Guarantor privacy policy

Last updated: 1 September 2026 · Version: v1.0 · Jurisdiction: United Kingdom · GAIN Credit LLC (trading as Tutu)

1. Who we are

GAIN Credit LLC, trading as Tutu, is incorporated in Delaware, United States, and authorised and regulated by the Financial Conduct Authority (FCA), registration number 689378. We are also registered with the Information Commissioner's Office (ICO), registration number Z2752028.

As the entity operating under the Tutu trading name, GAIN Credit LLC is the data controller responsible for how your personal data is used under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we use your personal data if someone nominates you as a potential guarantor, if you choose to continue with the guarantor application, and if you go on to become a guarantor for a Tutu loan.

2. How to contact us

We have appointed a Data Protection Officer (DPO), who is responsible for overseeing how we handle personal data and ensuring compliance with data protection law. If you have any questions about this Privacy Policy, how we use your personal data, or if you would like to exercise your privacy rights, you can contact us as follows:

3. Personal data we collect and how we collect it

The personal data we collect and how we use it will depend on whether you have been nominated as a potential guarantor, whether you choose to continue with the guarantor application, and whether you go on to become the guarantor.

If you have only been nominated, we initially receive limited information about you from the person who nominated you so that we can contact you. If you choose to continue, we will collect further information from you and other sources so that we can assess whether we can accept you as a guarantor. If you become a guarantor, we will continue to collect and use relevant information to manage the guarantee and our relationship with you.

Information provided by the person who nominates you

When someone nominates you as a potential guarantor, they provide us with your name and contact details so that we can contact you about their application. We ask the person who nominates you to tell you that they would like to nominate you as their guarantor and that Tutu will be in touch.

Being nominated does not mean that you have agreed to become a guarantor. When we contact you, you can decide whether you want to continue with the process. If you choose not to continue, we will not collect any further information about you, although we may retain limited information about your nomination and our contact with you in accordance with our retention requirements.

Information you provide if you choose to continue

If you choose to continue, we will ask you to provide further personal data so that we can assess whether we can accept you as a guarantor. This may include your name, date of birth, contact details, personal circumstances, employment details, income and expenditure information, bank account and transaction information, and other information you provide during the application process or when contacting us.

If you become a guarantor, we may also collect information from you during the life of the guarantee, including when we contact you about the loan or guarantee, when you make a payment, or when you contact us.

Information about the borrower

As part of the guarantor application and assessment process, we will provide you with information about the person who nominated you and the loan they have applied for so that you can decide whether you are willing to become their guarantor.

If you become their guarantor, we may provide you with further information about the loan where needed to manage the guarantee. This may include information about payments, amounts outstanding, missed payments, changes to payment arrangements, any formal insolvency, debt solution or statutory debt protection that affects the loan or guarantee, and steps being taken to recover amounts owed.

Information from credit reference, fraud and identity verification agencies

If you choose to continue your application to become a guarantor, we obtain personal data from credit reference agencies, fraud prevention agencies and identity verification providers to verify your identity, assess whether we can accept you as a guarantor, prevent fraud and financial crime, and meet our legal and regulatory obligations.

This may include your credit history, credit score, identity verification information, and fraud and financial crime prevention information.

Open Banking information

If you choose to use Open Banking and consent to your financial information being shared with us, we may receive information including your account balances, transaction history, income and expenditure.

We use this information to assess your ability to act as a guarantor, including whether making payments under the guarantee, if required, would be affordable for you.

The Open Banking information is shared with us on a one-off basis as part of your guarantor application. We will not use Open Banking to obtain updated information about your account on an ongoing basis.

You can withdraw your consent before the information is shared. Once it has been shared, withdrawing your consent will not affect our previous use of the information, and we may continue to retain it in accordance with the retention periods described in this Privacy Policy.

Information collected automatically

When you use our website or services, we automatically collect technical and usage information. This may include:

  • Your IP address, operating system, and browser type
  • Mobile device information, including device type, unique device identifiers, mobile network information, and operating system
  • Information about how you use our website and services, including pages visited, time spent, and navigation patterns
  • Cookie and tracking information

We use this information to operate our services, maintain security, prevent fraud, and improve our website and services.

Website analytics

We use analytics tools, such as Microsoft Clarity, to understand how our website is used and improve our services. Where required by law, this information is collected only with your consent.

Information from service providers and public sources

We may receive personal data from service providers who support our business, such as identity verification providers, payment processors, and technology providers. We may also obtain limited information from publicly available sources, such as the electoral register, where permitted by law.

Providing your personal data

You do not have to agree to become a guarantor. However, if you choose to continue with the process, we need certain personal data to assess whether we can accept you as a guarantor. If you choose not to provide this information, we may not be able to complete our assessment or accept you as a guarantor.

4. How we use your personal data and our legal basis

We use your personal data for the following purposes, in accordance with data protection law.

To contact you about being a potential guarantor

We use the name and contact details provided by the person who nominated you to contact you about their loan application and explain what being a guarantor involves. We will not treat you as having agreed to become a guarantor simply because someone has nominated you. You can choose whether you want to continue with the process.

If you choose not to continue, we will not use your information to assess you as a guarantor, although we may retain limited information about the nomination and our contact with you in accordance with our retention requirements.

To assess whether we can accept you as a guarantor

If you choose to continue, we use your personal data to verify your identity, assess your financial circumstances, affordability and creditworthiness, prevent fraud and financial crime, and decide whether we agree to accept you as a guarantor.

To arrange and manage the guarantee

If you become a guarantor, we use your personal data to put the guarantee in place and manage it for as long as it remains in force. This includes communicating with you about the loan and guarantee, contacting you if the borrower misses a payment, taking or processing payments you make, discussing payments with you and, where necessary, exercising or enforcing our rights under the guarantee.

To provide customer support and manage our relationship with you

We use your personal data to communicate with you, respond to enquiries, investigate complaints, and provide support where you need it.

To prevent fraud and financial crime, and ensure security

We use your personal data to verify your identity, prevent fraud and financial crime, and protect our customers, services and systems. This may include monitoring activity and analysing communications.

To comply with legal and regulatory obligations

We process personal data to comply with applicable laws and regulations, including requirements imposed by the Financial Conduct Authority and other regulatory bodies.

To improve our services and website

We use personal data to monitor and improve our services, systems and website. Where possible, we use aggregated or anonymised information for analysis and improvement.

Automated decision-making and credit scoring

If you apply to become a guarantor, we use credit scoring and automated checks to assess whether we can accept you. We may use information including your credit history, income and expenditure, existing financial commitments, and information provided by you or obtained from third parties. These checks may result in us being unable to accept you as a guarantor.

If you believe that an automated decision has been based on inaccurate information or would like us to reconsider the outcome, you can contact us using the details in Section 2.

Our legal bases for using your personal data

We rely on the following legal bases:

  • Contract – where processing is necessary to take steps at your request if you choose to proceed with the guarantor application and, if you become a guarantor, to arrange and manage the guarantee
  • Legal obligation – where we must comply with legal or regulatory requirements, including those imposed by the Financial Conduct Authority and anti-money laundering legislation
  • Legitimate interests – where processing is necessary to contact you after you have been nominated as a potential guarantor, to establish whether you are willing to consider becoming a guarantor, support responsible lending, assess and manage risk, prevent fraud and financial crime, improve our products and services, maintain the security of our systems, and manage or enforce the guarantee where appropriate
  • Consent – where required, such as for Open Banking

5. Special category data

Special category data is sensitive personal information, such as information about your health. We do not ask you to provide special category data as part of our assessment of whether you can act as a guarantor.

In limited circumstances, you may choose to provide health information for example, if you tell us about a medical condition when asking for support or explaining your personal circumstances. Where you share this type of information with us, we will only use it where relevant and where permitted by data protection law.

We do not use special category data to assess whether we can accept you as a guarantor or for marketing purposes. We apply additional safeguards to protect this information and retain it only for as long as necessary to fulfil the purpose for which it was provided and to comply with our legal and regulatory obligations.

6. Who we share your personal data with

We may share your personal data with the following categories of third parties where necessary to contact you about being a potential guarantor, assess whether we can accept you as a guarantor, manage the guarantee if you become one, comply with legal and regulatory obligations, and operate our business.

The person who nominated you

We may tell the person who nominated you whether their loan application can proceed with you as their guarantor. If it cannot, we will not tell them whether this is because you chose not to continue or because we were unable to accept you as a guarantor, or give them the detailed reasons for the outcome.

We will not share your credit file, income and expenditure information, or other information about your financial circumstances with them.

If you become their guarantor, we may share information with them where necessary to manage the loan and guarantee, including information about payments you make under the guarantee where this is relevant to their loan. If they ask us for a copy of the guarantor agreement, we will provide it where required in accordance with the Consumer Credit Act. This means that the personal data contained in the agreement will also be shared with them.

Credit reference agencies

If you apply to become a guarantor, we share personal data with credit reference agencies (CRAs) to verify your identity and assess whether we can accept you as a guarantor. When we carry out our assessment, we will supply your personal data to CRAs and they will provide us with information about you, which may include information about your financial history and public records such as the electoral register.

The credit reference agencies we use are TransUnion and Experian. Further information about how CRAs use your personal data, including your rights, is available in the Credit Reference Agency Information Notice (CRAIN): www.transunion.co.uk/crain and www.experian.co.uk/legal/crain.

Service providers who support our business

We share personal data with trusted third-party service providers who perform services on our behalf. This includes providers of payment services, identity verification, Open Banking, technology and IT systems, customer support, analytics and website services, and account servicing and administrative support.

Where service providers process personal data on our behalf, they are required to process it in accordance with our instructions and to protect it in accordance with data protection law.

Debt collection agencies

If you become liable to make payments under the guarantee, we may share your personal data with debt collection agencies who act on our behalf to help manage and, where necessary, recover amounts owed under the guarantee.

Debt purchasers and account assignment

Where the borrower's loan or our rights under the guarantee are transferred or assigned, associated personal data may also be transferred to the organisation that becomes responsible for managing the loan or guarantee. They will process your personal data as a data controller in accordance with their own privacy policy and legal obligations.

Regulators, authorities and law enforcement

We may share personal data where required to comply with legal or regulatory obligations, including with the Financial Conduct Authority, the Information Commissioner's Office, courts, law enforcement agencies, and other regulatory authorities.

Business transfers and professional advisers

If we sell, transfer, or restructure our business or assets, personal data may be shared with potential or actual buyers, their advisers, and our professional advisers, such as legal, financial, and audit advisers, where necessary and subject to appropriate safeguards.

7. International transfers

We operate globally and may transfer your personal data to, or allow access to your personal data from, our group companies, affiliates, and service providers located outside the United Kingdom where necessary to provide our services and operate our business. This may include transfers to countries such as the United States and India.

Where we transfer personal data to countries that have not been recognised by the UK as providing an adequate level of data protection, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can request a copy of the relevant safeguards by contacting us using the details in Section 2.

Where your personal data is transferred to a country that has been recognised by the UK as providing an adequate level of data protection, we rely on that adequacy decision as the basis for the transfer.

These safeguards are designed to ensure your personal data remains protected to UK data protection standards.

8. How long we keep your personal data

We only keep your personal data for as long as we need it. How long we keep it will depend on how far you progress through the guarantor journey and whether you become the guarantor.

If you are nominated but do not complete a guarantor application

If you are nominated as a potential guarantor but do not start an application, we will normally keep limited information about your nomination and our contact with you for 30 days after the invitation expires. This includes where you do not respond, tell us that you do not want to proceed, or tell us that the contact was unexpected.

If you start an application but leave before completing it, the information entered into the incomplete application is not retained. We will only keep the limited nomination and contact information described above, normally for 30 days after the invitation expires.

If you complete a guarantor application but do not become the guarantor

We will normally keep information about your application and the assessment we carried out for three years after your application ends. This applies where:

  • we are unable to accept you as a guarantor;
  • you pass our assessment but decide not to proceed;
  • another person is selected as the guarantor; or
  • the borrower's loan application is declined, withdrawn or does not otherwise proceed

After three years, we will delete the personal data or anonymise it so that it can no longer be linked to you.

If you become the guarantor

If you become the guarantor, we will normally keep information about you, your application and the guarantee for five and a half years from the later of:

  • the date the loan is closed; or
  • the date your obligations under the guarantee have ended

This includes where we call on the guarantee, you make payments under it, or there is enforcement or collections activity.

We keep this information to manage and evidence the guarantee, meet our legal and regulatory obligations, respond to complaints and legal claims, prevent and detect fraud and financial crime, and exercise, enforce or defend our legal rights.

After five and a half years, we will delete the personal data or anonymise it so that it can no longer be linked to you, unless we need to retain it for longer for one of the reasons set out below.

When we may keep information for longer

We may keep relevant personal data for longer than the periods described above where this is necessary because, for example:

  • there is an unresolved complaint, dispute or legal proceeding;
  • enforcement or collections activity is continuing;
  • we are dealing with a data protection rights request;
  • we are investigating suspected fraud or financial crime; or
  • the Financial Conduct Authority, a court or another regulatory or public body requires us to retain it

Where this applies, we will only keep the relevant information until the matter has been concluded and any applicable legal or regulatory retention requirement has expired.

Our retention periods take account of the type and sensitivity of the information, why we collected it, our legal and regulatory obligations and any relevant limitation periods. When we no longer need personal data, we securely delete it or anonymise it in accordance with our data retention requirements.

Credit reference agencies and fraud prevention agencies keep personal data in accordance with their own retention policies.

9. Your rights

You have a number of rights in relation to your personal data under data protection law. Some of these rights only apply in certain circumstances. These include the right to:

  • Request access to the personal data we hold about you
  • Request correction of inaccurate or incomplete personal data
  • Request deletion of your personal data in certain circumstances
  • Request restriction of how we use your personal data
  • Object to the use of your personal data where we rely on legitimate interests
  • Request transfer of your personal data to you or another organisation in a structured, commonly used format, where applicable
  • Withdraw your consent where we rely on consent to process your personal data

You may also ask us to reconsider an automated decision about your guarantor application.

If you have been nominated as a potential guarantor and do not want to continue, you can tell us. We will not use your information to assess you as a guarantor, although we may retain limited information about your nomination and our contact with you in accordance with our retention requirements.

If you become a guarantor, we may need to continue using your personal data for as long as the guarantee remains in place and, in some circumstances, after it ends. This means that exercising a right to object, restrict processing or request deletion will not necessarily require us to stop processing information that is needed to manage or enforce the guarantee or meet our legal and regulatory obligations.

We will consider any request you make in accordance with data protection law and explain the outcome to you.

You can exercise your rights by contacting us using the details in Section 2. We will normally respond within one month and will not normally charge you for doing so.

If you have concerns about how we use your personal data, you can contact our Data Protection Officer and we will investigate and respond.

You also have the right to complain to the Information Commissioner's Office about how we have handled your personal data. More information is available on the ICO's website.

10. Marketing communications

We will not send you marketing communications as a result of being nominated as a potential guarantor or becoming a guarantor, and we will not ask you to opt in to receive marketing as part of the guarantor process.

11. How we protect your personal data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, disclosure, alteration, or destruction. These measures include secure systems, encryption, access controls, and staff training.

We also require third-party service providers who process personal data on our behalf to protect it in accordance with data protection law and appropriate security standards.

We regularly review and update our security measures to help ensure your personal data remains protected.

12. Cookies and website technologies

We use cookies and similar technologies to operate our website, maintain security, and understand how our website is used so we can improve our services and customer experience. We comply with applicable data protection law and the Privacy and Electronic Communications Regulations (PECR).

Some cookies are necessary for our website to function. Other cookies, including analytics cookies, are only used with your consent. You can manage or withdraw your consent at any time using our cookie consent tool. You can also control cookies through your browser settings. Further information about our use of cookies is available in our Cookie Policy.

13. Third-party links

Our website may contain links to third-party websites. If you follow a link to any of these websites, please note that they have their own privacy policies and we are not responsible for their practices.

14. Children

You must be at least 18 years old to act as a guarantor. We do not knowingly collect personal data from children for this purpose.

15. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we use personal data. The latest version will always be available on our website and will include the date it was last updated.