Privacy Policy

1. Introduction and Scope

Direct Credit ("we," "our," "us," or the "Company") is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and protect your information when you visit our website at directcredit.com (the "Site"), use our mobile applications, apply for our lending products, or otherwise interact with our services (collectively, the "Services").

This Privacy Policy applies to all individuals who access our Services, including:

• Visitors browsing our website
• Applicants seeking business financing
• Current borrowers with active loans
• Former customers
• Prospective customers who have expressed interest in our Services
• Business partners and referral sources

By using our Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with the practices described herein, please do not use our Services.

2. Information We Collect

We collect information from various sources to provide our Services, evaluate loan applications, and meet our legal and regulatory obligations.

2.1 Information You Provide Directly

• Personal Identification: Full legal name, date of birth, Social Security Number (SSN), government-issued ID numbers
• Contact Information: Email address, phone number, mailing address
• Business Information: Legal business name, DBA names, EIN, business address, industry, years in operation, ownership structure
• Financial Information: Bank account details, bank statements, tax returns, profit and loss statements, balance sheets
• Ownership Information: Details of all beneficial owners with 25% or more ownership
• Collateral Information: Details about assets offered as collateral

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type and version
• Usage Data: Pages visited, links clicked, time spent on pages
• Location Data: Approximate location based on IP address
• Log Data: IP address, access times and dates, referring URLs
• Cookies and Tracking Technologies: See our Cookie Policy for details

2.3 Information from Third Parties

• Credit Bureaus: Personal and business credit reports from Experian, Equifax, TransUnion, Dun & Bradstreet
• Identity Verification Services: Results from KYC processes
• Financial Data Aggregators: Bank account transaction history with your authorization
• Public Records: Court records, Secretary of State filings, UCC filings, tax liens
• Referral Partners: Information from brokers, lending partners, or affiliates

2.4 Sensitive Personal Information

Certain information we collect is considered sensitive, including Social Security Numbers, financial account numbers, and government-issued identification. We collect such information only when necessary and protect it with enhanced security measures.

3. How We Use Your Information

3.1 Providing and Improving Our Services

• Processing and evaluating loan applications
• Underwriting and making credit decisions
• Funding approved loans and managing disbursements
• Servicing active loans, including payment processing
• Communicating about your application, account, and loan status
• Developing and improving our products and services

3.2 Identity Verification and Fraud Prevention

• Verifying your identity and the identity of business owners
• Detecting and preventing fraud, money laundering, and other illegal activities
• Conducting AML and KYC checks
• Monitoring for suspicious activity

3.3 Legal and Regulatory Compliance

• Complying with applicable laws, regulations, and legal processes
• Reporting to credit bureaus and regulatory agencies as required
• Enforcing our Terms of Service and loan agreements

3.4 Marketing and Communications

• Sending promotional communications about our products (with your consent where required)
• Personalizing your experience
• Conducting surveys and requesting feedback

4. Legal Basis for Processing (GDPR)

For individuals in the EEA and United Kingdom, we process your personal data based on:

• Contract Performance: Processing necessary to enter into or perform a contract with you
• Legal Obligation: Processing necessary to comply with legal and regulatory requirements
• Legitimate Interests: Processing necessary for our legitimate business interests
• Consent: Where you have given explicit consent to the processing

5. Information Sharing and Disclosure

5.1 Service Providers

We engage third-party service providers including cloud hosting, payment processors, identity verification, customer service, analytics, and legal services. These providers are contractually obligated to protect your information.

5.2 Credit Bureaus and Reporting Agencies

We report loan performance to major credit bureaus (Experian, Equifax, TransUnion) and business credit agencies. This reporting may affect your credit scores.

5.3 Legal and Regulatory Authorities

We may disclose information when required by law, to respond to government requests, protect our rights, or prevent wrongdoing.

5.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

6. Your Privacy Rights

6.1 Universal Rights

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Opt-Out: Unsubscribe from marketing communications at any time

6.2 Rights Under CCPA/CPRA (California Residents)

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: Direct us not to sell or share your personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights

6.3 Rights Under GDPR (EEA and UK Residents)

• Right to Erasure: Request deletion of your personal data in certain circumstances
• Right to Data Portability: Receive your personal data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Lodge a Complaint: Lodge a complaint with your local data protection authority

6.4 How to Exercise Your Rights

• Visit our Data Rights Request page
• Email us at info@bairdaugustine.com with "Privacy Request" in the subject line

7. Data Security

We implement comprehensive technical, administrative, and physical security measures to protect your personal information.

7.1 Technical Safeguards

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Access Controls: Role-based access with multi-factor authentication (MFA)
• Monitoring: 24/7 security monitoring and automated threat detection
• Vulnerability Management: Regular penetration testing and vulnerability assessments

7.2 Certifications and Compliance

• SOC 2 Type II: Annual third-party audit of security controls
• PCI DSS: Compliance with Payment Card Industry standards
• GLBA Safeguards Rule: Compliance with financial privacy requirements

8. Data Retention

• Active Accounts: Throughout the duration of our business relationship
• Loan Documentation: 7 years after loan payoff or charge-off
• Denied Applications: 2 years from the date of decision
• Marketing Data: Until you opt-out or 3 years of inactivity
• Tax Records: 7 years as required by IRS regulations

9. International Data Transfers

Direct Credit is headquartered in the United States. If you access our Services from outside the US, your information may be transferred to, stored, and processed in the United States.

9.1 Transfer Mechanisms

• Standard Contractual Clauses (SCCs): EU-approved model clauses for data transfers
• UK Addendum: Additional protections for UK data subjects
• Adequacy Decisions: Where applicable, transfers to countries deemed adequate by regulators

10. Cookies and Tracking Technologies

• Essential Cookies: Required for the website to function properly
• Performance Cookies: Help us understand how visitors interact with our site
• Functional Cookies: Remember your preferences and settings
• Targeting/Advertising Cookies: Deliver relevant advertisements

For more detailed information, please see our Cookie Policy.

11. Automated Decision-Making and Profiling

In accordance with GDPR Article 22 and applicable U.S. regulations, we disclose the following about our use of automated decision-making in the lending process.

11.1 How We Use Automated Processing

• Credit Risk Assessment: Algorithms evaluate creditworthiness based on credit scores, financial statements, business performance, and industry risk factors
• Fraud Detection: Automated systems screen applications for indicators of identity fraud, document manipulation, and suspicious patterns
• Lender Matching: Algorithms match loan applications with lender criteria to identify the best financing options
• Pricing Models: Interest rates and fees may be partially determined by automated risk-based pricing models

11.2 Your Rights Regarding Automated Decisions

• Right to Human Review: You may request that a qualified human underwriter review any automated decision
• Right to Explanation: You may request an explanation of the logic and key factors involved in an automated decision
• Right to Contest: You may contest an automated decision and submit additional information
• Right to Opt Out: Where legally required, you may opt out of certain automated profiling

To exercise any of these rights, contact us at info@bairdaugustine.com or visit our Data Rights Request page.

12. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for how to respond to DNT signals, our website does not currently respond to DNT signals. However, you can control tracking through:

• Our cookie consent management tool
• Browser-level privacy settings
• Opt-out mechanisms provided by our third-party analytics partners
• The Global Privacy Control (GPC) signal, which we honor as a valid opt-out request under applicable state privacy laws

13. State-Specific Privacy Rights

In addition to the CCPA/CPRA rights described in Section 6.2, residents of certain other states have additional privacy rights:

13.1 Virginia (VCDPA)

Virginia residents have the right to access, correct, delete, obtain a copy of, and opt out of the processing of personal data for targeted advertising, sale, or profiling. You may appeal a denied request by contacting info@bairdaugustine.com. If your appeal is denied, you may contact the Virginia Attorney General.

13.2 Colorado (CPA)

Colorado residents have rights to access, correct, delete, and obtain a portable copy of personal data, as well as the right to opt out of targeted advertising, sale, or certain profiling. You may designate an authorized agent to exercise rights on your behalf.

13.3 Connecticut (CTDPA)

Connecticut residents may access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale, or profiling. We will respond to verified requests within 45 days.

13.4 Texas (TDPSA)

Texas residents may access, correct, delete, and obtain a portable copy of personal data. You have the right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.

13.5 Oregon (OCPA)

Oregon residents have the right to know, correct, delete, and obtain a copy of personal data. You also have the right to opt out of targeted advertising, sale, and profiling. Oregon residents have additional rights related to the processing of sensitive data.

13.6 Universal Opt-Out Mechanisms

We honor opt-out preference signals, including the Global Privacy Control (GPC), as valid consumer requests to opt out of the sale or sharing of personal information under applicable state laws.

14. Data Breach Notification

In the event of a data breach involving your personal information, Direct Credit will:

• Notify affected individuals without unreasonable delay, and no later than required by applicable state and federal laws (typically within 30-72 hours of discovery depending on jurisdiction)
• Notify regulatory authorities as required, including state Attorneys General, the FTC, and supervisory authorities under GDPR (within 72 hours)
• Provide detailed notification including the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to address the breach
• Offer remediation such as complimentary credit monitoring and identity theft protection services for a minimum of 12 months
• Document the incident in our internal breach register, including facts, effects, and remedial actions taken

15. Financial Incentives

As required under the CCPA/CPRA, we disclose the following financial incentive programs that involve the collection of personal information:

• Newsletter Subscription: We may offer exclusive insights and early access to rate information in exchange for subscribing to our newsletter with your email address
• Referral Program: Referring a business that is subsequently funded may result in a referral bonus, which requires collecting referral contact information

Participation in these programs is voluntary. You may opt out at any time by contacting us. The value of the data collected is reasonably related to the value of the incentive offered, calculated based on the cost of providing the benefit.

16. California Shine the Light

Under California Civil Code Section 1798.83, California residents who have provided personal information to Direct Credit may request information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes. If this practice changes, we will update this policy and provide an opt-out mechanism.

17. Privacy Request Response Timeframes

We verify your identity before processing any privacy request. Verification may require matching information you provide against information we already maintain. We will not fulfill a request if we cannot verify your identity or authority to make the request.

18. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at info@bairdaugustine.com.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Provide prominent notice on our website or via email
• Where required by law, obtain your consent before applying material changes to data already collected
• Archive prior versions for your reference upon request

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after changes are posted constitutes acceptance of the updated policy.

20. Contact Us

For California Residents

California residents may also submit privacy requests through the California Attorney General's office at oag.ca.gov.

For EEA and UK Residents

If you are unsatisfied with our response to your privacy request, you have the right to lodge a complaint with your local data protection supervisory authority. You can find your local authority at edpb.europa.eu.

Gramm-Leach-Bliley Act (GLBA) Privacy Notice

As a financial services provider, Direct Credit is subject to the Gramm-Leach-Bliley Act.