Privacy policy

1. Who we are

GAIN Credit LLC, trading as Tutu, is incorporated in Delaware, United States, and authorised and regulated by the Financial Conduct Authority (FCA), registration number 689378. We are also registered with the Information Commissioner's Office (ICO), registration number Z2752028.

As the entity operating under the Tutu trading name, GAIN Credit LLC is the data controller responsible for how your personal data is used under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy applies to your use of the Tutu website and services in the United Kingdom.

2. How to contact us

We have appointed a Data Protection Officer (DPO), who is responsible for overseeing how we handle personal data and ensuring compliance with data protection law. If you have any questions about this Privacy Policy, how we use your personal data, or if you would like to exercise your privacy rights, you can contact us as follows:

• DPO Email: DPO@gaincredit.com
• Website: www.tutu.co.uk

You may also write to us at: Tutu, PO Box 10756, Leicester, LE3 4GX.

3. Personal data we collect and how we collect it

We collect personal data when you apply for our services, use your account, contact us, use our website, and from third parties such as credit reference agencies and fraud prevention agencies. In some cases, and with your consent, we may also collect information from your bank using Open Banking.

Information you provide to us

You provide personal data directly when you apply for a loan, contact us, or use our services. This may include your name, date of birth, contact details, personal circumstances, employment details, income and expenditure information, bank account and transaction information, details of your applications and loan history, and any information you provide when contacting customer support. We use this information to assess your application, provide our services, and manage your account.

Information about people you nominate as guarantors

If you apply for a guarantor loan, we will ask you for the name and contact details of the person you nominate as a potential guarantor so that we can contact them. Before giving us their details, you should let them know that you would like to nominate them and that we will be in touch. When we contact them, we will provide them with our guarantor privacy policy, which explains how we use their personal data.

Information from credit reference, fraud, and identification verification agencies

We obtain personal data from credit reference agencies, fraud prevention agencies, and identity verification providers to assess your application, verify your identity, prevent fraud and financial crimes, and meet our legal and regulatory obligations, including those under anti-money laundering legislation. This may include your credit history, credit score, financial associations, identity verification information, and fraud and financial crime prevention information.

Open Banking information (where you choose to share it with us)

If you choose to use Open Banking and consent to your financial information being shared with us, we may receive information including your account balances, transaction history, income and expenditure.

We use this information to assess your affordability and creditworthiness and support responsible lending decisions.

The Open Banking information is shared with us on a one-off basis as part of your loan application. We will not use Open Banking to obtain updated information about your account on an ongoing basis.

You can withdraw your consent before the information is shared. Once it has been shared, withdrawing your consent will not affect our previous use of the information, and we may continue to retain it in accordance with the retention periods described in this Privacy Policy.

Information collected automatically

When you use our website or services, we automatically collect technical and usage information. This may include:

• Your IP address, operating system, and browser type
• Mobile device information, including device type, unique device identifiers, mobile network information, and operating system
• Information about how you use our website, including pages visited, time spent, and navigation patterns
• Cookie and tracking information (further information is available in our Cookie Policy)

We use this information to operate our services, maintain security, prevent fraud, and improve our website and services.

Website analytics

We use analytics tools, such as Microsoft Clarity, to understand how our website is used and improve our services. Where required by law, this information is collected only with your consent.

Information from service providers and public sources

We may receive personal data from service providers who support our business, such as identity verification providers, payment processors, and technology providers. We may also obtain limited information from publicly available sources, such as the electoral register, where permitted by law.

Information from your guarantor

Your guarantor, or someone you nominate as a potential guarantor, may give us information about you when they contact us or when we speak to them about your loan. We do not routinely ask them to provide additional information about you, but they may share information with us during these conversations. Where relevant, we may take this information into account when assessing your application, managing your loan or providing you with appropriate support.

Providing your personal data

To assess your application and provide our services, we need certain personal data from you. If you choose not to provide this information, we may not be able to assess your application or offer you a loan.

4. How we use your personal data and our legal basis

We use your personal data for the following purposes, in accordance with data protection law.

To assess your application and provide our services

We use your personal data to assess your loan application, verify your identity, assess affordability and creditworthiness, and decide whether to offer you a loan. If a loan is provided, we use your personal data to manage your account, process payments, and communicate with you about your loan.

To arrange and manage a guarantee

Where you apply for a guarantor loan, we use your personal data to contact the person you nominate, give them the information they need to decide whether to become your guarantor, and carry out the checks we need to decide whether we can accept them.

If your loan goes ahead, we use your personal data to manage your loan and the guarantee. We will also give your guarantor a copy of your credit agreement and provide further copies or information where required under the Consumer Credit Act.

If you miss a payment, we will use your personal data to contact your guarantor and tell them about the missed payment. We may also use and share your personal data where necessary to manage or enforce the guarantee.

To prevent fraud and financial crime, and ensure security

We use your personal data to verify your identity, prevent fraud and financial crime, and protect our customers, services, and systems. This may include monitoring account activity and analysing communications.

To provide customer support and manage our relationship with you

We use your personal data to communicate with you, respond to enquiries, investigate complaints, and provide customer support.

To comply with legal and regulatory obligations

We process personal data to comply with applicable laws and regulations, including requirements imposed by the Financial Conduct Authority and other regulatory bodies.

To improve our services and website

We use personal data to monitor and improve our services, systems, and website. Where possible, we use aggregated or anonymised information for analysis and improvement.

To send marketing communications

If you have, or have previously had, a product with us, we may send you information about Gain Credit's own products and services that may be relevant to you. You can opt out of receiving marketing communications at any time.

Automated decision-making and credit scoring

We use automated systems, including credit scoring, to assess applications and make lending decisions. Our automated system analyses your application using information such as your credit history, income and expenditure, existing financial commitments, and other information derived from your application and from third party sources. If you do not meet our lending criteria, your application will be declined.

As an online-only lender, all lending decisions are made solely by automated means without human review. Under UK data protection law, where a decision is made solely by automated processing and has a significant effect on you, you have the right to request that the decision be reviewed by a member of our team, to express your point of view, to obtain an explanation of the decision, and to contest the outcome. To exercise any of these rights, please contact us.

Where you apply for a guarantor loan, we also carry out checks on the person you nominate as your guarantor. Your application can only proceed if we are able to accept them as your guarantor. If we are unable to do so and you do not nominate another person who we can accept, we will not be able to provide the loan.

We have safeguards in place to help ensure our automated decisions are fair, consistent, and accurate.

Our legal bases for using your personal data

We rely on the following legal bases:

• Contract – where processing is necessary to assess your application or provide our services, including arranging and managing a guarantee where you apply for a guarantor loan
• Legal obligation – where we must comply with legal or regulatory requirements, including those imposed by the Financial Conduct Authority (FCA) and anti-money laundering legislation
• Legitimate interests – where processing is necessary to support responsible lending, prevent fraud and financial crime, improve our products and services, maintain the security of our systems, share information with people you nominate as potential guarantors and with your guarantor where appropriate, and send you information about Gain Credit's own similar products and services. You can opt out of receiving marketing communications at any time
• Consent – where required, such as for Open Banking

5. Special category data

Special category data is sensitive personal information, such as information about your health. We do not ask you to provide special category data as part of your loan application.

In limited circumstances, you may choose to provide health information when contacting us or during the servicing of your account, for example, if you tell us about a medical condition when asking for support with your repayments or explaining your personal circumstances. Where you share this type of information with us, we will only process it where permitted by data protection law, including where you have given your explicit consent or where processing is necessary to protect your vital interests, establish, exercise or defend legal claims, or for reasons of substantial public interest where permitted by law.

If you have a guarantor, they may also share information about your health or other personal circumstances with us when speaking to us about your loan. We do not routinely ask your guarantor to provide this information about you, but if they choose to do so, we will only use it where relevant and where permitted by data protection law.

We do not use special category data to assess your application, make lending decisions, or for marketing purposes. We apply additional safeguards to protect this information and retain it only for as long as necessary to fulfil the purpose for which it was provided and to comply with our legal and regulatory obligations. Where we rely on your consent, you have the right to withdraw that consent at any time by contacting us using the details in Section 2. Withdrawing consent will not affect anything we did before you withdrew it.

6. Who we share your personal data with

We may share your personal data with the following categories of third parties where necessary to provide our services, comply with legal and regulatory obligations, and operate our business.

Credit reference agencies

We share personal data with credit reference agencies (CRAs) to assess your application, verify your identity, assess affordability and creditworthiness, and manage your account. When you apply, we will supply your personal data to CRAs, and they will provide us with information about you, including information from your credit application, financial history, and public records such as the electoral register. This helps us make responsible lending decisions.

We will also continue to share information with CRAs about your account, including your repayment history and account performance. If you do not repay your loan as agreed, this may be recorded by CRAs and shared with other organisations, including other lenders. CRAs will record searches on your credit file, which may be visible to other organisations and may affect your ability to obtain credit.

The credit reference agencies we use are TransUnion and Experian. Further information about how CRAs use your personal data, including your rights, is available in the Credit Reference Agency Information Notice (CRAIN): https://www.transunion.co.uk/crain

People you nominate as guarantors, and your guarantor

If you apply for a guarantor loan, we will share information about you and your application with the person you nominate as a potential guarantor so they can decide whether they are willing to become your guarantor. This may include your name, the amount and term of the loan you have applied for, the repayments, and the fact that you have nominated them.

If someone becomes your guarantor, we will share further information with them, while the guarantee remains in place, where needed to manage the loan and the guarantee. This may include information about your loan, your payments, amounts outstanding, missed payments, any changes we agree to your payment arrangements, any formal insolvency or debt solution you enter into that affects the loan or guarantee, and any steps we take to recover what is owed. This allows your guarantor to understand what is happening with the loan and, where necessary, make a payment or speak to us about the guarantee.

We will not share information about your credit file, credit score, detailed reasons for our lending decision, or any other products or accounts you hold with us. We will only share other information where you have specifically asked or authorised us to do so, or where we are required or permitted to do so by law.

We will only share information that is appropriate and necessary for the guarantor relationship.

Service providers who support our business

We share personal data with trusted third-party service providers who perform services on our behalf. This includes providers of payment services, identity verification, Open Banking, technology and IT systems, customer support, analytics and website services, and account servicing and administrative support.

Depending on the services they provide, these organisations may act as our data processors or as separate data controllers. Where they process personal data on our behalf, they are required to act in accordance with our instructions and protect the information in accordance with data protection law.

Debt collection agencies

We may share personal data with debt collection agencies who act on our behalf to help manage and recover amounts owed to us. These agencies process your personal data on our behalf and in accordance with data protection law.

Debt purchasers and account assignment

We may transfer or assign your account, including associated personal data, to a debt purchaser. Where this happens, the debt purchaser will become responsible for managing your account and will process your personal data as a data controller in accordance with their own privacy policy and legal obligations.

Regulators, authorities, and law enforcement

We may share personal data where required to comply with legal or regulatory obligations, including with the Financial Conduct Authority, the Information Commissioner's Office, courts, law enforcement agencies, and other regulatory authorities.

Business transfers and professional advisers

If we sell, transfer, or restructure our business or assets, including the sale or assignment of loan accounts, personal data may be shared with potential or actual buyers, their advisers, and our professional advisers, such as legal, financial, and audit advisers, where necessary and subject to appropriate safeguards.

7. International transfers

We operate globally and may transfer your personal data to, or allow access to your personal data from, our group companies, affiliates, and service providers located outside the United Kingdom where necessary to provide our services and operate our business. This may include transfers to countries such as the United States and India.

Where we transfer personal data to countries that have not been recognised by the UK as providing an adequate level of data protection, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (UK IDTA) or standard contractual clauses approved for use in the UK. You can request a copy of the relevant safeguards by contacting us using the details in Section 2.

Where your personal data is transferred to a country that has been recognised by the UK as providing an adequate level of data protection, we rely on that adequacy decision as the basis for the transfer.

These safeguards are designed to ensure your personal data remains protected to UK data protection standards.

8. How long we keep your personal data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. This includes providing our services, complying with legal and regulatory obligations, preventing fraud, resolving disputes, and enforcing or defending our legal rights.

How long we keep your information will depend on your relationship with us and the type of information we hold. This includes whether you take out a loan with us, whether an application does not result in a loan, and any information about you that arises through a guarantor relationship.

Where you take out a loan with us, we will normally keep information about you and your account for 5.5 years after your relationship with us ends. We do this to meet our legal and regulatory obligations, respond to complaints or legal claims, prevent and detect fraud and financial crime, and maintain appropriate records of our relationship with you.

In some circumstances, we may need to retain your personal data beyond this standard period. This may apply where there is an unresolved complaint, dispute, or legal proceedings, an ongoing data subject access request, or where retention is required by the Financial Conduct Authority or other regulatory body. In such cases, we retain relevant data until the matter is fully resolved and any applicable legal limitation period has expired.

If you leave the application before completing and submitting it, the information you have entered will not be retained.

Where you submit an application but it does not result in a loan, we will normally retain information about the application for three years. This includes applications that are declined or withdrawn after submission, or that cannot proceed because the requirements for a guarantor have not been met. We retain this information to evidence the application and our decision, prevent and detect fraud, respond to complaints or legal claims, and meet our legal and regulatory obligations.

We only keep personal data for as long as there is a legitimate reason to do so. Our retention periods take into account the type and sensitivity of the information, why we collected it, our legal and regulatory obligations, and any relevant limitation periods. When we no longer need personal data, we securely delete or anonymise it in accordance with our data retention requirements.

Credit reference agencies and fraud prevention agencies may retain your personal data in accordance with their own retention policies.

9. Your rights

You have a number of rights in relation to your personal data under data protection law. Some of these rights only apply in certain circumstances. These include the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete personal data
• Request deletion of your personal data in certain circumstances
• Request restriction of how we use your personal data
• Object to the use of your personal data, including for direct marketing. You have an absolute right to object to direct marketing at any time. If you do, we will stop sending you marketing communications
• Request transfer of your personal data to you or another organisation in a structured, commonly used format, where applicable
• Request a review of automated decisions that affect you (see Section 4 for further information)
• Withdraw your consent where we rely on consent to process your personal data

Where you have a loan with a guarantor, we may need to continue using and sharing certain information about your loan with your guarantor for as long as the guarantee remains in place. This means that exercising a right to object, restrict processing or request deletion will not necessarily require us to stop processing or sharing information that is needed to manage or enforce the loan or guarantee. We will consider any request you make in accordance with data protection law and explain the outcome to you.

You can exercise your rights by contacting us using the details in Section 2. We will normally respond within one month and will never charge you for doing so. If you have concerns about how we use your personal data, you can contact our Data Protection Officer and we will investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO) at any time. More information is available at www.ico.org.uk.

10. Marketing communications

If you have or have previously had a product with us, we may send you information about Gain Credit's own similar products and services that may be relevant to you. We may contact you by email, SMS, social media, online advertising platforms and other digital channels.

To help make our marketing more relevant, we may use information such as your email address to show you our adverts through social media and digital advertising platforms. We take appropriate steps to protect your personal information when doing this.

We rely on legitimate interests under UK GDPR and, where applicable, the PECR soft opt-in to send these marketing communications.

You can opt out of receiving marketing at any time by using the unsubscribe link in our emails, replying STOP to SMS messages, updating your marketing preferences in your online account, or by contacting us directly. If you opt out, we will stop using your contact details for marketing, including for advertising through social media and digital advertising platforms.

11. How we protect your personal data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, disclosure, alteration, or destruction. These measures include secure systems, encryption, access controls, and staff training.

We also require third-party service providers who process personal data on our behalf to protect it in accordance with data protection law and appropriate security standards.

We regularly review and update our security measures to help ensure your personal data remains protected.

12. Cookies and website technologies

We use cookies and similar technologies to operate our website, maintain security, and understand how our website is used so we can improve our services and customer experience. We comply with applicable data protection law and the Privacy and Electronic Communications Regulations (PECR).

Some cookies are necessary for our website to function. Other cookies, including analytics cookies, are only used with your consent. You can manage or withdraw your consent at any time using our cookie consent tool. You can also control cookies through your browser settings. Further information about our use of cookies is available in our Cookie Policy.

13. Third-party links

Our website may contain links to third-party websites. If you follow a link to any of these websites, please note that they have their own privacy policies and we are not responsible for their practices.

14. Children

Our services are only available to people aged 18 or over. We do not knowingly collect data from children.

15. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we use personal data. The latest version will always be available on our website and will include the date it was last updated.