Privacy Policy

This Privacy Notice was last updated on 02 June 2026.

At Tabeo, we are committed to protecting your privacy.

  1. ABOUT US

    1. In this Privacy Notice, reference to “Tabeo”, “we”, “our” or “us” is a reference to the Tabeo group of companies. The Tabeo group includes the UK companies listed below together with their applicable company registration number and relevant registration number under their respective registrations with the Information Commissioner’s Office (“ICO”). The relevant controller (or, in some cases, processor) of your personal information within the Tabeo group will depend on the particular Tabeo product and / or service being provided (further detail is in section 2 below).

      Company Company registration number ICO registration number
      Tabeo Finance Limited 10416530 ZA260247
      Tabeo Tech Limited 10363602 ZA260299
      Tabeo Plans Limited 12712093 ZB148062
      Tabeo AI Limited 16500746 ZC113919

    2. Our registered office address is at 10 Finsbury Square, London EC2A 1AF.

    3. Tabeo Finance Limited is authorised and regulated by the Financial Conduct Authority (“FCA”) under Financial Services Register number 777539.

    4. Tabeo Tech Limited operates the website www.tabeo.co.uk, which provides an online platform (“Platform”) through which Tabeo from time to time offers certain products and services to businesses registered on our platform (“Merchants”) and their customers (“Customers”). These products and services are summarised below.

  2. THIS PRIVACY NOTICE

    1. This Privacy Notice applies to prospective and existing Merchants (including contacts and users of our Platform), Customers, visitors of our Platform and other individuals who we deal with in the course of providing our products and services. This Privacy Notice sets out the basis on which any personal data about you that you provide to us, that we create, or that we obtain about you from other sources (for example, Merchants), will be processed by us. Please read this Privacy Notice to understand our practices regarding your personal data and how we will treat it.

    2. In relation to Customer personal data, where reference is made in this Privacy Notice to our:

      1. Finance or In-House Finance products, Tabeo Finance Limited is generally considered an independent controller together with the relevant Merchant (also an independent controller);

      2. Plans product, Tabeo Plans Limited is the Merchant’s processor;

      3. Px Suite product, Tabeo Tech Limited is the Merchant’s processor; or

      4. AI Conversions product, Tabeo AI Limited is the Merchant’s processor.

    3. Tabeo Tech Limited is also the controller which is responsible for administering the Platform and its users.

    4. As explained above, in certain circumstances and depending on the products and services provided, Tabeo acts as a processor of Customer personal data on behalf of the Merchant, who is the controller. Tabeo generally acts as an independent controller, together with the Merchant (also an independent controller), in relation to the provision by Tabeo of Finance or In-House Finance products. Irrespective of which Tabeo product or service we provide, we have in place contracts with our Merchants which include the appropriate data protection obligations between us. If you are a Customer, we recommend that you also review the privacy policy of the relevant Merchant (which is separate to this Privacy Notice) to understand how the Merchant collects and uses your personal data and if you would like to contact the Merchant to exercise your data privacy rights. Where the Merchant processes your personal information, it remains responsible for complying with all of its obligations under, and liable to you for any damages you suffer due to its breach of, data protection laws applicable to it.

    5. This Privacy Notice is provided only in the English language.

  3. AMENDMENTS TO THE PRIVACY NOTICE

    We may review and, if appropriate, update this Privacy Notice from time to time. We may, if we consider it appropriate, take steps to notify you of any significant updates (including via notification on our Platform). In any case, please visit https://tabeo.co.uk/privacy-policy for the most recent version of this Privacy Notice.

  4. CONTACT US

    If you have any questions about this Privacy Notice or your information, or wish to exercise any of your rights as described in this Privacy Notice, you can contact us as follows:

    By post:

    FAO Data Protection Officer

    Tabeo

    C/O Fox Williams

    10 Finsbury Square

    London

    EC2A 1AF


    By email:
    [email protected]

  5. DATA PROTECTION PRINCIPLES

    1. Where we are the data controller of your personal information, we comply with the core data protection principles as follows:

      1. Lawfulness, fairness and transparency – data must be processed lawfully, fairly and in a transparent manner.

      2. Purpose limitation – data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

      3. Data minimisation – data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

      4. Accuracy – data must be accurate and, where necessary, kept up to date.

      5. Storage limitation – data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

      6. Integrity and confidentiality – data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing (including unauthorised access) and against accidental loss, destruction or damage by using appropriate technical or organisational measures.

    2. This Privacy Notice describes the personal data that we collect and use, and explains how we comply with these principles.

  6. WHAT INFORMATION DO WE COLLECT?

    Technical information we collect

    1. You can browse our Platform as a guest without giving us any information, and we won’t know who you are. However, even if you are a guest, please bear in mind that we may:

      1. record your approximate location and device used during live chats on our Platform, together with any other information you choose to provide to us;

      2. record the areas of our Platform which you visit (such as certain pages) and at what times and for how long;

      3. record information about your activities in using our Platform (such as how you navigated the Platform and what you searched for); and

      4. collect information about your computer or device, such as which browser you are using, your network location, your operating system, your IP address and the type of connection you are using (e.g. broadband, ADSL etc.),

      (referred to as “Technical and Usage Data”).

    2. We may collect the information above by using cookies and other tracking technologies (“Cookies”). Cookies are very small text files that are stored on your device when you visit some websites. Please click here to access our Cookie Policy which explains what Cookies we use on our Platform.

    3. We collect the information at 6.1(a) above through our partner Heap.io. This information is stored by Heap.io on our behalf and processed according to our instructions pursuant to our GDPR-compliant services agreement with Heap.io.

      Information you give to us

    4. You may provide us with personal data when you:

      1. use the Platform (e.g. when filling in forms);

      2. create a Tabeo Account;

      3. enter information onto your Tabeo Account; or

      4. communicate with us whether through the Platform or otherwise.

    5. The information you provide us will largely depend on which Product you interact with. For Products like Finance or In-House Finance, you will likely be asked to provide more information than for other Products like cards. The information we collect may include but is not limited to:

      1. Biographical information, including your name, your date of birth and family circumstances such as your marital status and the number of dependents you have;

      2. Contact details, including your address, postcode, and other contact information such as email address and telephone/mobile number;

      3. Employment, including your employment status and any directorships you may have;

      4. Financial information, including your income, your outgoings, your residential status and whether you own certain assets (like a car) which can impact your likely or assumed expenditure;

      5. Account details, including your passwords and security question answers;

      6. Identification information, including answers to questions required by third party credit reference agencies for identification purposes; and

      7. IT and communications information, including recordings or transcripts of telephone calls you make to Tabeo.

    6. In some circumstances, you may also provide us with minimal information regarding your health when using certain of our Products, including:

      1. details regarding the treatment you require; and

      2. any other information which you voluntarily provide, for example in connection with a complaint from you,

      (“Health Data”).

    7. If you apply for any Products on behalf of another individual, it is not reasonably practicable for us to provide to them the information set out in this Privacy Notice. Accordingly, you confirm that you are authorised to provide to us the personal information of others which we shall process, that your provision of this personal information to us is lawful under data protection laws and that you have duly provided any required information or notices to those individuals.

    8. We may anonymise and aggregate any of the personal information we collect about you (so that it does not directly identify you). We may use anonymised information for purposes that include testing our IT systems, research, data analysis, improving our Platform and Products and developing new products and features. We may also share such anonymised information with third parties.

  7. PAYMENT SERVICES PARTNERS

    1. Tabeo handles minimal payment information. We can only view card information in a tokenised or redacted format. The Platform uses certain secure third party payment service providers in order to provide our Products and to effect payments to and from Tabeo. These providers will have the necessary regulatory licences which Tabeo may not have but which are needed to deliver the Product.

    2. Further information regarding our third party service providers can be found in the table in Annex 1 at the end of this Privacy Notice.

  8. INFORMATION FROM OTHER SOURCES

    1. We may obtain information about you from publicly available sources and third parties such as Open Banking and (in the case of Merchants only) social media platforms.

    2. We will also check information about you held on our own records and also obtain information from credit reference agencies and fraud prevention agencies about you relating to your personal credit behaviour and personal credit accounts. Further detail about our use of these agencies can be found in the ‘Who do we share your information with?’ section below.

    3. Records searched at credit reference agencies about you may be linked to your spouse/partner, members of your household or other persons to whom you are linked financially. For the purposes of any application or your agreement with us, you may be treated as financially linked and you will be assessed with reference to ‘associated records’.

    4. We work with some Merchants who are private healthcare providers, who may provide us with limited Health Data about you, in respect of a treatment you have financed or paid for by or through the Products. The Health Data we collect may be considered special category personal data under applicable data protection laws. We may also be provided with such limited Health Data by such Merchants should they contact us in relation to such finance or payment.

  9. IF YOU FAIL TO PROVIDE PERSONAL DATA

    Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you in relation to the Products. In this case, we may have to cancel a Product or service you have with us but we will notify you if this is the case at the time.

  10. WHAT WE DO WITH THE INFORMATION WE COLLECT

    1. As a data controller, we will only use your personal information if we have a legal basis for doing so. The purposes for which we use and process your information and the legal basis on which we carry out each type of processing are explained in the table below.

      Type of data Purposes for which we will process the information Legal basis for processing
      Biographical information, contact details, account details To provide the Platform to you and provide you with any Products you request from us through the Platform. Performance of a contract. Where not applicable, on the basis of our legitimate interests to provide the Platform and Products.
      Contact details To send you marketing communications and provide details of the Products and services which you may be interested in. Either your consent or, where consent is not required under applicable law, on the basis of our legitimate interests to raise awareness of Tabeo and its Product offering.
      Contact details, Technical and Usage Data To deliver to you any administrative notices, alerts and communications relevant to your use of the Products. It is in our legitimate interests to ensure that any changes to our policies, terms and other such technical updates are communicated to you, or compliance with a legal obligation.
      Technical and Usage Data To enrich your experience and interaction with our Platform by allowing us to store or access your details so that your preferences are retained when you revisit our Platform. Either your consent or, where consent is not required under applicable law, on the basis of our legitimate interests to improve our online services and raise awareness of Tabeo and its Product offering.
      Technical and Usage Data, IT and communications information, biographical information, account details and identification information To troubleshoot problems, and to help protect you against fraud or other criminal activity. It is in our legitimate interests to carry out such checks to ensure prevention against fraud and other harmful activity and that the Platform are safe and secure.
      Financial information (including credit reference checks), identification information, biographical information, employment and education information To carry out financial and identity checks, fraud prevention checks, regulatory checks and credit checks (including, if you are a Merchant, on your directors, officers and certain controlling shareholders). Performance of a contract or compliance with a legal obligation. Otherwise, it is in your and our legitimate interests that we carry out credit, fraud and similar checks for suspicious activity, creditworthiness or similar, assess eligibility for our Products, to prevent you and us being defrauded and for the prevention of unlawful activity.
      Account information, biographical information, employment information To set up and manage your Tabeo Account and update the records we hold about you from time to time Performance of a contract or compliance with a legal obligation (as applicable). Where not applicable, on the basis of our legitimate interests to manage your account with us.
      Biographical information, contact details, identification information In respect of Customers using our Products, if you do not repay money you have borrowed, to take steps to recover the money including trace your whereabouts and recover debts or enforce a Finance loan agreement. It is in our legitimate interests to recover any sums that you owe us.
      Contact details, biographical information, IT and communications information, account details For customer service, including answering questions and responding to feedback and complaints. It is in our legitimate interests to respond to your queries and resolve your complaints to maintain our reputation.
      Contact details, account details To contact you to help us with market research. It is in our legitimate interests to request your feedback, or invite you to participate in a research (or similar) project in order to improve our services, better understand the needs of our clients and customers, enhance the user experience and grow our brand.
      Technical and Usage Data To maintain and administer the Platform, including for the purposes of:
      • Analysing the Platform and mobile application usage and improve our services;
      • Statistical and modelling purposes including lifecycle modelling, stress testing, fraud modelling, product development, statistical analysis, market research and to improve our products and services
      		Consent, compliance with legal obligations (like the Consumer Duty). Otherwise, it is in our legitimate interests to improve our products and services and raise awareness of Tabeo.
      Contact details To provide you with information about goods or services offered by other companies that we consider may interest you Consent

    2. Depending on the Products you sign up for, we may need to process certain limited Health Data to provide you with our services. The Health Data we collect may fall within the meaning of “special category data” (sometimes referred to as sensitive data) under data protection laws, which means that it is afforded a higher degree of protection than regular personal data. However, we will collect only minimal Health Data. Where you voluntarily provide us with Health Data (for example, as part of a complaint) we will process it on the basis of your explicit consent. Where we are required to process Health Data in order to meet our obligations under FCA, consumer and/or similar regulatory requirements, we will process it on the basis of substantial public interest under applicable data protection laws. In either case, we will only process your Health Data to the extent necessary for the relevant purpose.

    3. If you have provided your consent to any of the processing referred to above, you can withdraw your consent at any time, but without affecting the lawfulness of processing based on consent before its withdrawal.

  11. WHO DO WE SHARE YOUR INFORMATION WITH?

    1. We may share your personal data when there is a legitimate reason to do so, and as required for the reasons set out in this Privacy Notice, for example:

      1. with Merchants so that they can contact you in relation to the relevant Products you are using with them;

      2. with vendors and other third parties performing services on our behalf who will only use the information to provide that service. Such services may include providing communications, market research and feedback requesting, payment processing verification, financial and related checks, advertising, fraud prevention, Platform and web hosting, IT maintenance and support, payment gateway and analytics. Further information regarding our third party service providers can be found in the table in Annex 1 at the end of this Privacy Notice;

      3. with practice management software providers used by Merchants and where our Products include passing data from Tabeo to those practice management software providers (each acting as data processors of the Merchant) for the purpose of the Merchant providing goods and services to you;

      4. with other members of our corporate group;

      5. with third party funders who provide advances under Finance loan agreements;

      6. with our business partners where this is necessary to provide our Products or otherwise where it is necessary in the normal course of our business;

      7. with our lawyers, accountants, insurers and other professional advisors (for example, to defend ourselves against legal claims);

      8. if we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer; and

      9. if we are acquired by a third party, personal data held by us about you will be disclosed to the third-party buyer.

    2. We will also add to your record with the credit reference agencies details of our Finance loan agreement with you, the payments you make under it, and any default or failure to keep to the terms.

    3. In some circumstances, we may have to disclose your personal data by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or personal safety of Tabeo, its customers, its users or others.

      What if you’re a borrower under our Finance or In-House Finance products?

    4. If you are a borrower under any of our Finance or In-House Finance products, we may share your personal data with third parties for the purposes of:

      1. checking details on applications for credit and other facilities;

      2. collecting money owed by you under the relevant loan agreement; and

      3. recovering debts owed by you under the relevant loan agreement.

    5. In addition, we may disclose your personal data to:

      1. credit reference and fraud prevention agencies to perform similar checks, trace your whereabouts and recover debts you owe. This may include details of your loans on the Platform, how you manage them and any amounts outstanding; and

      2. debt collection agencies and other legal representatives if required to enforce the terms of any loan agreement.

      What do credit reference and fraud prevention agencies do?

    6. This section of the Privacy Notice explains how your personal data will be used by credit reference and fraud prevention agencies.

    7. When a credit reference agency receives a search from us they will:

      1. make an administrative call with regard to your credit file without leaving a “footprint” on your credit score;

      2. place a credit search “footprint” on your credit file once you have entered into a loan agreement. If the search was for a credit application the record of that search (but not the name of the organisation that carried it out) may be seen by other organisations when you apply for credit in the future; and

      3. link together the previous and subsequent names advised by you, of anyone that is a party to the account.

    8. Credit reference agencies will supply the following information to us:

      1. information about your credit file, including your credit score;

      2. information about you, such as previous applications for credit and similar personal credit information in your name, payment history (including any missed payments), and details of any financial sanctions imposed by the United Kingdom government which are applicable to you;

      3. public information such as County Court Judgments (CCJs) and bankruptcies;

      4. electoral register information on you;

      5. your address history, including how long you have lived at each address;

      6. information about people linked to your credit file; and

      7. fraud prevention information.

    9. Credit reference agencies will keep records of outstanding debt on file for six years after they are closed, whether settled by you or defaulted.

    10. The information which we and other organisations provide to the credit reference agencies and fraud prevention agencies about you may be supplied by such parties to other organisations and used by them to:

      1. prevent crime, fraud and money laundering by, for example checking details provided on applications for credit and credit related or other facilities;

      2. check the operation of credit and credit-related accounts;

      3. verify your identity if you apply for additional Products;

      4. make decisions on credit and credit related services about you;

      5. manage your personal account(s);

      6. trace your whereabouts and recover debts that you owe;

      7. conduct other checks to prevent or detect fraud; and

      8. undertake statistical analysis and system testing.

    11. The identities of the credit reference agencies, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal data, data retention periods and your data protection rights with the credit reference agencies are explained in more detail in their respective Credit Reference Agency Information Notice (‘CRAIN’), which may be accessed via the links to the CRAs detailed below.

      1. Transunion: https://www.transunion.co.uk/crain

      2. Equifax: https://www.equifax.co.uk/privacy-hub/crain

    12. If false or inaccurate information is provided by you and fraud is identified we will record this and details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

      1. checking details on applications for credit and credit related or other facilities;

      2. managing credit and credit related accounts or facilities;

      3. recovering debt;

      4. checking details on proposals and claims for all types of insurance; and

      5. checking details of job applicants and employees.

    13. Please contact us if you want to receive details of the relevant fraud prevention agencies.

    14. We and other organisations may access and use the information about you recorded by fraud prevention agencies from other countries.

  12. TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

    1. The personal data that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (“UK”) and European Economic Area (“EEA”). It may also be processed by staff operating outside of the UK and EEA who work for our affiliates or for one of our suppliers.

    2. Where we transfer your personal data outside the UK and the EEA, we will ensure that it is safe and protected in a manner that is consistent with how your personal data would be protected by us in the UK. This can be done in several ways, for instance:

      1. the country that we send the data to might be approved by the European Commission or UK government (as applicable) as having in place an adequate level of protection for personal data in relation to the transfer; or

      2. we may adopt appropriate safeguards, including ensuring that the recipient has entered into a contract containing standard contractual clauses adopted by the European Commission and / or UK government (as applicable), obliging the recipient to protect your personal data to the appropriate standard.

    3. In other circumstances the law may permit us to otherwise transfer your personal data outside the UK and the EEA. In all cases, however, we will ensure that any transfer of your personal data is compliant with data protection law.

  13. MARKETING AND COMMUNICATIONS

    1. We would like to provide you with information about our products, services, promotions, special offers and other information (including related products and services of our partners such as insurance or financial planning) which we think you may find interesting.

    2. We may send you these marketing messages by phone, email, SMS and/or to your Tabeo Account.

    3. We will only send you marketing messages if you have given us your consent to do so, unless consent is not required under applicable law. Where you provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of our processing based on consent before its withdrawal. In any case, you have the right to opt out of receiving electronic marketing communications from us by clicking on the ‘unsubscribe’ link at the bottom of our marketing communications, or contacting us using the details in the ‘Contact Us’ section above.

  14. DATA RETENTION

    1. We will store the personal data we collect about you for no longer than necessary for the purposes set out in this Privacy Notice in accordance with our legal obligations and legitimate business interests. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, as well as the applicable legal, regulatory, tax, accounting or other requirements.

    2. If you are a Customer, we generally hold your data for 6 years after the end of our relationship with you. For example, 6 years after your loan is terminated, or your application is declined, or from our last contact with you regarding your application or agreement. Your data is held for this long in accordance with the criteria set out above, including to:

      1. align with statutory limitation periods in which you or we may bring a claim under our agreement with you;

      2. comply with legal obligations (for example our financial regulatory obligations);

      3. for our legitimate interests, for example if you attempt to apply chargebacks of any payment you make; and

      4. aggregate customer data for statistical and modelling purposes including lifecycle modelling, stress testing and fraud modelling.

  15. YOUR RIGHTS

    1. In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

      1. Right of access. You have the right to obtain access to your personal information.

      2. Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.

      3. Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.

      4. Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.

      5. Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.

      6. Right to object. You have a right to object to any processing based on our legitimate interests in certain circumstances. You can also object to our direct marketing activities for any reason by clicking the “unsubscribe” link set out in any marketing communication you receive.

      7. Right to withdraw consent. If you have provided consent to any processing of your personal information, you have a right to withdraw that consent but without affecting the lawfulness of processing based on consent before its withdrawal.

    2. Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply. We may refuse a request for erasure, for example, where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise or defence of legal claims.

  16. EXERCISING YOUR RIGHTS

    1. You can exercise any of your rights as described in this Privacy Notice and under data protection laws by contacting the Data Protection Officer using the contact details set out at the beginning of this Privacy Notice.

    2. Save as provided under applicable data protection laws, there is no charge for the exercise of your legal rights. However, if your request is manifestly unfounded or excessive, in particular because of its repetitive character, we may either: (a) charge a reasonable fee (subject to any limits imposed by applicable law) taking into account the administrative costs of providing the information or taking the action requested; or (b) refuse to act on the request.

    3. Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm your identity. We may also contact you to ask you for further information in relation to your request to assist with our response. It will help us to process your request if you clearly state which right you wish to exercise, what personal information it is that is of particular concern to you and, where appropriate, why it is that you are exercising it.

    4. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or if we have received a number of requests. In this case, we will notify you and keep you updated.

  17. AUTOMATED DECISION-MAKING

    1. We sometimes use algorithms to make decisions on our behalf. This is referred to as automated decision-making. We use automated decision-making for the following purposes:

      1. To assess your application for an account. Our, or our third party service providers’, algorithms assess your suitability for an account with us based on information such as your financial position and other circumstances, such as the results of anti-money laundering and sanctions checks. This means that we may automatically decide that you present a fraud or money-laundering risk, risk of suspicious activity that risks Tabeo, its staff, customers and others or pose a risk to us in terms of breaking financial sanctions, in which case we will reject your application for an account.

      2. To determine creditworthiness and affordability. This is based on the information we collect such as financial information, identification information and biographical information. We may also use open banking data, collected and provided to us by third parties. We use this to decide how easily you will be able to manage repaying credit and the interest rate we may charge you. We may compare you with other people in a set (for example, people who are in a certain age bracket may be more likely to be able to manage credit).

      3. To prevent and detect fraud. Our algorithms may freeze a transaction or account if we suspect fraud or money-laundering against Tabeo, our staff or our customers. Such decisions are based on patterns in our data, such as a Product being used in a way that fraudsters work.

    2. Subject to any applicable law or regulatory requirement which provides otherwise, you can ask for a member of our team to review an automated decision, including if your application for a Tabeo account was rejected using automated decision-making, using the contact details set out at the beginning of this Privacy Notice.

  18. COMPLAINTS

    1. If you feel that you would like to make a complaint regarding our use of your personal data, you have the right to take your complaint to the Information Commissioner’s Office (“ICO”) or other applicable data protection supervisory authority. Where you have the right to take your complaint to the ICO, you can report a concern with the ICO by following this link https://ico.org.uk/concerns/ or by calling them on 0303 123 1113.

    2. We would, however, appreciate the chance to deal with your concerns before you approach the regulator so please contact us (using the contact details set out at the beginning of this Privacy Notice). Where we receive a complaint relating to the processing of your personal data, we will acknowledge receipt of the complaint no later than 30 days from when we received the complaint and, without undue delay, take appropriate steps (making enquiries into the subject matter of the complaint, to the extent appropriate) to respond to the complaint, keeping you up-to-date on the progress and informing you of the outcome of the complaint.

  19. SECURITY

    1. We are committed to ensuring that your information is secure. In order to prevent unauthorised or accidental access, destruction, loss, alteration, damage or disclosure we have put in place appropriate physical, technical and organisational measures to safeguard and secure the information we collect online. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted online.

    2. Where appropriate, we use pseudonymisation and / or encryption to protect your information.

    3. Where data processing is carried out on our behalf by a third party, we will endeavour to ensure that appropriate security measures are in place including to prevent unauthorised disclosure of personal data.

  20. LINKING

    1. The Platform, and any of our other online services, may from time to time make use of third party solution providers either via direct sourcing of data or via use of third party applications. Your use of those applications is subject to their own privacy policies, which may be amended from time to time. Generally, if you follow a link to any third party website, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

Annex 1: Tabeo’s service providers

The table below provides a list of our service providers that process personal data in relation to the provision of our Products, together with a description of each provider’s respective role. Despite the indication below, a provider may act as either processor or controller, depending on the particular processing activity.

Provider Role Privacy Notice Controller or processor
Stripe We use Stripe for payment, analytics, and other business services. https://stripe.com/privacy Controller or processor (depending on activity)
GoCardless We use GoCardless for payment, analytics and other business services. https://gocardless.com/legal/privacy Controller or processor (depending on activity)
Onfido We use Onfido for ID and KYC checks https://onfido.com/privacy/ Processor
Tink We use Tink for financial checks authorised by you using Open Banking https://tink.com/legal/privacy-and-security/ Processor
Hubspot We use Hubspot for multi-channel outbound and inbound communications https://legal.hubspot.com/privacy-policy Processor
Sendgrid We use Sendgrid for outbound SMS and email communications https://www.twilio.com/en-us/legal/privacy Processor
Clicksend We use Clicksend for outbound SMS and postal communications https://www.clicksend.com/gb/legal/privacy-policy Processor
Aircall We use Aircall for inbound and outbound phone communications https://aircall.io/en-gb/privacy/ Processor
GCP We use Google Cloud Platform as our cloud computing software https://cloud.google.com/terms/cloud-privacy-notice Processor
AWS We use Amazon Web Services as our cloud computing software https://aws.amazon.com/privacy/ Processor
Open AI We use OpenAI for certain AI voice activation, recording and transcription services https://openai.com/policies/row-privacy-policy/ Processor