Privacy Policy

At GoGoProp, we put your privacy first. This policy tells you what information we collect, why we need it, and what you can ask us to do with your data.

We only collect the data we need to assess your loan and meet the rules we operate under. We do not sell your data. Where we do share it, section 6 names exactly who receives it and why.

If you have any questions, email us at support@gogoprop.com. Our team will answer your enquiry within 48 hours.

1. Who we are

GoGoProp is a digital provider of short-term bridging finance to overseas buyers of UK real estate for buy-to-let purposes.

The GoGoProp platform is run by the GoGoProp group of companies ("GoGoProp", "we", "us", "our"). Which company handles your data depends on your location and the service you use.

If you have questions about your data, contact us at support@gogoprop.com.

2. Who this policy is for

This policy applies to the following parties who use the GoGoProp platform:

• Borrowers and prospective borrowers: You send us an enquiry or a loan application.
• Brokers, introducers and other intermediaries: You submit or manage deals for your clients.
• Directors, shareholders and beneficial owners: Your details are required as part of a loan application, even if you are not the borrower yourself. Section 4 explains how we obtain your data.
• GoGoProp staff and authorised users: You access the platform's internal command centre.

3. What we collect

We collect only what we need to review your deal and meet our legal duties. Here is the full list:

Most of the information we ask for is either required by law or needed to enter a loan agreement with you. If you do not provide it, we will not be able to assess or complete your application.

4. Where your data comes from

Most of the data we hold comes directly from you, or from the broker acting for you.

We also receive data about you from other sources:

• The applicant or their broker: If you are a director, shareholder or beneficial owner connected to an application, we usually receive your details from the person applying rather than from you.
• Our verification providers: Cynopsis returns the results of identity and background checks (see Section 5).
• Our property data providers: HomeTrack and Property Data supply valuation and property information.
• Public registers and sources: Companies House, HM Land Registry, official sanctions lists and public news reports.

If we did not get your data from you, we will contact you within one month of receiving your data to tell you we hold it, what we hold, and where it came from. You have the same rights over that data as anyone else. Section 12 sets them out.

5. Identity checks and biometric data

Before we can lend to you, the law requires us to confirm your identity and check your background. We use a specialist provider, Cynopsis Solutions ("Cynopsis"), to run these checks.

The checks cover:

• KYC (Know Your Customer): confirming your identity is real and matches your documents
• AML (Anti-Money Laundering): checking that funds are not linked to financial crime
• PEP (Politically Exposed Person): checking whether you hold a prominent public position, which carries extra risk under the rules we follow
• Sanctions and adverse media: checking official sanctions lists and public news reports

When an identity check is needed, the platform creates a secure link and sends you to Cynopsis's own system to complete it.

Any biometric data (such as a face scan or liveness test) and identity documents you provide during the check are collected and managed by Cynopsis directly, under its own privacy notice and terms. GoGoProp does not collect, store, or receive your raw biometric data through the platform.

What we receive from Cynopsis is the result: whether the check passed, and whether anything was flagged. We use this result to process your loan application and meet our legal anti-money-laundering duties.

Some of the data we process, like a possible criminal-record match from a sanctions or news check, is considered sensitive under any applicable data-protection law. We handle this data only where permitted. This usually means either meeting our legal duties to prevent money laundering, financial crime, and fraud, or handling a legal claim.

We suggest you read Cynopsis's privacy notice before you complete a check.

6. Why we use your data

Under UK data-protection law (UK GDPR), and under Hong Kong's Personal Data (Privacy) Ordinance if you are in Hong Kong, we must have a valid legal reason for every way we use your data. Here are our reasons, listed by purpose:

"Legitimate interests" means we have a real business reason and have made sure it does not override your rights.

Where we rely on your consent, such as for marketing or non-essential cookies, you can withdraw it at any time.

7. Who we share your data with

We share your data only where it is necessary, and only with:

• Verification and data providers. Cynopsis for identity and AML checks, HomeTrack for automated property valuations, and Property Data for property intelligence.
• Brokers and introducers. Only where they are linked to your deal, and only the information they need to manage it.
• Professional advisers. Solicitors, valuers, accountants and auditors.
• Funding and banking partners. Where they are involved in completing or servicing your loan.
• Regulators and authorities. Including the FCA, HMRC, the Hong Kong authorities and others, where the law requires it.
• Technology and hosting providers. They run the platform's infrastructure for us, under contract.

We do not sell your personal data. We never have, and we have no plans to.

8. Sending data between countries

GoGoProp operates across the United Kingdom and Hong Kong, and we work with clients worldwide. This means your data may move between these countries and others.

When we send personal data outside the UK, we use safeguards approved by UK data-protection law. These are usually one of the following:

• the UK International Data Transfer Agreement (IDTA)
• the UK Addendum to the EU Standard Contractual Clauses
• a transfer to a country the UK government has formally approved as having adequate protection

You can ask for copies of the safeguards that apply to you by emailing support@gogoprop.com.

9. How long we keep your data

We keep your data only as long as we need it, and as long as the law requires.

Records from identity, KYC and AML checks are generally kept for at least five years after our business relationship ends, or a transaction completes. Anti-money-laundering law sets that period, so we cannot delete this data earlier even if you ask.

Where we no longer need your data, we securely delete it or make it anonymous.

10. Your data rights

Under UK GDPR, you have the right to ask us to:

• Give you a copy of the personal data we hold about you;
• Correct wrong or incomplete data;
• Delete your data (subject to our legal retention obligations);
• Pause our use of it while we look into a concern you have raised;
• Object to us using it, where we rely on legitimate interests;
• Provide the information you gave us in a format you can pass to another provider;
• Withdraw your consent at any time, where we rely on it.

If you are in Hong Kong, the Personal Data (Privacy) Ordinance gives you the right to access and correct your data. Everything above still applies wherever possible.

To make a request, email support@gogoprop.com. We will ask you to confirm your identity first, so no one else can access your data. We aim to reply within one month.

Note that as a regulated lender, we are legally required to keep certain records, particularly around identity and anti-money-laundering checks. If you ask us to delete data that falls into that category, we will explain what we must keep and why.

11. How we protect your data

Security is built into the platform from the start. In practice, this means:

• Encryption: We encrypt your data when it travels and when we store it.
• Limited access: Only staff who need your data to do their job can see it.
• Vetted partners: Every provider who handles data for us works under a written contract with defined security duties.
• Monitoring: We track platform activity and logins so we can spot anything unusual.
• Separation of sensitive data: Biometric data stays with Cynopsis and never reaches our systems (see section 4).
• Regular review: We test and review our security controls as our business and the threats around it change.

No system can guarantee perfect security, and we will not claim otherwise. What we can say is that we treat your data as seriously as we treat your money.

12. Cookies

Cookies are small files that a website stores on your device. We use three types:

• Essential cookies. These keep you logged in and keep the platform secure. The site cannot work without them.
• Analytics cookies. These show us how people use the platform so we can improve it.
• Marketing cookies. These measure how our campaigns perform.

We use cookies to keep the platform working, to understand how people use it, and to measure our marketing. You control everything except the essential ones. See our Cookies Policy for the full list.

13. Changes to this policy

We update this policy when our services, partners, or legal duties change. The date at the top always shows the latest version.

If we make a change that significantly affects how we use your data, we will tell you directly instead of expecting you to notice.

14. Contact and complaints

For anything about your data, contact us via our email support@gogoprop.com or by post at the relevant registered address in Section 1. Tell us what you need, and we will come back to you.

If you are not happy with our answer, you can complain to a relevant data-protection authority:

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk, helpline 0303 123 1113
• Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD), pcpd.org.hk