Privacy Policy 

To use our services, You must be over 18 years of age and a UK resident
 

This Privacy Policy informs You of the nature of the personal data about You that is processed by us and how You can request that We delete it, update it, transfer it and/or provide You with access to it.

This Privacy Policy is intended to assist You in making informed decisions when using the Site and our Services. Please take a moment to read and understand it. It should be read in conjunction with our Terms of Use and Cookie Policy.

This policy, Your credit agreement and any additional terms of use incorporated by reference into this policy, together (our Terms) apply to Your use of the Drafty mobile application software (App) available for Android and IOS once You have downloaded the App onto Your mobile telephone or handheld device (Device).

This policy, and any additional terms of use referenced within this policy, applies to Your use of any of the services accessible through www.drafty.co.uk  (Our Site), unless it is stated that a separate privacy policy or use of information statement applies.

For the purposes of this policy “You” or “Your” means You as a user of the App Site or as a participant in the Services and/or a user of the Services Sites (as defined below). Individuals who have undergone email verification are specifically identified as “Customers”.

“We”, “Our” or “Us” means GAIN Credit LLC (trading as Drafty) having registered office at 251 Little Falls Drive, Wilmington, DE 19808, USA, and its affiliates.

‘Personal Data’, ‘Data Processor’ and ‘Data Controller’ are defined as per the Data Protection Act 2018.

For the purpose of the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA), the Data Controller is GAIN Credit LLC.

GAIN Credit LLC is a registered Data Controller and details of our notification to the regulator for data protection, may be found in the Information Commissioner’s Office Public Register of Data Controllers at ​​​​ www.ico.org.uk under registration number Z2752028.

This policy, and any additional terms of use referenced within this policy, applies to Your use of any of the services accessible through www.drafty.co.uk  (Our Site), unless it is stated that a separate privacy policy or use of information statement applies.

We may collect and process the following data about You:

You may give us information about You by filling in forms on Our Site or App. This includes information provided when You register to subscribe to any of our Services or report an issue with Our Site or App.

Details provided may include:

• Name 
• Date of Birth 
• E-mail Address 
• Number of Children 
• Marital Status 

• Housing Type 
• Monthly Income information

If You choose to proceed with a loan or line of credit application, We will require additional information, including: 

• Your name 
• Your contact details 
• Transaction details encompassing loan balances 
• Employer name 
• Take-home pay 
• Other financial particulars, and banking information, such as Your bank’s sort code and account number.

Each time You visit one of Our Sites or use one of our Apps and/or Services We may automatically collect the following information:

Device – Technical Information

• the type of mobile device You use
• a unique device identifier (for example, Your Device’s IMEI number
• the MAC address of the Device’s wireless network interface or the mobile phone number used by the Device)
• mobile network information
• Your mobile operating system
• the type of mobile browser You use
• time zone setting

Computer – Technical Information

• information about Your computer, including Your IP address, operating system and browser type (this is statistical data about browsing actions and patterns and is not in individually identifiable form)
• automatic information obtained by using “cookies” when Your browser accesses our Website and when You log-in (see the “Cookies” section below for more information);
• details of Your use of any of our Apps or Your visits to any of Our Sites including, but not limited to:
  • traffic data
  • location data
  • Weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that You access

Microsoft Clarity

• We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our Website through behavioural metrics, heatmaps, and session replay to improve and market our products/services.
• Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity.
• Additionally, We use this information for site optimization, fraud/security purposes, and advertising.
• For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

We may use Your Personal Data for a number of purposes, which include:

• to assess Your creditworthiness for our loan and credit products and services
• to be communicate with Your regarding Your agreement with Us, including notifying You about repayments.
• to provide You with the Services or products You request
• to identify which of our products, or our partners’ products, might interest You
• to enhance Your experience of using our App and/or Our Sites or our Services;
• for conducting statistical analysis;
• to identify You when You contact us or visit our App Site or Our Sites;
• to prevent and detect fraud –  this may involve the use of voice detection technology to analyse recordings of Your telephone calls with us
• for editorial or feedback purposes for our advertisers;
• for feedback purposes for our products/services
• aggregated information about users for editorial or feedback purposes for our advertisers.

Special category data is sensitive information about you. This can include:

• Your race or ethnic background
• Your political views
• Your religious or philosophical beliefs
• Whether you belong to a trade union
• Health information
• Information about your sex life or sexual orientation

We may need to collect this sensitive information to:

• Follow the law: We may collect sensitive data to comply with legal obligations, such as anti-discrimination laws, or financial regulations that require us to assess risks related to health or disability.
• Provide you with the best services and tailored support: We may use sensitive data to better understand your needs, allowing us to offer personalised financial products or services that suit your unique situation.

We take your privacy seriously and protect your sensitive information by:

• Using strong security measures
• Allowing only authorised staff to access it
• Regularly reviewing our data protection policies and processes.

Your Right to Withdraw Consent

You can change your mind and withdraw your consent for us to use your sensitive information at any time. This won’t affect any use of your data that happened before you withdrew consent.

How to Withdraw Consent

If you want to withdraw consent, you can do this by telling us. You can contact us using our Contact Us Form

We will confirm that we received your request and that your consent has been withdrawn.

Impact of Withdrawing Consent

If you withdraw your consent, it might affect some services or support we provide to you. We will let you know if this happens and try to find other ways to help you.

We use secure payment processing to ensure the safety of your transactions. Your payment data may be processed in one of the following ways:

1. Direct Payment Processing (PCI-DSS Compliant Processing)

When you make a payment directly through our systems, we process your payment card details in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). PCI-DSS is a global standard that ensures secure handling of payment card information. We use industry-standard encryption and security measures to protect your payment data.

2. Third-Party Payment Processing

In some cases, we use a trusted third-party Payment Service Provider (PSP) to process transactions on our behalf. When your payment is made through a PSP, we do not store or process your payment details directly. Instead, your payment information is securely transmitted to the PSP, who processes the payment in accordance with its own privacy policies and security standards.

• Our products and services may sometimes be provided in conjunction with our business partners.
• This means We may need to share Your information to those partners to provide You with the products or services You request.
• We will only disclose Your information to such third parties where We have Your explicit consent to do so via an ‘opt in’ mechanism on our Website or other similar channels.
• We may also share the Personal Data You submit with our associated group companies (which includes any company linked to us in some way by common ownership or management) for the purposes of:
  • the provision of products and service You request; and
  • consumer profiling and market research
  • to contact You electronically about related products and services, offers and events, through the consent expressed via an ‘opt in’ mechanism

If You consent via the opt in process, We may also share Your Personal Data with selected third parties for the following reasons:

• In relation to offers they feel might interest You 
• Products that may suit Your needs 
• To seek Your feedback, suggestions or opinions on current products 
• For editorial, survey, research and product development purposes.

• If You submit or create a blog on our App Site or Our Sites, You should be aware that any Personal Data You submit can be read, collected, or used by other users of these blogs, and could be used to send You unsolicited messages.
• We are not responsible for the Personal Data You choose to submit in these forums.

• We post customer testimonials, which may contain Personal Data, on the App Site, banners and/or Our Sites as Well as some other Websites with GAIN Credit LLC or its related brands’ presence.

We have trusted relationships with carefully selected third parties who perform services on Our behalf. All service providers are bound by contract to maintain the security of Your personal data.

Where third party service providers are used, they act as agents to perform tasks on behalf of and under the instructions of GAIN Credit LLC.

These service providers must agree to use Personal Data only for the purposes for which they have been engaged by us and must either:

• Process it in a territory which the UK has determined provides an adequate level of protection for Personal Data; or
• Implement appropriate safeguards to protect Your Personal Data, including transferring it in accordance with an applicable transfer mechanism such as International Data-Transfer Agreement.

We may share Your Personal Data with the following:

• Alternative Lenders
• Credit Reference Agencies
• Customer Service Providers
• Collections Agencies
• Debt Purchasers
• Payment Service Providers
• Purchasers – in the event our business or substantially all of its assets are acquired by a third party (in which case Personal Data held about customers will be one of the transferred assets.
• In order to enforce any of our terms and conditions

• Fraud Prevention or Law Enforcement Agencies – in the event false or inaccurate information is provided and fraud is identified. We and other organisations may also access and use this information to prevent fraud and money laundering.
• if We required or compelled to do so by any legal authority, as required by law or when We believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or legal process served on us

The following list contains the names of third parties with whom We may share such information with:

• T Dot UK Ltd 
• Choose Wisely Limited 
• Nouveau Finance Limited 
• Loan Machine Limited trading as Lead Affinity
• Equiniti Limited
• COEO trading as CRS (Credit Resource Solutions)
• ARC Capital
• WorldPay
• PaySafe
• Nomu Pay Limited trading as Total Processing

Please note that for full details on how We may use Your information to determine and/or provide provision of loan facilities You should read the Use of Information Statement contained in Your pre-contractual documentation.

We work closely with selected third parties. From time to time, We may receive information about You from them. These third parties include:

• Credit reference agencies
• Fraud prevention agencies
• Business partners
• Sub-contractors in technical, payment and delivery services
• Advertising networks
• Analytics providers
• Search information providers

We also receive unique application numbers. When You install or uninstall a Service containing a unique application number or when such a Service searches for automatic updates, that number and information about Your installation, for example, the type of operating system, may be sent to us.

In order to process Your application, We will perform credit and identity checks on You with one or more credit reference agencies (“CRAs”). Where You take a loan or credit product with us, We may also make periodic searches at CRAs to manage Your account with us.

To do this, We will supply Your personal information to CRAs and they will give us information about You. This will include information from Your credit application and about Your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• assess Your creditworthiness and whether You can afford to take the product;
• verify the accuracy of the data You have provided to us;
• prevent criminal activity, fraud and money laundering;
• manage Your account(s);
• trace and recover debts; and
• ensure any offers provided to You are appropriate to Your circumstances.

We will continue to exchange information about You with CRAs while You have a relationship with us. We will also inform the CRAs about Your settled accounts. If You borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on Your credit file that may be seen by other lenders.

If You tell us that You have a spouse or financial associate, We will link Your records together, so You should make sure You discuss this with them, and share with them this information, before lodging the application.

CRAs will also link Your records together and these links will remain on Your and their files until such time as You or Your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the UK credit reference agencies, their role also as fraud prevention agencies, the data they hold, how they use and share Personal Data, data retention periods and Your data protection rights with the Credit reference agencies are explained in more detail within the Credit Reference Agency Information Notice (CRAIN) at https://www.transunion.co.uk/crain

The Credit Reference Agencies that We use are:

TransUnion

• Website: TransUnion UK | An Information & Insights Company
• E-mail: UKConsumer@transunion.com
• Telephone: 0330 024 7574
• Post: TransUnion Consumer Services Team, PO Box 647, Unit 4, Hull HU9 9QZ

Experian

• Website: Experian | Credit Scores, Reports & Credit Comparison
• Telephone: 0800 013 8888
• Post:  Customer Support Centre, Experian Ltd, PO BOX 9000, Nottingham, NG80 7WF

We share Personal Data with fraud prevention agencies about both active and prospective borrowers.

The Personal Data We have collected from You will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify Your identity. If fraud is detected, You could be refused certain services, finance, or employment.

Further details of how Your information will be used by us and these fraud prevention agencies, and Your data protection rights, can be found by viewing the Cifas National Fraud Database fair processing notice (https://www.cifas.org.uk/fpn).

If You provide us with false or inaccurate Personal Data and We suspect any unlawful activity such as fraud or money laundering, this will be recorded, and We may pass details to fraud prevention agencies.

We and other organisations may also access and use this Personal Data to prevent any unlawful activity, such as fraud and money laundering, including when:

• checking and verifying Your identity;
• checking and verifying details on applications for credit, credit related or other financial products and facilities;
• managing credit, credit-related or other financial products and facilities; Recovering debt; and
• checking details on proposals and claim for all types of insurance.

• We use cookies to differentiate You from other users of the app, our sites, and app site.
• This helps us to offer You a good experience when using the app or browsing the app site.
• It also helps us to enhance Our App, Our Sites and the App site.
• For further details about the cookies We use, please refer to our Cookie Policy.

• By visiting Our Site through the express consent via an ‘opt in’ mechanism available, You understand and agree that We may contact You via the e-mail address You enter on Your application to assist You with Your request or to discuss other products and services that GAIN Credit LLC may provide for You. 
• You may opt-out of receiving these marketing communications from us or from our associated companies by using the unsubscribe options provided in the email communications received by You. 
• If You opt-out of our use of Your Personal Data for marketing purposes, We will make reasonable efforts to honour such choice within 10 business days.  
• We reserve the right to take reasonable steps to authenticate Your identity with respect to any such request or other enquiry. 
• If You provide consent for us to share Your information with selected third parties, You may receive follow-up contact and offers from third party companies. 
• While We only work with selected partners, We are not responsible for the services or representations of these third parties.  
• If You do not want to receive further marking communications from these third parties, please contact them directly.

Sometimes We use Your Personal Data in automated processes to make decisions about You.  We do this to help ensure decisions are made accurately, fairly and efficiently.

We use automated decision making using Your Personal Data to create a profile of You for credit scoring – a method which predicts Your creditworthiness based on Your financial profile.

To carry out credit scoring We use information You give to us, information We obtain from credit reference agencies, and details about how You have used other products and services You have with us.

In some cases, We will also use external data sources for credit scoring (refer to the Credit Reference Agencies section above).

We analyse this information to identify a credit score based on how likely it is that debts will be re-paid. We use credit scoring to make the following decisions about You:

• whether We enter into a contract to provide a product or service to You
• whether to adjust products or services You have (such as an increasing or decreasing credit limits)
• whether We should pre-approve any suitable products or services for You
• where We need to recover a debt from You.

To carry out marketing profiling, We use:

• Information You give us 
• Details about how You  have used our services 
• Any feedback You have given us 
• Information We have obtained from Credit Reference Agencies 
• Information We have obtained from Social Networking Platforms 
• Information We have obtained from third parties We are partnered with 

We use processes to analyse this information to decide: 

• What services to offer to You  
• How to prioritise the marketing messages You receive 
• Assess how likely messages will be useful for You;  
• How likely You are to respond to the messages We send.

We store Your personal data in accordance with current laws, for a minimum of 5.5 years from either:

• The date Your account was closed
• The date You last used our services.  

We may hold information relating to loan accounts falling under the non-personal information category for longer where necessary for:

• active or potential legal proceedings
• to resolve or defend claims
• making remediation payments.

You have the following rights in relation to the personal data We hold about You. If You would like to exercise any of these rights, please contact us using the details set out in How to Contact Us.

• If You ask us, We will confirm whether We are processing Your personal data and, if so, provide You with a copy of that personal data (along with certain other details). 
• Please note that if We receive a request, We will take reasonable steps to verify Your identity before We take any action. 
• This is to safeguard Your information from fraud.

• If the personal data We hold about You is inaccurate or incomplete, You are entitled to have it rectified. 
• If We have shared Your personal data with others, We’ll let them know about the rectification where possible. 
• If You ask us, where possible and lawful to do so, We will also tell You who We’ve shared Your personal data with so that You can contact them directly.

• You can ask us to delete or remove Your personal data in some circumstances, such as where We no longer need it or where You withdraw Your consent (where applicable).
• If We have shared Your personal data with others, We will let them know about the erasure where possible.
• If You ask us, where it is possible and lawful for us to do so, We will also tell You who We have shared Your personal data with so that You can contact them directly.

• You can ask us to ‘block’ or suppress the processing of Your personal data in certain circumstances such as where You contest the accuracy of that personal data or You object to us processing it for a particular purpose.
• This may not mean that We will stop storing Your personal data but, where We do keep it, We will tell You if We remove any restriction that We have placed on Your personal data to stop us processing it further.
• If We’ve shared Your personal data with others, We’ll let them know about the restriction where it is possible for us to do so. 
• If You ask us, where it is possible and lawful for us to do so, We’ll also tell You who We’ve shared Your personal data with so that You can contact them directly.

• You have the right, in certain circumstances, to obtain personal data You have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of Your choice.

• You can ask us to stop processing Your personal data, and We will do so, if We are relying on our own or someone else’s legitimate interest to process Your personal data, except if We can demonstrate compelling legal grounds for the processing; or processing Your personal data for the purposes direct marketing.

• You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects You, unless such profiling is necessary for the entering into, or the performance of, a contract between You and us.

• If We rely on Your consent (or explicit consent) as our legal basis for processing Your personal data, You have the right to withdraw that consent at any time. 
• You can exercise Your right of withdrawal by contacting us using our contact details in the Contact Us section or by using any other opt-out mechanism We may provide, such as an unsubscribe link in an email.

• If You have a concern about any aspect of our privacy practices, including the way We have handled Your personal data, please contact us using the contact details provided in the Contact Us section. 
• If You’d like to get further information, You can contact our Data Protection Officer through our Contact Us page.
• You can also report any issues or concerns to the Information Commissioner’s Office here.

• We do not provide services for children under the age of 18, and We do not send them any marketing information. 
• We collect data about all users of and visitors to our Website regardless of age, through cookies, and We anticipate that some of those users and visitors will be children. 
• Such visitors including children may be able to visit other parts of the Website and may be subjected to the available online financial promotions or marketing contents. 

• We are aware of the importance of the data We collect from You and therefore We use advanced technology to protect Your information.
• We take reasonable precautions to protect Personal Data from loss, misuse and unauthorised access, disclosure, alteration and destruction.
  We store data in encrypted form on computers and control access via secure Web pages.
• We also employ firewalls and other security technologies to protect our servers from external attack.
• Our employees are trained in the proper handling of Personal Data and when We use other companies to provide services for us, We require them to protect the confidentiality of Personal Data they receive.
  When You enter certain more-sensitive information (such as Your bank sort code or account number) on the application form, We encrypt that information using secure socket layer technology.
• We only keep Your Personal Data for as long as necessary, for the purposes for which it was collected, to provide You with services and to conduct our legitimate business interests or where otherwise required by law. 
• In addition, We take reasonable steps to ensure that the data We collect is relevant for its intended purposes, and is accurate, and up to date.

• We use cookies to differentiate You from other users of the app, our sites, and app site.
• This helps us to offer You a good experience when using the app or browsing the app site.
• It also helps us to enhance Our App, Our Sites and the App site.
• For further details about the cookies We use, please refer to our Cookie Policy.

• Our Sites and/or App Site may contain links to third party Websites.
• If You follow a link to any of these third-party Websites, please note that such Websites have their own terms and privacy policies, and that We are not responsible or liable for any of the practices of these third-party sites.

• Gain Credit LLC operates globally with affiliates and vendor partners including third countries, which means Personal Data may be stored and processed (for example stored in a data center) by us or our service providers for the provision of services relevant to You.
• By providing Personal Data for any of the purposes stated above, You acknowledge that Your Personal Data may be transferred to or stored in third countries outside of UK and We will take necessary measures to safeguard Personal Data in accordance with the contractual obligations and data protection legislation applicable to the provision of services.
• Your Personal Data will only be transferred if We or our vendor partners:
  • Process it in a territory which the UK has determined provides an adequate level of protection for Personal Data; or
  • Implement appropriate safeguards to protect Your Personal Data, including transferring it in accordance with an applicable transfer mechanism (such as International Data-Transfer Agreement).

Please note that our affiliates Global Analytics India Private Limited (GAI), GAIN Credit Holdings, Inc and GAIN Credit, Inc also adhere to the above said principles.

• We may make changes to this Privacy Policy from time to time.
• This Privacy Policy was last updated on 13/02/2025  
• To ensure that You are always aware of how We use Your personal data, We will update this Privacy Policy from time to time to reflect any changes or proposed changes to our use of Your personal data.  
• We may also make changes to comply with changes in applicable law or regulatory requirements. 
• We encourage You to review this Privacy Policy periodically to be informed of how We use Your personal data. 
• The new terms may be displayed on-screen, and You may be required to read and accept them to continue Your use of the Application and Our Sites.

If You have any questions or concerns about the use of Your Personal Data as described above, You can contact us by:

• Telephone: 0203 695 8072 (between Monday to Friday 9am-6pm and Saturday 9am-1pm)*
• E-mail: customercare@drafty.co.uk
• Post: Drafty, PO Box 10756, Leicester, LE3 4GX.
• Website: www.drafty.co.uk

• Drafty is a trading name of GAIN Credit LLC which is a limited liability company registered in the State of Delaware, USA under number 4124111 at the registered address: 251 Little Falls Drive, Wilmington, DE 19808, USA .
• GAIN Credit LLC is Authorised and regulated by the Financial Conduct Authority. Our FCA Registration number is 689378. 
• We are licensed by the Information Commissioner’s Office (Registration Number: Z2752028)