Privacy Policy

Lumora Capital Solutions Limited (‘we’, ‘our’, ‘us’) respects your privacy and is committed to protecting your personal data. This notice explains how we collect, use, and share your personal data in connection with your investment or other dealings with us.

Company Name:

Lumora Capital Solutions Limited

Registered Address:

80 Roding Road, IG10 3EF

Company Number:

16651308

Data Protection Officer (DPO):

Jennifer Cruickshank

Contact Email:

[email protected]

We may collect the following types of personal data:

• Identification data (e.g. name, date of birth, passport details, tax identification number)
• Contact details (e.g. address, email, phone number)
• Financial information (e.g. credit history, banking details, source of funds, tax residency)
• Compliance data (e.g., anti-money laundering checks, sanctions checks, KYC documentation)
• Communications (e.g., emails, meeting notes)
• Monitoring data (e.g., covenant reporting, call recordings, site visit notes)
• Litigation / enforcement (e.g., data arising from default and recovery actions)

We generally collect data directly from you, your company, professional advisers, or through third-party compliance and credit information providers including credit reference agencies and introducers and/or brokers.

We process your personal data for the following purposes:

• Assessing loan applications, creditworthiness and security
• Managing loan agreements, repayments and related obligations
• Complying with legal and regulatory obligations, including tax, AML, and sanctions laws
• Communicating with borrowers, guarantors and representatives
• Sharing information and responding to requests from regulators or investors, funders, partners, or service providers
• Communicating with you about company matters and updates
• Ongoing monitoring of loan performance and reporting to funders or investors where relevant

We may use certain personal data, in anonymised or aggregated form where possible, to support the development, testing, and improvement of our systems, including machine learning models and generative AI tools. This helps us to enhance risk management, compliance, and operational efficiency. Where personal data is used, we ensure that appropriate safeguards are in place to protect your rights and freedoms. You have the right to object to this type of processing at any time.

The Company processes the Investor’s personal data only where there is a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The purposes and corresponding lawful bases include:

Performance of a contract- to take steps prior to entering into and to perform the Company’s obligations under loan and other ancillary agreements.

Compliance with a legal obligation- to meet the Company’s obligations under applicable laws and regulations, including tax, anti-money laundering, and anti-financial crime.

Legitimate interests– to protect the Company’s business interests, manage credit risk, enforce loan obligations, and maintain accurate records, provided these interests are not overridden by your rights.

Consent (where required)– where none of the above bases apply, the Company will seek your explicit consent before collecting, using, or sharing personal data.

By providing personal data to the Company, you acknowledge that their data will be processed for the purposes described above.

We may share your personal data with:

• Professional advisers (lawyers, accountants, auditors)
• Banks, lenders and syndication partners
• Credit reference agencies who may in turn hold and share this information with other lenders
• Regulatory and tax authorities such as the FCA and HMRC
• Service providers including banks, servicers, cloud storage providers, or KYC platforms
• Potential future investors or acquirers or funders during due diligence
• Our affiliates and subsidiaries
• Our recovery and enforcement partners (if a loan defaults)

We do not sell your personal data to third parties.

Where data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or Standard Contractual Clauses.

In particular, data may be transferred to countries including (but not limited to) the European Economic Area (EEA), the United States, the Philippines and Singapore.

We retain your personal data only as long as necessary to fulfil the purposes described in this notice and comply with legal obligations. Typically, this means:

• 7 years from the date provided to us; or
• for the duration of a loan agreement plus 7 years after termination or repayment of the loan.

Under UK GDPR you may:

• Access and obtain copies of your data
• Request correction or deletion
• Object to or restrict processing
• Request data portability
• Lodge a complaint with the UK Information Commissioner’s Office (ICO)

Note on automated processing: we use automated tools (including credit scoring, AML and sanctions screening) to assist our assessments. However, final lending decisions are always made by our credit team and are not based solely on automated processing. You have the right to request a review of any decision if you believe the use of automated tools has unfairly affected the outcome.

You may exercise your rights under the UK GDPR, Data Protection Act 2018 by contacting our Data Protection Officer (DPO) at [email protected].

We may ask you to verify your identity before responding to your request.

We will acknowledge your request promptly and aim to respond within one month for UK GDPR requests (or up to three months for complex requests).

If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk

We implement reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, loss, or destruction.

We may update this notice from time to time to reflect changes in law or our practices. Significant changes will be communicated by email or other appropriate means.

We collect and use personal data to assess, underwrite and manage loans, comply with legal obligations, and protect our business interests. Data will be processed in accordance with the UK GDPR, the Data Protection Act 2018, and other applicable laws.