Ayan Capital Group – Privacy Policy
Introduction
Welcome to the Ayan Capital Group (“Ayan”, “we”, “us”, “our”) privacy policy. For the purposes of this privacy policy, the Ayan Capital Group means:
- Ayan Capital Ltd; and
- Ayan Capital 1 Ltd.
The Ayan Capital Group provides Sharia-compliant car finance, offering interest-free vehicle financing structured to comply with Islamic finance principles. You can also opt in to our ‘Enhanced Repair Responsibilities’, which we call AyanCare. If you opt in, we accept liability, as owner of the vehicle you hire from us, for the cost of certain repairs. The cost is financed within your agreement and forms part of your monthly payment.
This privacy policy explains who we are, what personal data we collect, why we collect it, how we use it, who we share it with and how long we keep it when we are providing our services to retail customers and business customers, including individuals acting on behalf of a business customer such as directors, ultimate beneficial owners (UBO) and guarantors. It also explains your rights and how to contact us or the ICO.
Controller and DPO
This privacy policy applies to the Ayan Capital Group, comprising Ayan Capital Ltd and Ayan Capital 1 Ltd.
The relevant Ayan Capital Group entity is the controller of your personal data depending on which group company you deal with, which company provides services to you, or which company enters into an agreement with you, or when you use or browse our website.
Our registered offices are:
Ayan Capital Ltd: 20 Wenlock Road, London, England, N1 7GU
Ayan Capital 1 Ltd: Mitchell Charlesworth, 3rd Floor, 44 Peter Street, Manchester, United Kingdom, M2 5GP
Our external Group Data Protection Officer is Harper James.
Your right to complain
If you have any concerns about how we collect, use, or handle your personal data, you have the right to make a complaint to us.
You can do this by contacting us using the details below:
Email: dpo@ayancapital.co.uk
Phone: +44 20 3802 0292
Please provide enough information to help us understand and investigate your complaint.
We will acknowledge your complaint within 30 days of receiving it and will respond without undue delay. If we need further information from you in order to investigate your complaint, we may contact you.
We encourage you to contact us first so that we have the opportunity to investigate and try to resolve the issue. However, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Further information about how to do this can be found on the ICO’s website: https://ico.org.uk.
Keeping your data up to date and policy updates
Please keep us informed if your personal data changes during your relationship with us.
We keep this policy under regular review.
Last updated: ASeptember 2026
Third-party links and services
Our website may contain links to third-party websites, plugins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.
1. What data we collect
Personal data means any information about an individual from which that person can be identified.
Customers and prospective customers
We may collect the following categories of personal data when you seek to use our services:
Identity Data: including name, title, date of birth, proof of identity documentation (such as passport or driving licence, ID card, and utility bills).
Contact Data: including home address, email address, telephone number. In some cases, we can ask for the contact info of your friends or relatives, for use as an additional contact point if we are unable to reach you.
Profile Data: including account details, application history, feedback or survey responses, communication history with us, call recordings.
Marketing and Communications Data: marketing preferences, consent records, opt-in/opt-out history.
Application Information: including information provided during your finance application, vehicle information relating to your application.
Financial Data: including bank account details, affordability information, income and expenditure information, open banking data where provided.
Transaction Data: including payments to and from you, information relating to vehicle purchases and finance agreements.
AyanCare and Repair Data: including details of AyanCare where you have opted in to it, your vehicle registration number, vehicle identification number (VIN), make, model, mileage, AyanCare reference, repair requests, fault descriptions, repair booking information, repair history, repair status and outcomes, approved repairer information, and evidence of vehicle service history.
Driving History Data: including driving licence information, driving history obtained through the DVLA.
Technical Data: IP address, device information, browser type and version, login data, website usage information.
Business-use applications and corporate customers
If you tell us that the vehicle finance is for business purposes, your application will follow our business application journey from the outset.
In this journey, we deal with the individual who submits the application. That individual must be a director and the UBO of the company and must also provide a personal guarantee. We do not collect or verify the personal data of additional directors, signatories or other representatives as part of this process.
Where our business-use process requires the finance to be taken out in the name of a limited company, the agreement is entered into with that corporate entity. Even where the credit agreement is with the company, we process the applicant’s personal data throughout the journey, including at initiation, for affordability and credit assessment, for AML/KYC and sanctions screening, fraud prevention, and in connection with the personal guarantee.
For business-use applications, we may therefore also collect:
- Authority and Company Relationship Data: including your role, directorship, UBO status and authority to act for the company.
- Guarantee Data: including information relating to any personal guarantee you provide.
Website users
When you visit our website we may collect Technical Data and Usage Data about how you interact with our website through cookies and similar technologies.
Aggregated data
We may also use aggregated or statistical data that does not directly identify you.
Special category data
We do not intentionally collect special category personal data (such as data relating to health, racial or ethnic origin, political opinions, religious beliefs, or biometric data).
If you do not provide data
If you do not provide personal data required by law or under a contract with us, we may not be able to provide our services or enter into a finance agreement with you.
2. How we collect your data
Direct interactions
You may provide personal data directly to us when you:
- apply for vehicle finance services, including where you opt in to AyanCare
- create an account
- communicate with us by phone, email or online
- submit documents or identity verification
- provide company details or guarantee information in connection with a business-use application
- complete forms or surveys
Automated technologies
We collect certain Technical Data automatically when you use our website through:
- cookies
- server logs
- analytics tools
Third-party and publicly available sources
We may receive personal data from third parties involved in credit checking, identity verification and vehicle history checks, including:
- Merchants, Dealerships and Brokers: organisations with whom we partner and who may be involved in the vehicle sale process.
- iVendi: software provider that merchants, dealers and brokers use.
- Credit reference agencies (CRAs) such as Experian (via Fintern Technologies Ltd) and TransUnion (via CreditSafe) — see below for more information.
- CIFAS fraud prevention databases
- Open Banking providers used for affordability checks
- DVLA for driving licence verification
- KYC providers including Plaid
- Vehicle history providers such as UKVD
- Your organisation: if you are the representative of a business customer.
- Our appointed AyanCare repair administrator: may provide us with information about repair requests, repairs, outcomes, customer satisfaction and related analysis.
- Approved Repairers: garages and repairers approved by us or our appointed repair administrator to assess and carry out repairs under AyanCare.
3. How and why we use your data and our lawful bases
We only process personal data where the law allows us to.
The main lawful bases we rely on are:
- Performance of a contract with you or taking steps at your request before entering into a contract;
- Compliance with our legal obligations;
- Legitimate interests — where we rely on legitimate interests as a lawful basis, we process personal data to operate and improve our business, assess eligibility for our financial products, manage risk, prevent fraud, maintain the security of our systems, and provide and improve our services. We ensure that these interests are balanced against your rights and freedoms.
- Consent (where required).
Key purposes for processing
| Purpose | Type of data | Lawful basis |
|---|
| To process and assess finance applications | Identity, Contact, Financial, Application, Driving History, Authority and Company Relationship, Guarantee | Taking steps before entering into a contract, performance of a contract and legitimate interests (assessing eligibility for our products, managing financial risk, and ensuring responsible lending) |
| To verify identity, authority to act for a company, and company relationship information | Identity, Contact, Application Information, Authority and Company Relationship | Legal obligation and legitimate interests (verifying that the individual is who they say they are, is authorised to act on behalf of the company) |
| To carry out AML/KYC, sanctions screening, credit checks, affordability checks and fraud prevention | Identity, Financial, Application Information, Authority and Company Relationship, Guarantee | Legitimate interests (assessing creditworthiness, preventing fraud and financial crime, and managing lending risk) and legal obligation. |
| To assess corporate applications and related personal guarantees | Identity, Contact, Financial, Application Information, Authority and Company Relationship, Guarantee | Taking steps before entering into a contract, performance of a contract, legal obligation and legitimate interests (assessing eligibility for finance, assessing the suitability and adequacy of any personal guarantee, managing credit, fraud and default risk) |
| To administer and manage finance agreements and related guarantees | Identity, Contact, Transaction, Profile, Guarantee | Taking steps before entering into a contract, performance of a contract, legal obligation and legitimate interests (administering accounts and payments, monitoring the performance of finance agreements and guarantees) |
| Retail direct marketing – sending promotional offers, product updates, newsletters, event invitations and personalised marketing communications to retail customers. | Identity, Contact, Marketing and Communications, Profile. | Consent, where required under applicable marketing laws (including PECR), and/or legitimate interests (promoting products and services and growing the business) |
| Business direct marketing – sending marketing communications about products, services, events and industry updates to business customers. | Identity, Contact, Marketing and Communications, Profile. | Legitimate interests (promoting products and developing business relationships and marketing relevant products and services to business contacts) |
| To verify identity and comply with regulatory obligations | Identity, Financial | Legal obligation |
| To manage our relationship with customers and applicants | Identity, Contact, Profile | Performance of a contract and legitimate interests (providing customer support, managing communications, and maintaining service quality) |
| To offer, price and administer AyanCare, including preparing agreement and disclosure documentation | Identity, Contact, Application Information, Vehicle Data, AyanCare and Repair Data | Taking steps before entering into a contract, performance of a contract and legitimate interests (offering optional products and administering our customer relationships) |
| To manage repair requests and arrange or authorise repairs under AyanCare | Identity, Contact, Vehicle Data, AyanCare and Repair Data, including service-history evidence | Performance of a contract and legitimate interests (administering repair services, preventing fraud, managing service quality and resolving complaints or disputes) |
| To monitor the performance and quality of AyanCare and repair administration services | AyanCare and Repair Data, Profile Data, feedback and satisfaction information | Legitimate interests (monitoring service quality, improving our products and services, managing suppliers, and resolving complaints or disputes) |
| To record calls with you for training and monitoring purposes. | Identity, Contact, Profile | Legitimate interests (maintaining service quality, staff training, monitoring compliance with internal procedures and regulatory requirements, and resolving complaints or disputes) |
| To administer and protect our business and website | Identity, Contact, Technical | Legitimate interests (operating our business, maintaining network and information security, preventing fraud or misuse of our systems) and legal obligation |
| To analyse and improve our services and website | Technical, Usage | Legitimate interests (monitoring usage, improving our products and services, and enhancing user experience) |
| To meet legal, regulatory and reporting obligations | Any relevant category of personal data depending on the obligation | Legal obligation |
Marketing and surveys
Where we carry out direct marketing communications or customer surveys, we ensure that these are conducted in accordance with applicable marketing laws and consent requirements where necessary.
You can opt out of marketing communications at any time by changing your preferences on your dashboard or by emailing us: dpo@ayancapital.co.uk
AyanCare and repairs
AyanCare is optional. If you opt in, we accept liability, as owner of the vehicle you are hiring from us, for the cost of certain repairs due to mechanical breakdown.
Ayan is the controller of the personal data processed in connection with the provision of AyanCare. We use carefully selected third-party service providers to administer the service and arrange and manage repairs. Where necessary, we may share relevant contact, vehicle, repair and service-history information with those providers and approved repairers so that they can provide the service to you. Our appointed repair administrator processes your personal data on our instructions. Approved repairers act as independent data controllers in relation to the repair services they provide and the records they maintain. They are responsible for their own privacy notices, which we recommend you review.
Use of AI tools
We use artificial intelligence tools to support aspects of our business operations.
This includes:
- machine learning models used in connection with retail car finance applications only. These models are not used for business applications;
- approved AI-enabled software and analysis tools used to support internal operations, including AI features within approved platforms and AI coding assistants; and
- limited use of general-purpose AI tools, such as Claude or ChatGPT, for internal productivity purposes. We do not input customers’ personal data into these tools.
Business applications follow a separate process from the outset and are assessed through manual review, taking into account relevant corporate financial information and the personal data of the applicant acting as director, ultimate beneficial owner and guarantor. There is no solely automated approval of a corporate application.
Where AI tools are used in decision-making, we apply appropriate safeguards and human oversight where required. Further information is set out in section 5 below.
Cookies and similar technologies
Our website and application use cookies, local storage and similar technologies for security, to remember your preferences, to measure how our services are used and, where you accept it, for advertising. Strictly necessary technologies are used without consent under Regulation 6(4) PECR. Everything else is used only if you accept it in our cookie banner, and you can change or withdraw that choice at any time through the Consent Preferences button on any page.
A full list of the cookies we use, their purpose and how long they last, together with details of session recording and international transfers, is set out in our Cookie Policy.
Change of purpose
We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another compatible reason or where required or permitted by law.
4. Credit Reference and Affordability Checks
To assess your application, affordability, and creditworthiness, and to verify identity, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We primarily obtain credit and affordability data from Experian, accessed via our data partner Fintern Technologies Ltd. In some cases, we may also obtain credit and identity information from Creditsafe Business Solutions Limited, which sources consumer data from TransUnion International UK Limited.
The information received from CRAs may include details about your identity, credit commitments, payment history, and public records. We use this information where you have authorised us to do so as part of your finance application for purposes such as assessing creditworthiness and product suitability, verifying identity, managing accounts, recovering debts, and preventing fraud.
If you apply for finance for business purposes, credit checks are carried out on the individual applicant, not only on the corporate entity. The applicant, who must be a director and UBO of the company, is credit-assessed as part of the business application journey and is also assessed in their capacity as guarantor because a personal guarantee is required. The creditworthiness of the corporate entity is assessed separately at company level.
We may also share information with CRAs on an ongoing basis about the operation of your account, including whether payments are made on time. Credit reference agencies may share your information with other organisations and may link your data with that of financial associates such as joint applicants.
Further information about how credit reference agencies process and share personal data, including the identities of the CRAs we use, can be found in the Credit Reference Agency Information Notices (CRAIN).
You can find further details about how our data partners process your personal data in their respective privacy notices:
As part of the application process, we may also:
- request access to your bank transaction data through open banking to assess affordability (used only for the application process);
- obtain driving licence information from the DVLA using your licence and National Insurance number, which may also be shared with our insurance broker to calculate insurance premiums; and
- carry out fraud and identity checks with CIFAS to help prevent fraud and money laundering.
5. Automated Decision Making and Profiling
We use automated decision making and profiling when assessing retail applications for finance. This helps us assess applications quickly and consistently while managing credit risk and preventing fraud. These decisions are significant because they may determine whether finance is offered to you and the financing limit available.
Retail applications
At the retail application stage, some decisions may be made automatically without human involvement. This may include:
- automatically approving an application and setting a financing limit where eligibility and affordability criteria are met; or
- automatically declining an application where predefined risk criteria are triggered.
Applications that do not clearly meet approval or decline criteria, or that show inconsistencies or risk indicators, are referred to an underwriting officer for manual review.
Business applications
Business applications are identified at the outset of the journey and follow the business flow from that point.
Our machine learning underwriting model is not applied to business applications. Business applications are assessed through manual review, taking into account the corporate financial data and the personal data of the applicant acting as director, UBO and guarantor.
For business auto finance, the outcome is limited to either:
- a decline; or
- a referral to manual review.
There is no solely automated approval of a corporate application.
Information used in the decisioning process
Depending on the type of application, our systems assess information such as:
- details provided in your application
- credit reference data (for example payment history, defaults, county court judgments and credit scores)
- affordability information
- fraud prevention and identity verification data
This information is assessed against predefined lending, affordability and fraud-prevention criteria.
Possible outcomes
The possible outcomes of this process include:
- approval of your application and the setting of a financing limit
- refusal of your application; or
- referral for manual review by an underwriting officer.
These outcomes may affect whether finance is offered to you and the financing limit available.
Your rights
You have the right to request human review of an automated decision, to express your point of view and to contest a decision.
If you would like further information or wish to request a review of a decision, you can contact us at dpo@ayancapital.co.uk
6. Sharing your data
We may share your personal data with trusted third parties where this is necessary to provide our services, administer your agreement, comply with legal or regulatory obligations, or protect our legitimate interests. These may include:
- Credit reference agencies (see section on Credit Reference and Affordability Checks above).
- Fraud prevention organisations, including CIFAS.
- Open Banking providers used to assess affordability.
- Payment service providers to support certain payment and financial transaction services, including direct debit and card payment processors
- Marketing platforms or providers involved in supporting us in sending direct marketing to our customers
- Identity verification and KYC providers to comply with our legal and regulatory obligations, including anti-money laundering (AML), counter-terrorist financing (CTF), and fraud prevention requirements, to help us verify your identity and assess potential financial crime risks when you apply for our services or during the course of our relationship with you.
- Vehicle data providers, such as vehicle history or vehicle service databases.
- Vehicle dealers or suppliers involved in your vehicle purchase.
- Insurers or insurance brokers involved in arranging required insurance.
- Regulators, government bodies, law enforcement agencies, and courts where required by law
- Professional advisers, such as lawyers, accountants, and auditors
- Technology, cloud hosting, analytics, and software service providers, including AI-enabled tools used to support our operations and call recordings providers
- Investors, funders, or financing partners who support the provision of our products, or third parties to whom we may choose to sell, transfer or merge parts of our business or our assets.
- Our appointed AyanCare repair administrator and approved repairers: where you have opted in to AyanCare, we may share relevant customer, vehicle and repair information with our appointed repair administrator, and with approved repairers where necessary to assess, approve, arrange and carry out repairs. These parties do not receive your bank account details, income and expenditure information or credit reference information.
- Advertising and analytics platforms. Where you accept the relevant cookies, we share online identifiers and information about how you use our website and application with Google, Meta, Microsoft Advertising, Reddit, TikTok and Hotjar, so that we can measure how our services are used and how our advertising performs. Depending on the provider, they act as our processor or as a separate or joint controller of the data they receive. This does not include the contents of your finance application, credit reference data or the documents you upload. Full details are in our Cookie Policy.
We require all third parties to respect the security of your personal data and to process it only for specified purposes and in accordance with applicable data protection laws.
7. International transfers
Some of our service providers or operational teams may be located outside the United Kingdom. In particular, personal data may be transferred to Tajikistan and Uzbekistan. In this case, we ensure appropriate safeguards are in place to protect your data in accordance with UK data protection law. These safeguards may include contractual protections or equivalent mechanisms.
Where you accept advertising or analytics cookies, information about your use of our website and application is also transferred to the United States by Google, Meta, Microsoft Advertising, Reddit and TikTok. We rely on the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to ensure your data remains protected.
For further information about international transfers, please contact us at dpo@ayancapital.co.uk.
8. Data security
We have implemented appropriate technical and organisational security measures to protect personal data from accidental loss, unauthorised access, alteration or disclosure.
Access to personal data is limited to employees, contractors and service providers who need it for legitimate business purposes and who are subject to confidentiality obligations.
We have procedures in place to deal with suspected personal data breaches and will notify individuals and regulators where required by law.
9. How long we keep your data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, tax, accounting or reporting requirements.
Retention periods may vary depending on the nature of the data and the applicable legal obligations. Data may also be retained for longer where necessary to deal with complaints, disputes or potential legal claims.
For more information about our retention periods, please contact dpo@ayancapital.co.uk.
10. Your rights
Under UK data protection law, you have several rights in relation to your personal data.
You can contact us at dpo@ayancapital.co.uk to exercise any of these rights.
You will not usually have to pay a fee to access your personal data. However, we may charge a reasonable fee or refuse a request where it is clearly unfounded or excessive.
We aim to respond to requests within one month.
Your legal rights
Access: You can request a copy of the personal data we hold about you and check we are processing it lawfully.
Correction: You can ask us to correct incomplete or inaccurate data. We may need to verify the accuracy of the new data.
Erasure: You can ask us to delete your data where there is no good reason for us to continue processing it, where you have objected successfully, where we processed it unlawfully or where we must erase it to comply with law. We may not always be able to comply for specific legal reasons, which we will explain if applicable.
Objection: You can object to processing based on our legitimate interests if you feel it impacts your rights and freedoms, and you can always object to direct marketing. We may demonstrate compelling legitimate grounds to continue processing in some cases.
Restriction: You can ask us to suspend processing where you want us to check accuracy, where processing is unlawful but you do not want erasure, where you need us to keep data to establish, exercise or defend legal claims, or where you have objected and we are considering our grounds.
Portability: You can ask us to transfer your data to you or a third party in a structured, commonly used, machine-readable format. This applies to automated information you provided, where we process it based on consent or contract.
Withdraw consent: Where we rely on consent, you can withdraw it at any time. This will not affect processing carried out before withdrawal. If you withdraw consent, we may be unable to provide certain services and will advise you if so.
.svg)
