Privacy Policy - UK

Section 1 – Introduction and defined terms

We at Glow Financial Services Limited (the “Company”, “Glow”, “we”, “us” or “our”) are committed to protecting the privacy and security of your personal information and ensure that all personal data handled by us is processed in accordance with the applicable data protection laws and regulations and guidance laid out by the Information Commissioner’s Office (“ICO”).

This Privacy Notice (“Notice”) explains how we collect, use, process, disclose and protect your personal information when you interact with Glow as a user of this website (“Website”); as a Glow employee; or as an employee or representative of Glow’s clients (“Corporate Clients”) or our suppliers. If you interact with Glow’s brands, for example through loan applications or customer portals, those activities are governed by the relevant brand’s Privacy Notice.

For the purpose of applicable data protection law, including the Data Protection Act 2018 and UK GDPR (together, “DP Law”), Glow is the Data Controller of your personal information that we collect, hold, and process.

This Notice was last updated 22^nd August 2025. For a summary of all updates to this Notice, please refer to section 13 ‘All changes to this Notice’.

Section 2 – About us

Glow is a company registered in England with Company No. 09127663.

Our contact details are:

Company name: Glow Financial Services Limited

Registered Address: 71 Queen Victoria Street London EC4 4AY

Phone Number: +44 (0)207 126 8167

E-mail: dataprotection@glowgfs.com

We are authorised and regulated by the Financial Conduct Authority ( Reference Number: 751308 ). Find out more about us at https://www.glowfinsvs.com/

Brands in UK:

Samsung Finance– Privacy Notice

EE Finance – Privacy Notice

Section 3 - Website Users

3.1 - What and how we collect

Emails submitted by Website users

The information we collect via emails depends on the content of the emails but can include personal information

Careers information

Any application details you submit likely contain personal information. See section 4 below

Device/usage data

IP addresses, device, browser, referrer, pages viewed, timestamps, cookie identifiers. If tracking reasonably identifies you we treat it as personal information and explain in our brand Privacy Policies as appropriate.

3.2 - Who we share it with

Service providers for hosting, security, analytics, site operations.

Group companies that support the corporate website. For information on where Glow processes your information, please see section 9 ‘Where we process your information’.

3.3 - Why we collect it

Where we have a legitimate interest:

to respond to enquires and send requested updates to our Website users;

to operate and secure our Website;

to measure Website performance;

to ensure Website users are able to communicate with us.

Where we have a legal obligation:

to comply with applicable laws and regulations.

3.4 - Retention Period

Emails received are automatically removed from the Website’s email inbox after thirty (30) days. However, depending on the nature of your correspondence, the Retention Period may be longer in accordance with other sections of this Privacy Policy.

‍

Section 4 - Employees and Potential Employees

4.1 – What and how we collect

Employee Information

Recruitment Information

Interview questions and interview notes

Offer Letter

Payroll information

Payroll records (including payroll records, bank account details, P45, tax codes, salary, expenses)

Personnel Files

Copy of passport (or other right to work documentation) and driver’s licence

Redundancy details, calculations of payments and refunds

Sick certificates and self certificates

References

Credit Check results

Criminal Record Check results

Contract of Employment

Confidentiality Letters (including non-disclosure agreements)

Name, Address, personal email and telephone number

PPS Number

Date of birth

Details of next of kin

Qualification certificates

Performance scoring/rating documents

Disciplinary warning and investigations

Grievances

Absence data

Training Completion details

Maternity and Paternity details.

4.2 - Who we share it with

Glow Affiliates:

Glow personnel in other companies within the Glow group may process your personnel information on our behalf. Certain personnel may be based outside of the UK (please see section 9: ‘Where we process your information’).

Payroll Providers:

We share your payroll information and relevant information from your personnel file with our payroll provider which is a third-party provider that supports us in carrying out our payroll activities.

Vetting Agency

We share relevant information from your personnel file with Verifile Vetting Agency in order to verify information we receive from you is accurate.

Regulators

We may share relevant personal information, where we are obligated to do so, with the Financial Conduct Authority (FCA). This may include: passport or driving licence number, credit check results, criminal record check results, name, address, personal email, telephone number, National Insurance number, and disciplinary warnings and investigations (if applicable).

4.3 - Why we collect it

Where we have a legitimate interest:

to establish suitability of potential employees for the role advertised and interviewed for;

to record questions asked during the interview process and to ensure we are compliant with relevant equality and discrimination legislation;

to record what was contractually offered/committed to potential employees; and

to enable payments to be processed and be made.

Where we have a contractual obligation:

to ensure that we as employers are able to perform our contractual duties to our employees;

Where we have a legal obligation:

to comply with the relevant employment legislation.

4.4 - Retention Period

Glow retains job applicant information for up to two (2) years after the date of the application. In order to meet our legal and regulatory requirements, employee records are retained for up to seven (7) years after the date employment ceasing.

Section 5 – Personnel of our Corporate Clients‍

5.1 - What and how we collect

Business Contact information

Your name, surname, title and job role

Your contact details such as your address, email address, telephone number(s)

Information relating to your access and use of our services, including but not limited to:

Your IP address

Your location

Device type

Software used

User name and password

5.2 - Who we share it with

Glow Affiliates:

Glow personnel in other companies within the Glow group may process your personnel information on our behalf. Certain personnel may not be based outside of the UK (please see section 9: ‘Where we process your information’).

Third Party Service Providers:

There may be occasions where our third-party service providers may process personal data for example in providing support to users of our systems.

5.3 - Why we collect it

Where we have a legitimate interest:

to provide our service to our Corporate Client and to fulfil our contractual obligations to our Corporate Clients;

to ensure secure access to our systems; and

for legal and regulatory purposes.

5.4 - Retention Period

We may retain business contact information of Corporate Clients’ personnel for up to seven (7) years following the end of the provision of our services to our Corporate Client.

Section 6 - Third-Parties‍

6.1 - What and how we collect

Business Contact information

Your name, surname, title and job role

Your contact details such as your address, email address, telephone number(s)

Information relating to your access and use of our services, including but not limited to:

Your IP address

Your location

Device type

Software used

User name and password

6.2 - Who we share it with

Glow Affiliates:

Corporate Clients:

There may be occasions where we need to share personal data with our Corporate Client for example where our supplier’s personnel are involved in the provision of services to our Corporate Client.

6.3 - Why we collect it

Where we have a legitimate interest:

to contact our third party service providers, to receive your services and to fulfil our contractual obligations;

to ensure secure access to our systems; and

for legal and regulatory purposes.

6.4 - Retention Period

We may retain business contact information of our service provider’s personnel for up to seven (7) years following the end of the service contract.

Section 7 – How we market Glow's products and services‍

Glow may send you marketing promotions about products and services (including Glow products and services) where you have provided your consent to do so either to us or our Corporate Clients. There may be exceptions where we can inform you about other products or services where we are allowed to do so under DP Law. Where you have provided marketing consent, Glow may share your personal information with our Corporate Client for the purposes of our Corporate Client contacting you with marketing promotions.

Section 8 - How we use automated decision-making‍

We do not use any automated decision-making in relation to our Website users, employees, potential employees, Corporate Clients, or third-parties. Automated decision making that may occur in a consumer loan application context is governed by the relevant brand policy, see section 2.

Section 9– Where we process your information

Glow processes all your information in the United Kingdom (UK) but may need to transfer your information outside the UK to service providers, agents, or subcontractors, and to carry out the fraud prevention services and carrying out Glow’s business activities.

In some cases, data protection laws outside of the UK may not provide the same level of protection as those in the UK, such as in the US. Where we share your personal information with service providers, agents or subcontractors located in a country that has not been approved by the authorities as having a suitably equivalent standard of data protection law, we will use specific contracts (known as Standard Contractual Clauses or the International Data Transfer Agreement) approved for use in the UK, and if necessary additional supplementary measures, which give personal data the same protection it has in the UK.

Financial information, contact information, information relating to your identity and information relating to your access and use of our services (including your IP address, your location, and the device being used) may be processed in the US, Ireland, the Netherlands and Germany.

Please contact our data protection team at dataprotection@glowgfs.com if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

Section 10 – Your legal rights in relation to your information

You have several rights under DP Law that you may wish to exercise. These include the right to:

Access or obtain copies of your personal information;

Rectification, you have the right to request that inaccurate information about you is corrected;

Request restriction of processing concerning you or to object to processing of your personal data;

Request erasure of your personal data where it is no longer necessary for us to retain;

Object to automated decision-making;

Data portability including to obtain personal data in a commonly used machine-readable format in certain circumstances such as where our processing of it is based on your consent;

Withdraw consent to any processing for which you have previously given that consent (regardless of our legitimate interest).

Where you exercise any of your rights, you have the right to be informed about the potential consequences of such exercise. For example, if you ask us to remove all contact details like email addresses and phone numbers, this would mean we have no way to contact you. Where we have a legitimate and lawful basis for the continued processing of your personal data, we are not required to honour a request for erasure.

Please contact us at dataprotection@glowgfs.com if you would like to exercise any of your rights in relation to your personal information. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under DP Law to charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.

We sometimes need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that your personal information is not disclosed to any person who has no right to receive it.

We will act upon the request without undue delay and at the latest within one (1) month of receipt. We may extend the time to respond by a further two (2) months if the request is complex or we have received several requests from the same person. In these circumstances, we will let you know without undue delay and within one (1) month of receiving your request and explain why the extension is necessary.

It is also important that the personal information we hold about you is accurate and current. You need to keep us informed if your personal contact information changes by emailing dataprotection@glowgfs.com.

Without prejudice to any other administrative or judicial remedy you might have, you have the right to lodge a complaint with the Information Commissioner if you consider that we have infringed applicable data privacy laws when processing your personal data. The Information Commissioner’s Office can be contacted using the following link: https://ico.org.uk/.

Section 11 – Keeping you up to date

We keep this Notice under regular review. We may change this Notice from time to time by updating it to reflect changes in the law and/or our privacy practices. The date at the top of this Notice will be updated accordingly and we encourage you to check this from time to time for any updates or changes. We may also contact you to let you know that we have updated the Notice. We may also take that opportunity to ask you if you would like to update your marketing preferences.

Section 12 – Contacting Us

If you have any questions regarding our Privacy Notice, please email us at dataprotection@glowgfs.com.

Section 13 – All changes to this Policy

April 2024:

Adding Section 15 ‘All changes to this Notice’ to summarise all changes that have been made to the Notice.

Providing more detailed information on what information we collect from you and how it is processed to provide you with greater transparency.

Adding more detail to the time periods we hold your personal information for depending on the circumstances and any applicable laws.

January 2025:

Updated Glow's data retention period as disclosed in section 3 & 4.August 2025:

Providing more detailed information on what information we collect from you and how it is processed to provide you with greater transparency.

Adding more detail to the time periods we hold your personal information for depending on the circumstances and any applicable laws.

August 2025:

Providing more detailed information on what information we collect from you and how it is processed to provide you with greater transparency.

Adding more detail to the time periods we hold your personal information for depending on the circumstances and any applicable laws.

‍

Glow Financial Services Limited (“Glow”), 71 Queen Victoria Street, London EC4V 4BE. Registered in England No. 09127663. Glow is authorised and regulated by the Financial Conduct Authority (Reference No. 751308). The register can be accessed through www.fca.org.uk.

*Calls to 03 numbers cost no more than national rate calls to 01 or 02 numbers and count towards any inclusive minutes.

‍