Privacy policy

Last updated 18 October 2026

This policy explains what personal information Capitrel collects when you apply for sale and leaseback, why we need it, who we share it with, and the rights you have. We don’t sell personal information, we don’t use advertising or analytics cookies, and we only email or text you about your application.

Who we are

Capitrel is a trading name of HSKI Group Ltd, a company registered in England and Wales with company number 16825249. Our registered office is 82 Unit A, James Carter Road, Bury St Edmunds, IP28 7DE.

HSKI Group Ltd is the controller of the personal information described here. For anything about your information, email privacy@capitrel.com or write to us at our registered office.

What we collect

When you apply

Your business: its name, company number and registered address (we take these from the Companies House register), how long it has traded and its turnover.
The asset: what it is, its age and condition, its working hours if it’s machinery, and any notes you add.
People: the directors’ names (from Companies House), and your name, role, email address and phone number.

Your account

Your email address, which is how you sign in. The six-digit sign-in codes we email you are stored only in scrambled form and stop working after 10 minutes.
When you signed in, so we can keep you signed in on that device.

Photos of the asset

The photos you upload, including nameplates and serial numbers. Your device shrinks each photo before upload, which also removes the location data that phones add. Please keep people, faces and personal documents out of the photos.

Your business bank account

If you connect the business bank account, we receive read-only information through Plaid: the account names and numbers, balances and recent transactions. We never see your online banking login, and nobody can move money or make payments through this connection. Plaid’s own end user privacy policy applies to your use of Plaid.

Your ID check

After you accept an offer, the director signing for the business confirms who they are through Stripe Identity: a photo of their passport, driving licence or national ID card, and a selfie. Stripe checks that the document is genuine and that the selfie matches the photo on it.
Stripe tells us the result and the name and date of birth on the document. We keep the result and the name, and check both against the directors listed at Companies House; we don’t keep the date of birth. The document images and the selfie stay with Stripe, and we can look at them there if we need to review a check.
Matching your selfie to your document uses biometric data. Stripe asks for your explicit consent before you start. Stripe’s privacy policy explains how it handles this information, including where it uses it for its own purposes, such as preventing fraud.

Your offer, agreements and payments

Our valuation of the asset and the offer we make, the share and lease length you choose, and the monthly payments that follow.
When you sign the agreements: the name you type, the time, your IP address and your browser type, kept with an exact copy of the documents you signed.
Your Direct Debit is set up on GoCardless’s own page. We receive the mandate reference and its status, not your bank login.
When we pay your business: the amount, the date and the payment reference.

Technical information

Your IP address, used only to limit repeated requests and keep the service secure. We store it in a one-way scrambled form, kept for a few hours.
A record of the emails and text messages we send you and whether they were delivered.

How we use it, and our legal reasons

What we do	Legal reason (UK GDPR)
Make and keep the sale and lease agreements, pay your business and collect the lease payments by Direct Debit	Performing the agreements your business has signed with us
Assess your application, value the asset and prepare an offer	Taking steps, at your business’s request, before entering into an agreement; and our legitimate interest in assessing business finance applications
Run your account and send emails and text messages about your application, including reminders to add photos or connect your bank account. Texts go only to a mobile number you gave us, and carry a private link to your application.	Our legitimate interest in running the application, and taking steps before an agreement
Review your business bank account	Our legitimate interest in checking that the business can afford the agreement and that the account belongs to it. You choose whether to connect it.
Confirm the identity of the director signing for the business (the ID check)	Our legitimate interest in preventing fraud and knowing who we make agreements with, and any legal obligation that applies. For the selfie match, which uses biometric data: your explicit consent, which Stripe asks for before you start
Prevent fraud and keep the service secure	Our legitimate interest in protecting applicants and Capitrel, and any legal obligation that applies
Keep records of agreements and payments	Legal obligations, such as tax and accounting rules

We don’t make decisions about your application using automated processing alone: a person reviews every application. We don’t send marketing emails.

We use these service providers, who process information only on our instructions:

Cloudflare: hosts this website and protects it from attacks.
Supabase: our database and photo storage, held in London.
SMTP2GO: delivers our emails.
Twilio: delivers our text messages.
GoCardless: sets up your Direct Debit and collects the lease payments.
Plaid: connects your business bank account, if you choose to.
Stripe: runs the ID check (Stripe Identity).

We look up your company on the public Companies House register. We may also share information with our professional advisers, with anyone who funds or buys an agreement we make with your business, and with the police, regulators or courts when the law requires it.

Data outside the UK

Our database and photos are stored in the UK. Some of our providers, such as Cloudflare, SMTP2GO, Twilio, GoCardless, Plaid and Stripe, may process information in other countries. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, which give your information the same protection it has in the UK.

How long we keep it

Applications you don’t finish: deleted after 30 days.
Sign-in codes: deleted within a day of being made. Sign-in sessions end after 30 days, or 24 hours for a phone opened with a QR code or a link we texted. Links in texts stop working after 7 days.
Applications that don’t lead to an agreement, with their photos and bank information: 12 months after our last contact, then deleted.
Applications that lead to an agreement: for the length of the agreement and six years after it ends, as the law requires for financial records.

Cookies

We only use cookies that the service needs to work, so we don’t ask for consent to them:

An application cookie that lets this browser resume your application, for up to 30 days.
An account cookie that keeps you signed in, for up to 30 days (24 hours on a phone opened with a QR code or a link we texted).

We don’t use analytics, advertising or social media cookies.

Your rights

You have the right to ask for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to have it moved to another organisation. Some rights have limits, for example when we must keep records by law. Email privacy@capitrel.com and we’ll reply within one month.

You can stop a bank connection at any time in your bank’s app or through my.plaid.com. You can withdraw your consent to the selfie match; if you’d rather not use it, email us and we’ll talk about another way to confirm your identity.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Keeping it secure

Everything travels over encrypted connections. Only authorised Capitrel staff can see applications, and they sign in through a separate, protected system. The key to your bank connection is encrypted before we store it, and photos are kept in private storage that is only reachable through our own website.

Changes to this policy

If we change how we use your information, we’ll update this page and the date at the top. If a change is significant, we’ll email you.