1. Who we are
Easther Trading is the data controller for the information described in this policy. That means we decide what personal data is collected and what it is used for, and we are accountable for protecting it.
Our address:
123 Main St, City, Country
Privacy enquiries: support@easthertradingpty.com
2. The information we collect
Information you give us
| Category | Examples | When |
|---|---|---|
| Identity | Name, date of birth, government ID document, selfie | Registration and KYC verification |
| Contact | Email address, phone number, postal address | Registration and profile updates |
| Financial | Income evidence, bank statements, loan purpose, requested amount | When you apply for a loan |
| Correspondence | Support tickets, replies, questions asked in the help widget | When you contact us |
Information collected automatically
- Login records — the IP address, browser and time of each sign-in attempt, successful or not. This is a security measure that lets us detect unauthorised access to your account.
- Usage data — which pages you visit and what you search for in the help centre, so we can improve them.
- Cookies — described in full in our Cookie Policy.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract |
| Assessing a loan application and affordability | Performance of a contract; legitimate interests |
| Verifying your identity (KYC) and preventing fraud | Legal obligation |
| Keeping financial and transaction records | Legal obligation |
| Providing customer support | Performance of a contract |
| Improving the service and our help content | Legitimate interests |
| Sending marketing emails | Consent — which you may withdraw at any time |
4. Automated decision-making
Applications may be assessed with the assistance of automated checks. We do not make final lending decisions by automated means alone. A person reviews the outcome before an application is declined, and you may ask for the reasoning behind any decision that affects you.
Our help assistant answers questions using published help-centre content. It has no access to your account, your application or your documents, and it plays no part in any lending decision.
5. Who we share it with
We do not sell your personal information. We share it only where necessary:
- Identity and fraud-prevention providers — to verify who you are.
- Payment providers — to disburse funds and collect repayments.
- Technology suppliers — hosting and email delivery, bound by contract to protect your data and use it only on our instructions.
- Regulators, courts and law enforcement — where we are legally required to.
6. How long we keep it
| Record | Retention |
|---|---|
| Account and profile | While your account is open |
| Loan agreements and repayment history | Typically six years after the loan closes, to meet financial record-keeping duties |
| KYC documents | As required by anti-money-laundering rules |
| Login and security logs | Around six months |
| Support correspondence | While relevant to your relationship with us |
| Marketing consent | Until you unsubscribe |
When a retention period ends, data is deleted or irreversibly anonymised.
7. How we protect it
- Passwords are hashed with bcrypt — they are never stored in a readable form, and nobody here can see yours.
- Stored service credentials are encrypted at rest using AES-256-GCM.
- Access to customer data is limited to staff who need it for their role.
- Every sign-in attempt is logged so unusual access can be spotted.
- Optional two-factor authentication adds a one-time code to your login.
No system is perfectly secure, but if a breach ever put your rights at risk we will notify you and the relevant regulator without undue delay.
8. Your rights
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate details corrected.
- Erasure — have data deleted, where we are not legally required to keep it.
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — for anything based on consent, such as marketing.
To exercise any of these, contact us using the details above. We respond within one month. There is no charge unless a request is manifestly excessive.
9. Marketing
We only send marketing emails if you asked for them. Every one carries an unsubscribe link, and unsubscribing is immediate. It never affects your account or any application.
10. International transfers
Where data is processed outside your country, we ensure an appropriate safeguard is in place — such as standard contractual clauses or an adequacy decision.
11. Children
Our service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.
12. Changes to this policy
If we make a material change we will tell you before it takes effect. The date at the top of this page always reflects the current version.
13. Complaints
If you are unhappy with how we have handled your data, please tell us first — see our Complaints Procedure. You also have the right to complain directly to your national data protection authority.
