Privacy policy

Who we are

MerchantHQ is published by Best Business Loans Ltd, registered in England and Wales (company number 16833937), registered office Cust Hall, Toppesfield, Halstead, Essex CO9 4EB. For UK GDPR we are the data controller.

What we collect

• Business data. Trading name, sector, monthly card volume, average transaction value, current acquirer (if any).
• Contact data. Name, email, phone.
• High-risk vertical declarations. Where applicable (CBD, vape, adult, firearms, gambling) so your enquiry goes to a broker partner that can place that category.
• Server logs. IP, user agent, URL, timestamp. Retained 30 days.
• Cookies. Essential (form session, consent state). Analytics and marketing cookies only with consent.

Why we collect it

• To pass your quote-form enquiry to our card-payments broker partner (Merchant Advice Service, or Fena for peptide businesses), which contacts you about quotes from acquirers that fit your sector and volume.
• To pass your enquiry to the partner(s) you select.
• Where you tell us on the quote form that you also want business funding or working capital, to pass those details to our funding partner, an independent UK finance broker, so they can contact you about funding options.
• To improve match quality over time.

Lawful bases

Quote-form submissions and partner introductions: contract performance and legitimate interest. Marketing: consent (opt in). Server logs and essential cookies: legitimate interest (running the site).

Who we share with

• Our card-payments broker partner (Merchant Advice Service, or Fena for peptide businesses), which receives every quote-form enquiry and pays us a fee for each introduction. It becomes an independent data controller from that point.
• Our funding partner (an independent UK finance broker), only where you ask for business funding on the quote form. They become an independent data controller from that point.
• Hosting and infrastructure (Cloudflare).
• Our database (Supabase), which stores quote-form enquiries, including answers saved as you go through the form, and our email providers (Resend and Google), which deliver enquiry emails to our team and broker partner, and FormSubmit, which sends a backup copy of each quote-form enquiry to our team only.
• Analytics, only if you accept cookies: Google Analytics, Microsoft Clarity (page and session analytics) and Zuko (form analytics). If you reject cookies, none of these load, apart from Google's cookieless consent-mode signals.
• A cookieless page-visit counter run by our web partner Rank4AI, which records the page, referrer and browser type and sets no cookies, and Companies House, which we query to look up your company.
• Email and CRM providers used to operate the site.
• Meta Platforms Ireland Ltd (Meta Pixel), only if you accept marketing cookies, to measure how our advertising on Facebook and Instagram performs and to attribute quote enquiries. See the cookie policy.
• YouTube (Google LLC), only if you press play on one of our videos: the video then loads from YouTube's privacy-enhanced address and YouTube receives your IP address and browser details under its own privacy policy. Nothing loads from YouTube before you press play.
• Awin (where you click an Awin-tagged sign-up link), limited to a referral identifier.

We do not sell personal data and we do not pass it to data brokers. The only advertising company that receives data from this site is Meta, and only through the Meta Pixel if you accept marketing cookies.

International transfers

Some of our processors (for example Cloudflare, Google and, depending on region, our database and email providers) may process personal data outside the UK and European Economic Area. Where they do, we rely on an adequacy decision or on the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards, so your data receives an equivalent level of protection.

Retention

• Quote requests that did not progress: 90 days.
• Partner introductions made: 6 years (commercial record-keeping).
• Email correspondence: 3 years.
• Marketing opt-outs: indefinitely.

Your rights

Access, rectification, erasure, restriction, objection, portability. Email privacy@merchanthq.co.uk to exercise any of these. Or complain to the ICO at ico.org.uk.