1. Roles

The lender is the controller of its borrowers’ and staff data in the lendhero platform and decides why and how it is processed. lendhero is the processor and acts only on the lender’s documented instructions. When a lender runs lendhero on its own servers, we access its data only when the lender asks us to, for example for support.

2. What the DPA covers

  • The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects.
  • Confidentiality duties for everyone at lendhero who can access client data.
  • Help with data subject requests, impact assessments and consultations with authorities.
  • Standard Contractual Clauses and other transfer safeguards where data leaves the EEA, the UK or Switzerland, and equivalent terms for other regions.
  • Audit rights and the information needed to show compliance.

3. Security measures

  • Encryption in transit (TLS) and at rest.
  • Role-based access with field-level permissions, multi-factor authentication and a four-eyes rule for sensitive actions.
  • An audit log of every action by staff, partners, integrations and AI agents.
  • Separate environments for testing and production, backups and recovery tests.
  • Regular vulnerability scanning and penetration tests; clients may run their own tests by agreement.

4. Sub-processors

We use a limited number of sub-processors, mainly for cloud hosting, email and messaging delivery and support tools, each under terms that protect data at least as well as our DPA. Integrations that a lender switches on, such as credit bureaus, identity checks or payment providers, are engaged by the lender. We keep an up-to-date list of sub-processors, available on request, and give clients advance notice of changes so they can object.

5. Data location

Clients choose where their data is stored: in our cloud region for their market, in their private cloud or on their own servers. This helps meet data residency rules such as those in the EU, Brazil, Saudi Arabia, India and other markets.

6. Incidents

If we become aware of a personal data breach affecting client data, we notify the client without undue delay and provide the information it needs to meet its own notification duties.

7. Return and deletion

At the end of the contract, the client can export its data. We then delete it from our systems, including backups on their normal cycle, unless the law requires us to keep it.

8. AI features

AI agents work inside the client’s environment and within the roles and permissions the client sets. Client data is not used to train public models, and every agent action is logged.

9. Contact

Questions about data processing or a DPA: privacy@lend-hero.com.