Skip to main content

Data Protection

GDPR — Your Data Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have specific rights under the General Data Protection Regulation (GDPR) and equivalent legislation. This page explains those rights and how to exercise them.

Last updated: August 1, 2025

Legal Basis for Processing

Contract Performance

Processing necessary to deliver the evaluation and application services you request.

Legitimate Interests

Analytics to improve the Platform, fraud prevention, and security — where not overridden by your rights.

Consent

Where you have opted in to specific non-essential cookies, communications, or optional processing.

Legal Obligation

Where processing is required to comply with applicable laws, regulations, or court orders.

Your Rights Under GDPR

Right to Access

Request a copy of the personal data we hold about you, including how it is used and who it has been shared with.

Right to Rectification

Request correction of any inaccurate or incomplete personal data we hold.

Right to Erasure

Request deletion of your personal data ("right to be forgotten") where there is no compelling reason for its continued processing.

Right to Restrict

Request that we restrict processing of your data in certain circumstances — for example while you contest its accuracy.

Right to Portability

Receive your personal data in a structured, machine-readable format and transfer it to another controller.

Right to Object

Object to processing of your personal data based on legitimate interests, including profiling.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Data Controller

LendEval acts as the data controller for personal data collected through this Platform. If you have concerns about how your data is processed, you have the right to lodge a complaint with your local supervisory authority (e.g., the Information Commissioner's Office in the UK, or the relevant DPA in your EU member state).

Submit a Data Rights Request

We will respond to verified requests within 30 days as required by GDPR. We may need to verify your identity before processing your request.