Last updated: 1 November 2026
Carki is a trading name of Equaliti Limited, a company registered in England and Wales under company number 13109643. Our registered office is 20–22 Wenlock Road, London, N1 7GU. We are authorised and regulated by the Financial Conduct Authority under reference 952416. Our Information Commissioner’s Office registration reference is ZB349066.
We are a credit broker. This policy explains how we collect and use personal information when you visit our website, enquire about finance, apply through us, communicate with us or deal with us as a business contact. Equaliti Limited is the controller responsible for the personal information we use for these purposes.
Lenders, credit reference agencies and some other organisations involved in your application act as separate controllers. Their privacy notices explain their own use of your information. This policy does not replace those notices. Separate privacy information applies to employees and job applicants.
You can contact our Data Protection Officer about this policy, our use of your personal information, a data protection complaint or a request to exercise your rights.
Email: data@carki.co.uk
Post: Data Protection Officer, Equaliti Limited trading as Carki, 20–22 Wenlock Road, London, N1 7GU.
Please mark correspondence “Data Protection”. You do not need to use a particular form or quote data protection legislation to contact us or exercise your rights.
We collect information relevant to the service you request and our relationship with you. This may include:
If you tell us about a health condition, disability or other support need, we may record relevant information to help provide suitable support. We aim to record only what is necessary. See section 6 for additional protections for sensitive information.
Where information is needed to assess an application, verify identity or meet a legal requirement, we will explain this when requesting it. If you do not provide it, we may be unable to progress your application or provide the relevant service.
We receive information directly from you through our website, application forms, telephone calls, email, messages and documents. We may also receive information from a dealer or introducer you use, lenders, credit reference agencies, identity verification and fraud prevention providers, publicly available registers and your authorised representative.
Where you choose to use Open Banking, information comes from your bank through the relevant authorised provider, following the permission process explained to you at the time. You do not need to give Carki your online banking password.
If you provide information about someone else, please make sure you are entitled to do so and make them aware of this policy. We will provide them with privacy information where required.
We use personal information only where we have an appropriate lawful basis. The basis depends on the particular purpose; we do not rely on every basis for every activity.
Finance enquiries and applications. We use information to respond to your request, understand your requirements, obtain quotations, identify potential lenders and help arrange finance. Where necessary, this is to take steps at your request before entering into a contract with us or to perform that contract. Our legitimate interests also support administering introductions and communicating with dealers and lenders to deliver the service you request.
Credit and eligibility checks. We use relevant information to assess potential eligibility and match applications with lender criteria. Our legitimate interests are arranging appropriate introductions and avoiding unsuitable or fraudulent applications. Where a particular check is required by law or a regulatory rule applicable to us, we rely on that legal obligation.
Identity checks and fraud prevention. We use information to verify identity, investigate suspicious activity and protect customers, lenders and our business. We rely on our legitimate interests in preventing financial crime and protecting transactions, and on legal obligations where they apply to the particular check.
Regulatory records and complaints. We use information to meet applicable FCA, accounting, tax and other legal requirements. We also use it to investigate complaints, demonstrate fair treatment and establish, exercise or defend legal claims. Our bases are the relevant legal obligation and, for associated activities not required by law, our legitimate interests in resolving disputes and protecting legal rights.
Running and improving our business. We use information for system security, quality assurance, staff training, service analysis, managing suppliers and commercial relationships, and business continuity. Our legitimate interests are providing a reliable service, protecting information and improving how our business operates. Where possible, we use anonymised information for analysis.
Marketing and cookies. We rely on consent where required by electronic marketing or cookie rules. Where permitted, we may rely on legitimate interests to promote relevant services, subject to your right to object. Sections 10 and 11 explain your choices.
When relying on legitimate interests, we consider the necessity of the processing and its effect on your rights and interests. You can contact us for more information about that assessment. If we need to use your information for a new purpose, we will provide further information and obtain consent where required.
Health information and biometric data used to uniquely identify someone receive additional legal protection. An ordinary photograph is not automatically special category biometric data; that depends on how it is processed.
Where we process special category information, we need both a lawful basis under the UK GDPR and an additional condition permitting that use. For example, we may ask for your explicit consent to record health information so we can provide support. Where another condition applies, we will explain it as appropriate. You can withdraw consent by contacting data@carki.co.uk; withdrawal does not affect processing already carried out lawfully.
Where an identity verification service uses biometric recognition, the verification process must explain the information used, the provider’s role, the relevant legal basis and condition, and your available options before the check takes place.
Information about criminal offences or allegations is subject to separate legal safeguards. We process it only where permitted by law and with the required safeguards. It is not treated as ordinary application information.
We use credit reference agency information, including information from TransUnion, to support identity verification, eligibility assessment, credit broking and fraud prevention. We may supply identification and application details to obtain the relevant results. Lenders may carry out their own checks using TransUnion or other agencies.
A search may leave a record on your credit file. A soft search is generally visible to you and does not affect your credit score. A hard search is visible to other lenders and may affect their assessment. The application process will explain the type of search before it is undertaken. An initial eligibility check does not guarantee that a lender will offer finance or that no hard search will be required later.
Credit reference agencies maintain information from credit providers, public records and other sources, and use it for purposes including credit assessment, identity verification and fraud prevention. Where relevant, they may link records for people who are financially associated. Applying for finance may involve checking relevant financial associations.
The Credit Reference Agency Information Notice explains how the principal UK agencies use and share information, their retention arrangements and your rights: https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference
Where fraud prevention information is shared, it may be checked against relevant databases and used to identify false identities, inconsistent information or suspected fraud. A recorded fraud concern can affect access to finance or other services. We will provide any additional notice required for the particular agency or check used. Contact us if you wish to query information we have supplied; you can also raise accuracy concerns with the relevant agency.
Credit scores and electronic eligibility checks may help assess which lenders or products could be suitable. These processes can compare application details and credit information with lender criteria. Factors can include income, existing commitments, credit history and the amount and term requested. The results can affect available quotations, the lenders approached or whether an application progresses.
Lenders make their own lending decisions and may use automated systems to decide eligibility, credit limits, interest rates or whether to accept an application. Their notices explain their decision processes and the safeguards available.
Where we make a significant decision about you using solely automated processing, we will provide the information and safeguards required by law, including a way to seek human intervention, make representations and challenge the decision. Contact data@carki.co.uk if you want an explanation of an assessment we have made or help identifying the lender responsible for a decision.
We share information only where relevant to a stated purpose and supported by a lawful basis. Recipients may include:
Some recipients process information on our instructions under contract; others are responsible for their own processing as separate controllers. We will make the relevant lender or provider’s privacy information available during the application process or on request. We do not sell your personal information or share it with unrelated organisations for their own marketing.
We may contact you about relevant Carki services where the law permits. For email or text marketing, we obtain consent unless a permitted exception applies, such as the existing customer exception where all its conditions are met. Telephone marketing is subject to applicable preference service rules and your objections.
You can opt out at any time using an unsubscribe link, the opt out instructions in a message, or by emailing data@carki.co.uk. You have an absolute right to object to direct marketing, including related profiling. We may keep a limited suppression record to make sure your preference is respected.
Withdrawing marketing permission does not prevent necessary service messages about an enquiry, application, agreement or complaint.
Our website uses cookies and similar technologies. Some support functions such as security and remembering essential choices. Where consent is required for other technologies, we ask before using them and allow you to change your choice.
Our Cookie Policy and website cookie settings explain the technologies in use, their purposes, providers and duration, and how to manage them. Declining optional cookies does not prevent you from contacting us about finance.
Our suppliers may store or access information outside the United Kingdom. Where this amounts to a restricted international transfer, we use a lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and complete the assessments required by law. Contractual safeguards may include the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.
You can contact data@carki.co.uk for information about relevant destinations and safeguards, including how to obtain a copy, subject to necessary redactions.
We use appropriate technical and organisational measures to protect personal information, including access controls, confidentiality requirements and measures to protect storage and transmission. We restrict access to people who need the information for their work and have procedures to investigate security incidents and make notifications where legally required.
We keep personal information only for as long as necessary for the purpose for which it is held. Retention depends on the type of record, whether an enquiry leads to an agreement, the duration of our relationship, applicable regulatory and accounting requirements, and the period during which a complaint or legal claim may arise.
Application and transaction records are assessed against regulatory record keeping requirements, the need to evidence the service provided and relevant claim periods. Complaint records are assessed against complaint handling requirements and any continuing dispute. Identity verification records, recordings and technical logs are kept according to their purpose and risk, rather than automatically retaining every item for the same period.
We may retain relevant records for longer where necessary for an active complaint, investigation, legal hold or other legal obligation. Marketing records are reviewed against your preferences, and a limited suppression record may remain after you opt out. When information is no longer needed, we delete it securely or anonymise it. Contact us for the retention period or criteria applying to a particular record.
Depending on the circumstances, you can ask us to:
You can also withdraw consent at any time where we rely on it. These rights are subject to legal conditions and exemptions; for example, we may need to retain information to meet a legal obligation or defend a claim. We will explain any refusal or restriction and how to challenge it.
Contact data@carki.co.uk or write to the address in section 2. Requests can also be made verbally. We may ask for proportionate information to verify identity or clarify the request where necessary; we do not routinely require everyone to provide a passport or complete a form.
We normally respond without undue delay and within one month, subject to any extension or pause permitted by law. If more time is permitted, we will explain why. Requests are normally free. Any permitted charge or refusal will be explained.
If you are concerned about our use of your personal information, contact our Data Protection Officer at data@carki.co.uk or by post using section 2. Explain what happened and, if possible, the outcome you seek. You do not need to use a particular form.
We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed as appropriate and explain the outcome without undue delay. A request to exercise a data protection right is handled under its own applicable time limit, even if made alongside a complaint.
You also have the right to complain to the Information Commissioner’s Office. You can contact the ICO at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. Further contact information is available at https://ico.org.uk/.
We review this policy when our services, processing activities or legal requirements change. The version published on our website will show its last updated date. Where required, we will bring significant changes to your attention through an appropriate channel.
