Access Rights, please log in to our website and send us a message through the Expert Help section and tell us you wish to exercise your access rights under the General Data Protection Regulation (UK GDPR). If you have lost your log in details, please click on Log In and follow the on-screen instructions for re-issue.

If you cannot log in for any reason, you may still exercise your Subject Access Rights by writing to us at the address shown below, advising us of your full name and any previous names you may have used, your full current address, also of any previous addresses you have lived in the last six years, and your date of birth.

In any case, to enable us to reveal your data only to you, we will request that you complete an online verification process.

Right to rectification

You have the right to obtain from us, without undue delay, the rectification of inaccurate data we hold concerning you. Taking into account the purposes of the processing, you have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

If the inaccurate data is contained on your Credit Report, invoking your right to rectification is not an appropriate way of achieving this. This is because any request to rectify Credit Report data we hold:

  • will not amend the data at source (i.e. at the Credit Reference Agencies or at the companies or at those that in turn supply them)
  • would be inappropriate as the Credit Report data we hold is an accurate snapshot of the data held at the various Credit Reference Agencies as at the date of the search

We set up our services to help consumers to identify and correct errors on their Credit Report. Please log in and send us a message through the Expert Help section and we will advise you of the quickest and most efficient way of putting errors right using your statutory rights under other laws.

Right to erasure

You have the right to obtain from us the erasure of Personal Data concerning you without delay. To invoke your right please log in and send us a message through the Expert Help section and ask us to erase your Personal Data. You should note that erasure of data held by us will not remove your Credit Report data at the Credit Reference Agencies. It is likely that if you invoke your right to erasure directly to a Credit Reference Agency, you are likely to be advised that your right to erasure does not generally apply to Credit Report data, as there may continue to be an overriding legitimate ground for this data to be maintained by the agency, which may be claimed by the agency to be in the public interest.

If you have made a recent payment to us, we will routinely erase your data on your request but not earlier than 120 days after the date of your last payment. This is because your data may be required by us for the defence of any potential claim relating to that payment.

If you have any history of a dispute with us on any matter, including any payment dispute, we will routinely refuse to erase your data on the basis that it is required by us for the establishment, exercise or defence of legal claims.

Right to restriction of processing

Subject to certain exemptions, you have the right to obtain from us restriction of processing where one of the following applies:

  • The accuracy of the Personal Data is contested by you and is restricted until the accuracy of the data has been verified;
  • The processing is unlawful and you oppose the erasure of the Personal Data and instead request the restriction in its use;
  • We no longer need the Personal Data for the purposes of processing, but it is required by you for the establishment, exercise or defence of legal claims;
  • You have objected to processing of your Personal Data pending the verification of whether there are legitimate grounds for us to override these objections.
Notification obligation regarding rectification or erasure of Personal Data or restriction on processing

We shall communicate any rectification or erasure of Personal Data or restriction of processing as described above to each recipient to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort. We shall provide you with information about those recipients if you request it.

Right to data portability

You have the right to receive your Personal Data which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from us.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of Personal Data concerning you, including any personal profiling; unless this relates to processing that is necessary for the performance of a task carried out in the public interest or an exercise of official authority vested in us. We shall on longer process the Personal Data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you, or the establishment, exercise or defence of legal claims.

Right to not be subject to decisions based solely on automated processing

Other than our online authentication process, which is an essential part of our fraud prevention procedures, we do not carry out any automated processing which may lead to an automated decision based on your Personal Data.

Invoking your rights

If you would like to invoke any of the above Data Subject Rights with us, please contact our Data Protection Officer at the address given below.

Accuracy of information

In order to provide the highest level of customer service possible, we need to keep accurate Personal Data about you. We take reasonable steps to ensure the accuracy of any Personal Data or sensitive information we obtain. We ensure that the source of any Personal Data or sensitive information is clear and we carefully consider any challenges to the accuracy of the information. We also consider when it is necessary to update the information such as name or address changes, and you can help us by informing us of these changes when they occur.

Policy changes

This Privacy Policy is regularly reviewed. This is to make sure that we continue to meet the highest standards and to protect your privacy. We reserve the right, at all times, to update, modify or amend this Policy. We suggest that you review this Privacy Policy from time to time to ensure you are aware of any changes we may have made. We will not significantly change how we use information that you have already given to us without either your prior agreement or as otherwise permitted under the General Data Protection Regulation (UK GDPR).

If you have a complaint

Our general Complaints Policy can be found at the foot of our Terms and Conditions but if you have a complaint which specifically relates to the use of your Personal Data or sensitive information then please write to the Data Protection Officer, using the contact details found at the end of this Privacy Policy.

If your complaint is not resolved to your satisfaction and if you wish to make a formal complaint to the Information Commissioner’s Office (ICO), you can contact them on 01625 545745 or 0303 123 1113. You also have the right to judicial remedy against a legally binding decision of the ICO where you consider that your rights under the General Data Protection Regulation (UK GDPR) have been infringed as a result of the processing of your personal data. You have the right to appoint a third party to lodge the complaint on your behalf and to exercise your right to seek compensation.

Opting out of marketing communications

You have the following options if you do not wish to receive future marketing communications from us. Please note that we may still be required to notify you from time to time of any significant changes to our terms and conditions, even after you express a preference not to receive marketing communications.

  • You can log in to your account and send a message to a professionally trained Credit Analyst through the Expert Help section.
  • You can email
  • You can opt-out using the unsubscribe link which is contained at the foot of each email


This site gives you the following options for changing and modifying information previously provided.

  • You can log in to your account and send a message to a professionally trained Credit Analyst through the Expert Help section.
  • You can send an email to

Information About Cookies

A cookie is a small text file stored on your browser, for example Internet Explorer or Chrome.

We use a minimal number of cookies to support your use of our website. More information is available below - you can change your settings anytime by clicking the link below:

Customise Cookie Preferences

Important information

Questions and queries

If you have any questions or queries which are not answered by this Privacy Policy, or have any potential concerns about how we may use the Personal Data we hold, please write to:

Data Protection Officer
Credit Reporting Agency Limited
20-21 Lemon Street

Or email

Last updated: 15 December 2023