Privacy Policy

Last updated: 20 October 2026

Step Exchange Ltd ("StepEx", "we", "us", or "our") is committed to protecting your personal data and being transparent about how we use it.

This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with us, our website, or our services.

1. Who we are

StepEx is the trading name of two companies in the same group. Both are controllers of personal data, each for the processing listed against it in the table below. In this policy "StepEx", "we", "us" and "our" mean the company that is the controller of the processing being described.

Where Step Exchange Ltd runs the systems that hold StepEx Lender Ltd's applicant and borrower data, it does so on StepEx Lender Ltd's instructions and under a written agreement between the two companies.

• Registered address for both companies: StepEx, Complete HQ, 2 Bridge Court, Kingsmill Road, Saltash, Cornwall, United Kingdom, PL12 6LS
• Privacy contact for both companies: info@stepex.co

2. The personal data we collect

Depending on how you interact with us, we may collect:

• Contact information (e.g. name, email address, phone number)
• Financial information (e.g. income information, repayment history)
• Bank transaction data, where you choose to provide access via Open Banking
• Credit reference data obtained from credit reference agencies
• Identity and verification data (e.g. date of birth and identity checks where required)
• Technical data (e.g. IP address, device and browser information)
• Usage data (e.g. how you use our website or services)
• Communications (e.g. emails or messages you send us)
• Information about the course and the fees your finance relates to: the course, its start and end dates, the fees and any deposit, confirmation of the offer or place, enrolment and attendance status, any withdrawal, deferral or change of course, completion or graduation, and any refund.
• Where the finance is for someone else's course, the details of the student that we need to verify the place and settle the fees.
• Information about your finance agreement and your payments: amounts due, invoices, Direct Debit collections, whether payments are up to date, any arrears, any income declarations and evidence you give us under an income-linked agreement, and settlement.
• Information about your health or circumstances that you choose to tell us, so that we can support you (see below).

We only collect personal data that is relevant and necessary for the purposes described below.

Where we get it from. Most of this information comes from you. We also receive it from the education provider whose course your finance relates to, from credit reference and fraud prevention agencies, and, where you authorise it, from HM Revenue & Customs, your employer or your bank (including through Open Banking).

Health and circumstances. If you tell us about your health or other circumstances that affect how you deal with us or your ability to pay, we record what we need to support you and to treat you fairly. We use it only for that purpose, share it only where we need to in order to help you, and rely on your explicit consent or on the legal condition that allows us to protect the economic well-being of people who may be at risk.

What you must give us. You must give us the information we ask for in a finance application, and the information your finance agreement requires. If you do not, we may not be able to consider your application or provide finance, and under an agreement it may be a breach, as your agreement explains. Other information is optional and we will tell you when it is.

3. How we use your personal data

We use personal data to:

• provide and administer our services
• assess eligibility and affordability for education finance
• meet legal and regulatory obligations (including anti-money laundering and fraud prevention)
• manage customer relationships and support enquiries
• improve our products, services, and risk models
• operate, secure, and improve our website
• verify the details in your finance application with the education provider, including the course, the fees, any deposit and the student's place
• arrange and confirm the settlement of the course fees with the education provider
• keep the education provider informed of the status of your finance agreement and of your payments
• handle refunds, complaints and disputes about the course or the fees
• support you if your circumstances change or you are in financial difficulty
• collect what you owe, including through debt collection agencies, solicitors and the courts if you do not pay
• transfer or assign finance agreements, or raise funding against them, as the agreement allows

4. Legal basis for processing

We process personal data where we have a lawful basis to do so, including:

• Contract: Processing is necessary to perform a contract with you or take steps at your request before entering into a contract.
• Legal obligation: Processing is necessary to comply with legal or regulatory requirements.
• Legitimate interests: Processing is necessary for our legitimate interests (or those of a third party), provided your rights do not override those interests.
• Consent: Where you have given consent for specific processing activities.

Where we rely on legitimate interests, they are: administering finance for courses at education providers, including verifying applications, settling fees and keeping providers informed of the status of agreements and payments; preventing fraud and managing credit risk; collecting what is owed to us; funding, transferring or assigning agreements; improving our products and risk models; running the StepEx group, including sharing personal data within it for administration and to operate the platform; and running and securing our website and platform. You can object to processing based on legitimate interests (see "Your rights"). Where we rely on your consent, you can withdraw it at any time by contacting us; this does not affect processing before you withdrew it.

5. Who we share your personal data with

We share personal data with the following recipients, and only for the purposes described in this policy.

Companies in the StepEx group. StepEx Lender Ltd and Step Exchange Ltd share personal data with each other where that is needed to run this website and the StepEx platform, to process finance applications, to provide support, to manage finance agreements and to administer the group. Each company uses the data only for the processing it is responsible for, as set out in section 1.

Education providers. If your finance is for fees at an education provider, or you apply through a provider's StepEx finance page, we share personal data with that provider, and the provider shares personal data with us, so that we can:

• verify the details in your application, including the course, the fees, any deposit and the student's place on the course;
• arrange and confirm the settlement of the fees;
• keep the provider informed of the status of your agreement and of your payments, including whether the agreement is in force, whether your payments are up to date, and whether the agreement has been withdrawn from, ended or settled;
• handle refunds, complaints and disputes about the course or the fees; and
• manage our arrangements with the provider, including reconciling payments and reporting to the provider under our agreement with them.

This can include your name and contact details, application and agreement references, the course and the fees, the amount financed, the status of your agreement and your payment status. Under an income-linked agreement, a month in which no repayment is due is not reported as a missed payment. We do not give the provider your credit file, your credit score or the details of our credit and affordability assessment. Where the provider has chosen to set its own eligibility rules for a course, we tell it which of three likelihood-to-repay bands (high, medium or low) we have placed your application in, so that it can apply those rules; this is StepEx's own classification, not information from a credit reference agency. Where the finance is for someone else's course, the provider receives the details of the person paying and we receive the details of the student. We may also share this information with the provider's agents and advisers. Sharing continues after your agreement ends for as long as it is needed for these purposes. The education provider is a separate controller of the personal data it holds, and its own privacy notice applies to what it does with it.

Credit reference and fraud prevention agencies. When you apply, and while your agreement runs, we exchange information with Experian, a credit reference agency, and with fraud prevention agencies, to verify your identity, assess your application and manage your agreement. If you do not pay, we may record that with Experian, which can affect your credit rating and make credit harder or more expensive to obtain. Experian's Credit Reference Agency Information Notice explains how it uses and shares personal data: https://www.experian.co.uk/legal/crain/ Fraud prevention agencies may use your data to prevent fraud and money laundering, which can lead to us or others refusing to provide services or finance.

Identity, income and payment services. Providers of identity verification, Open Banking (if you choose to connect your bank account), Direct Debit and payment processing, and electronic signature services.

Our service providers. Companies that host our website and platform, store our data, send our communications, schedule calls and run our customer-support systems. They act on our instructions and may only use your data to provide their services to us.

Funders, assignees and prospective purchasers. If we transfer, assign, charge or securitise finance agreements, or raise funding against them, the other party and its advisers receive the information needed for that purpose, as your agreement allows.

Debt collection and legal recovery. If you do not pay, debt collection agencies, solicitors and the courts.

Personal representatives. If a borrower dies, the personal representatives of their estate, so that the agreement can be dealt with.

Regulators and authorities. The Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner's Office, HM Revenue & Customs, law enforcement and other authorities, where we are required or permitted to share information with them.

Professional advisers. Our auditors, accountants, lawyers and insurers.

Independent review platform. As described in section 8.

6. How long we keep your personal data

We keep personal data for as long as we need it for the purposes described in this policy and to meet our legal and regulatory duties. For a finance application that does not go ahead, that is the period needed to deal with any query, complaint or dispute about the decision and to meet our record-keeping duties. For a finance agreement, it is the life of the agreement and 7 years after it ends, to meet our record-keeping duties as a regulated lender and the time limits for legal claims. When we no longer need personal data we delete it or anonymise it.

7. Your rights

Under UK data protection law, you have rights including:

• The right to access your personal data
• The right to rectification of inaccurate data
• The right to erasure in certain circumstances
• The right to restrict processing
• The right to data portability
• The right to object to processing
• The right to withdraw consent, where we rely on consent

You can make any of these requests to either company at the privacy contact in section 1, and we will pass it to the right one.

To exercise any of these rights, please contact us at info@stepex.co.

8. Independent reviews

We may invite you to provide feedback about your experience with StepEx through an independent customer review platform.

If we do so, we may share limited personal information, including your name, email address and a reference relating to your application or agreement, solely for the purpose of sending you a review invitation. We only share the minimum personal information necessary for this purpose and require our service providers to process your personal information in accordance with applicable data protection laws.

9. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Email: info@stepex.co
Address: StepEx, Complete HQ, 2 Bridge Court, Kingsmill Road, Saltash, Cornwall, United Kingdom, PL12 6LS

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed.