SBTP Group Ltd is made up of a number of different legal entities. This includes buffa Loans Ltd (trading as buffa), FCL Consumer Finance Ltd (trading as Smart Pig) and Synced FS Ltd.

  • Buffa: short-term online lender.
  • Smart Pig: short-term online student lender.
  • Synced: online banking application.

The details of each of our companies are set out at the end of this privacy policy.

Buffa Loans Limited (buffa, we, us and our) is a short-term lender authorised and regulated by the Financial Conduct Authority (FCA).

This policy tells you how buffa collect and use your information based on what you tell us about yourself, including any data you may provide through this website, what we learn by having you as a customer, and the choices you make during your relationship with us. This policy also explains your data rights under the General Data Protection Regulation (‘GDPR’).

We are registered with the ICO, our details are:

- Data Controller: buffa Loans Ltd

- Registration Number: ZA314963

We encourage you to take time to read this policy and get in touch if you have any questions. To get in touch with us regarding this policy or anything else relating to how we use your information, please email us on -

Our Privacy Commitment

We take your personal data very seriously and you can expect, as a customer, information we hold about you will not be disclosed to anyone other than in the circumstances listed below:

- where we are legally required to disclose;

- where we have a public duty to disclose;

- where our legitimate business purposes require disclosure,

- where the disclosure is made with your consent; or

- as set out in other circumstances within this policy.

We promise to keep your data safe and private.

Lawful Basis For Processing Your Information

Under the GDPR, we can only use your personal information where we have a reason to do so. We use your personal information on the following lawful basis:

ConsentWhere you have given clear consent for us to process your personal data for a specific purpose.
ContractProcessing is necessary for us to fulfil a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
Legal obligation

The processing is necessary for us to comply with the law.

Legitimate interests

The processing is necessary for our legitimate interests; however, these interests will not outweigh your rights as an individual.

We have outlined below any lawful basis which may cause us to use your information, including our legitimate interests:

Use of information Lawful basis for processing including basis of Legitimate Interests
Provide our services
  • To register you as a new customer
  • To help us assess and process your application for credit.
  • To issue communications including legal, regulatory and servicing communications relating to our relationship with you.
Performance of a contract with you

Our legitimate interests:
  • To ensure we lend responsibly, validate your ID and prevent financial crime to manage our business risks.

Account management

  • Manage payments, fees and charges
  • To collect money owed to us and recover debt including tracing your whereabouts.
  • To help us investigate any complaints, disputes or other enquiries that you have with us.
Performance of a contract with you

Our legal obligation

Our legitimate interests:
  • to ensure we recover debts owed to us.
  • to ensure we resolve your complaints in a timely manner and ensure we put things right.
Manage financial crime, IT security & risks
  • To help us fight financial crime such as fraud and money laundering.
  • to help us protect the business and our customers
  • To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
Performance of a contract with you

Our legal obligation

Our legitimate interest:
  • to detect and prevent financial crime, verify your ID to manage business risks and to comply with rules applicable for us.
  • for running our business, provision of administration and IT services, network security.
  • the context of a business reorganisation or group restructuring exercise
Marketing and product development
  • To help us develop and undertake marketing campaigns.
  • To personalise our marketing content based on customer base.
  • To help us develop or improve products or services
Our legitimate interest:
  • to provide information about our products and services which may be suitable for you.
  • to provide customers more relevant messages based on their circumstances.
  • to study how you use our products/services, to develop them, ensure our product or services meet your needs, to grow our business and inform our business and marketing strategy.
General business operations
  • To help us to perform administrative, operational or compliance oversight activities including monitoring calls, communications, testing of our systems, policies and procedures.
Our legal obligation

Our legitimate interests
  • to develop our business, improve the service we provide to our customers, and to train our employees.
Manage our legal obligations
  • To comply with regulatory and legal requirements such as preventing financial crime, acting in accordance with your data rights and meeting standards set by regulator and law enforcement bodies.
Our legal obligation

Our legitimate interests:
  • to comply as regulated firm and protect our business

Information We Use

buffa uses the following information about you:

- Contact Information: where you live and your contact details such as telephone number and email address.

- Financial data: your income, outgoings and repayments to other creditors.

- Employment data: details of your employer, type of employment, and your job title.

- Communication information: your contact with us including calls, emails, letters, and Live Chat.

- Transactional data: your borrowing and repayment behaviour.

- Preferences: how you use our product and services. This includes any consent provided during your applications such as marketing preference.

- Sensitive/ Special Category information: details provided by you or an approved party regarding your circumstances such as health which help make decisions on your account.

- Device data: information collected from your devices (computer, mobile, tablet etc.) and your usage of our website.

Collecting Your Information

We may collect personal information about you through various ways:

- Using our website: information we collect when you use the Buffa website (such as IP address, operating system and preferred web browser).

- Applications: personal information you provide us when applying for a loan with us such as your contact details, date of birth, your financial position, and employment details.

- Third parties we work with: This includes organisations such as credit reference agencies, fraud prevention agencies, credit brokers, comparison websites, and social media networks.

- Communications: when you communicate with us including when you write to us, (letter, email or Live Chat), call us, or through other any interaction with us such as completing surveys, entering competitions and promotions.

- Using our services: data collected when you use our product and services such as loan repayments, usage data and borrowing trends.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Making Automated Decisions

buffa may use your personal information, like detail you have provided during your relationship with us, or information we have collected, to make automated decisions. The ability to make automated decisions is key to our business operations which allow us to fairly assess and decide whether you are suitable for credit.

Where you are eligible for credit, we will use automated decisions to decide how much credit you are entitled to. The automated decisions we take may impact the products or services we may offer you.

Types of automated decision we make:

- Assessing your suitability for credit: We use automated decisions when you apply for credit with us and this helps us decide whether we can provide you with credit or not. We do this through using data you have provided during your loan application together with data provided by Credit Reference Agencies about how you have managed your commitments with other lenders. If you are an existing customer, we will also use information regarding the repayment history on your previous loan(s).

This method of automated decision making is common practice within the financial services market and ensures responsible lending and fair consumer outcomes.

- Fighting financial crime: We use automated decisions based on your personal information and data provided by external agencies to detect, prevent and deter fraud.

- Delivering suitable products and services: We will use the information, together with information obtained from customers who are similar to you, to study and learn about our customers’ needs, and to make decisions based on what we learn. This enables us to provide suitable products and services for groups of customers, and to manage our relationships with them.

Sharing Your Information

We may share your personal information with companies within SBTP Group Ltd (which includes FCL Consumer Finance Ltd and Synced FS Ltd), its subsidiaries, and these organisations:

- Credit references agencies (CRAs)

- Fraud prevention agencies (FPAs)

- Authorised third parties including individuals or third parties such as debt management companies looking after your account

- Approved third parties who assist us to manage your account such as collecting what you owe

- Professional advisors such as lawyers, bankers, auditors and insurers

- Regulatory bodies

- Market researchers

- Comparison websites and credit brokers

- Payment system (s) we may use

We may also share your personal information if the structure of SBTP Group changes, and to any new subsidiaries that may be added to the Group. We will consider how this impacts your personal information and ensure we operate to keep your information safe.

Credit Reference Agencies

We conduct checks using Credit Reference Agencies (‘CRAs’). We do this to assess your credit worthiness and check your identity when you apply for a loan with us. buffa will share your personal information with CRAs and in turn they will give us information about you.

The information we will share with CRA’s include:

- your name, address and date of birth

- your application(s) for credit

- your financial situation and repayment history

- information from public record, such as County Court Judgments and Insolvency information

We’ll use this data to help us:

- assess your suitability for credit including amount to lend and whether this is affordable

- assess the details you provided on your loan application

- let you know when you may re borrow from us

- fight financial crime such as fraud and money laundering

- recover debt including tracing activities where appropriate

buffa will share information with the CRAs where you have applied for a loan with us.

This includes where you have been approved or declined for a loan – known as a credit search. Once you are customer, we will continue to share data with CRA’s in line with our obligations to them, to give information on your loan repayments.

For more information on how CRAs (including the likes of Transunion, Equifax, and Experian) use and share your personal information, the type of information they hold, where it comes from and the legalities of how it is handled please click here.

If you would like details of your personal information held by the CRAs we use, please find their details below;

TransUnion International UK Limited


Email address:

Telephone number: 0330 024 7574

Postal address: Transunion Information Group Limited, One Park Lane, Leeds, West Yorkshire LS3 1EP.

Fraud Prevention Agencies (FPA's)

We need to confirm your identity before we grant you a loan. We may use information to help us:

- confirm your identity.

- fight financial crime.

- fulfil any contracts you have with us.

- comply with law enforcement agencies in fighting financial crime.

We may share information with FPAs if you provide false or inaccurate information and fraud is identified. Law enforcement agencies may access and use this information to detect and prosecute financial crime.

Fraud Prevention Agencies may also send some personal information to countries outside the European Economic Area (‘EEA’) to combat financial crime. If they do so, there will be an agreement to ensure the information is held securely to standards at least as good as those in the EEA.

The kinds of personal information that we use:

- Your financial details (applications for credit, repayments etc.)

- Your device data (IP address, browser version, device type)

We will decline your application for credit if we believe there is a risk of fraud. If you are an existing customer and we detect fraud or risk of fraud, we may block your buffa account indefinitely and may report this to law enforcement agencies and provide the FPA with details.

As we share information with FPAs, other subscribers to the FPA, such as lenders will be able to access this information. This could have an impact on your future relationships with financial organisations if you apply for a loan or other product.

Transfer of Information

We will only send your data outside of the European Economic Area (‘EEA’) to comply with a legal obligation, to help us with our business operations such as working with third parties to manage our products and services or to fulfil your request.

If we do transfer information outside of the EEA, we will ensure the information is held securely to standards at least as good as those in the EEA and used only for the purposes set out in this policy. We will do this by ensuring that at least one of the following safeguards is implemented:

- we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;

- where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe; or

- where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.

Keeping Your Information

We will only keep your information for as long as we need it. If you have taken a loan with us, we will keep your personal information for as long as you are a customer or 6 years following the closure of your last loan with us.

If you have applied for a loan but you were declined, we may keep your personal information up to six years from your application date.

We may keep your data for one of these reasons:

  • To manage your account with us such as applications, repayments and keeping you up to date on the status of your account.
  • To deal with any enquires, complaints or disputes you may have with us including those related to your loan application.
  • To report accurately to the Credit References Agencies (CRAs).
  • To combat financial crime.
  • To comply with legal and tax requirements including any rules that apply to us.
  • For research or statistical purposes.

We may also keep your data for longer than 6 years if we cannot delete it for legal, regulatory or technical reasons.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your Data Rights


We may use your personal information to tell you about relevant products and offers for marketing purposes within the SBTP Group. This information includes details provided by you or approved third parties we work with and we may market to you when you provided consent or under ‘legitimate interests’.

You have the right to withdraw your consent at any time. You can withdraw consent by:

- Amending your preference online via our Members Area.

- Clicking on ‘unsubscribe’ on marketing emails you receive from us.

- Emailing us on

If you withdraw your consent and you are a customer with us, you will still receive important information such as payment reminders, statements, regulatory notices and other service related communication. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw consent.

Right to access

You have the right to access the personal information we hold on you (commonly known as a “data subject access request”).

Right to rectification

You have the right to ask us to rectify any personal information we hold on you that you believe is wrong or incomplete, though we may need to verify the accuracy of the new data you provide to us. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. If you have any concerns about the information we hold, please get in touch.

Right to erasure

You may have a right to have some or all information we hold about you deleted. However, you should bear in mind that, as a regulated financial services firm, we are required to retain many records even after you close your account with us.

Right to portability

You have the right, in certain circumstances, to receive some of your information electronically from us. We will provide this information to you or to another party you have authorised such as another individual or another business.

Right to object

You have the right to object to the processing of your personal information. When you get in contact us with, we may state the legal or other required reasons why we need to process your data.

Right to restrict

In some instances, we may be able to restrict the use of your personal information. You can ask us to suspend the processing of your personal data in the following scenarios:

- if it is not accurate or up to date.

- if it’s been used unlawfully but you don’t want us to delete it.

- if it is not relevant any more, however, but you want us to keep it for use in legal claims. If you have already asked us to stop using your data but we need to verify whether we have overriding legitimate grounds to use it.

Rights related to automated decision making

You as an individual have the right to object to automated decisions, however, this may significantly impact how we can provide our products and services to you. If you are happy for us to make an automated decision, but you wish to object to a decision, you can get in contact with us. Please see the section of this privacy policy entitled ‘Making Automated Decisions’ about the types of automated decisions we make.

To exercise any of your rights above, please contact us -

Complaints and Disputes

We try to meet the highest standards when collecting and using your personal information. If you are unhappy how buffa has processed or used your personal information, please contact us by email - You may also complain directly to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (


You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy. Click here to read it.

How to Contact Us

Buffa Loans Limited (trading as Buffa)

Company number - 10865145

Registered Office - Unit 3, Jephson Court, Tancred Close, Leamington Spa, CV31 3RZ.

Contact address - Buffa Loans Limited, 3 Jephson Court, Tancred Close, Leamington Spa, CV31 3RZ

Telephone number - 01926 298410

Email -

FCL Consumer Finance Limited (trading as Smart-Pig)

Company number - 07694453

Registered Office - Unit 3, Jephson Court, Tancred Close, Leamington Spa, CV31 3RZ.

Synced FS Limited

Company number - 09901936

Registered Office - Unit 3, Jephson Court, Tancred Close, Leamington Spa, CV31 3RZ.