Capital on Tap Customer Privacy Policy

4. Where do we collect your personal information from?

Typically, we will collect information from you when you contact us directly or provide information to us to provide you with our products and services.  In addition, we collect information from and about you in the following ways:

• You (or your representative)

• Data Analytics Providers

• Marketing Partners

• Our website and mobile applications

• Social Media Websites

• Services Providers

• Government Agencies

• Publicly accessible databases

• Third Parties

4. Our purpose for collecting your personal information

4.1   In this section, we set out the purposes for which we use personal information that we collect via our Website and elsewhere.

4.2   Please note that in addition to the disclosures we have identified below, we may disclose personal information for the purposes we explain in this notice to service providers, contractors, agents, advisors (e.g. legal, financial, business or other advisors) and affiliates of Capital on Tap that perform activities on our behalf:

(a) To communicate effectively with you and conduct our business ► to manage the use of Capital on Tap Business Credit Card, including to respond to your queries, to otherwise communicate with you, or to carry out our obligations arising from any agreements in connection with your Capital on Tap Business Credit Card;

(b) To confirm that application details are correct ► so that we can ensure that information used to assess applications for the Capital on Tap Business Credit Card are entirely correct, we may cross-check it against resources such as:

(i) state corporate registration records, to confirm company information;

(ii) zip code confirmation services;

(iii) data validation services, to confirm bank account and contact details; and

(iv) consumer reporting agencies.

The purpose of these checks is to monitor for inconsistencies. Sometimes, where we cannot confirm your details based on the information provided, we may request further documentation such as copies of identification documents or bank statements.

(c) To process applications for credit ► We will use your personal data in connection with processing applications for the Capital on Tap Business Credit Card. To do this, we may:

(i) undertake checks against PEP (Politically Exposed Persons) Sanctions and AML (Anti Money Laundering) databases;

(ii) utilize consumer reporting agencies and credit data providers to undertake a credit check on you and/or your business;

(iii) utilize third party databases to assist in connection with the processing of your application; and

(iv) use third party tools to categorize your personal and financial data.

We will continue to exchange information about you with credit reporting agencies (CRAs) while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not pay the minimum contractual repayments on time, we will report the outstanding debt to CRAs, who will record this on your business credit file, and personal credit file where a Personal Guarantee is in place. We may also inform CRAs if you do not pay the minimum contractual repayments on time and enter an Arrangement to Pay. This information may be supplied to other organizations by CRAs.

(d) In relation to fraud/crime prevention ► personal information we have collected about you may be shared with fraud prevention agencies that will use it to prevent fraud and money-laundering and to verify your identity. If fraud is suspected or detected or you supply us with misleading, false, incomplete or inaccurate information, you could be refused credit, or your existing account may be frozen, pending investigation.

(e) To undertake continuing checks and monitoring ► to ensure service quality, accurate credit offer assignment, and compliance with procedures.

Where a Capital on Tap Business Credit Card account has been issued, we may continue to check against the information you provided to us, your credit report, PEP, sanctions and/or anti-money-laundering databases on a periodic basis. We also undertake ongoing monitoring of your use of our Website and your transactions for fraud detection or crime prevention purposes.

(f) To collect payments ► We will generally collect credit payments directly from you via ACH. We use GoCardless to process your ACH payments. More information on how GoCardless processes your personal data and your data protection rights, including your right to object, is available at https://gocardless.com/legal/privacy/.

When you are late in making a scheduled payment, a collections agent may be engaged to obtain repayment. There is a process in place to assist individuals who are struggling to make payments on their Capital on Tap Business Credit Card . If you have difficulties making payments under your credit agreement please contact us at your first opportunity by phone or by email as set out in “Contact Us.”

(g) To provide you with marketing materials ► to provide you with updates and offers, where you have chosen to receive these. We may also use your information for marketing products and services to you by mail, email, SMS or phone and, where required by law, we will ask for your consent at the time we collect your data to conduct any of these types of marketing. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt-out by contacting us as set out in “Contact Us.”

(h) For research and development purposes ► to analyze your personal information and usage of products and services in order to better understand your requirements, to better understand our business and develop products and services. We may also share your information with social media providers, exclusively for purposes of market research, and only where you have provided consent to that social media provider to assist us with this market research;

(i) To inform you of changes ► to notify you about changes to services and products;

(j) To ensure website content is relevant ► to ensure that content from our Website is presented in the most effective manner for you and for your device, which may include recording your session while on our Website or passing your data to business partners, suppliers and/or service providers;

(k) To reorganize or make changes to our business ► in the event that we: (i) are subject to negotiations for the sale of our business or part thereof to a third party; (ii) are sold to a third party; or (iii) otherwise undergo a reorganization, merger, bankruptcy, dissolution, liquidation, or other transaction or legal proceeding, we may need to transfer some or all of your personal information to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analyzing any proposed sale or reorganization. We may also need to transfer your personal information to that reorganized entity or third party for them to use for the same purposes as set out in this policy.

(l) In connection with our legal or regulatory obligations ► We may use your personal information to comply with regulatory requirements or dialogue with regulators as applicable which may include disclosing your personal information to third parties, litigants, regulators and/or law enforcement agencies in connection with inquiries, proceedings or investigations by such parties. In addition, we may use your personal information to enforce terms and conditions, to protect our operations or those of any of our affiliates, to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others and to allow us to pursue available remedies or limit the damages that we may sustain.

(m) For security monitoring ► We may indirectly /directly access your information for cyber security monitoring purposes – to ensure the protection of your personal data by monitoring cyber security threats.

(n) Sensitive Personal Information ► We may share this information with subsidiaries and affiliates, with subcontractors, service providers, and other vendors to which access to the Information is required to fulfill the work being performed or requests made by you or Capital on Tap or with third party servicers to whom debt may be sold.

(o) For other purposes ► From time to time, we may use your data in other ways from those described above, but we will let you know before doing so.

5. Who we share your personal information with

5.1   We may disclose information about you to any of our affiliates or their or our employees, officers, agents, suppliers or subcontractors insofar as reasonably necessary to provide you with the services contemplated in the Capital on Tap Business Credit Card Agreement or as set out in this Privacy Policy. These entities will only collect, use and disclose your personal information to the extent necessary to allow them to perform the services they provide to us. These entities will employ commercially reasonable security procedures and practices to protect your personal information from unauthorized access, destruction, use, modification, or disclosure.

5.2   In addition, we may disclose information about you:

(a) To the extent that we are required to do so by law;

(b) To counterparties, regulators and law enforcement agencies in connection with any legal proceedings, prospective legal proceedings or lawful requests, or in order to establish, exercise or defend our legal rights including providing information to others for the purposes of fraud prevention and reducing credit risk;

(c) To any third party who provided your details to us (for example, a broker) in connection with the outcome of your application; and

(d) To the purchaser or prospective purchaser of any business or asset which we are or are selling or contemplating selling, or as part of a reorganization, merger, bankruptcy, dissolution, liquidation, or other transaction or legal proceeding.

Capital on Tap does not sell, rent, or lease your personal information. We do not disclose your personal information to third parties for their direct marketing purposes.

6. Children’s online privacy

Our Website is meant for adults only. We do not knowingly collect personally identifiable information from children under the age of 13. If you are a parent or legal guardian and think your child under 13 has given us information, please contact us as described below in the “Contact Us” section of this Privacy Policy; please mark your inquiry “COPPA Information Request.”  If we become aware that a child under 13 has provided us with personal information without parental consent, we will take steps to remove such information and terminate the child’s account. For information concerning the Children’s Online Privacy Protection Act (“COPPA”), visit the Federal Trade Commission’s website at www.ftc.gov.

7. Transmission, storage and security of your personal information

Security over the internet

7.1   No data transmission over the Internet or website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal information in accordance with data protection legislative requirements. You should take all precautions to safeguard your passwords and any account information that you may have or provide and to employ current virus-scanning or firewall software and other security safeguards. You should also log out of your account and close your browser window. 

7.2   We will store all the personal information you provide on our secure password and firewall-protected servers. All electronic transactions you make to or receive from us on our website will be encrypted using SSL technology. We may store your data on servers overseas or “in the cloud,” and by using the Website or otherwise providing us with information, you consent to us storing your information in this manner.

7.3  Our systems use a third-party email service that we access over an encrypted HTTPS connection, which in turn uses opportunistic TLS connections to relay emails. For the majority of our customers, this means that the receipt of emails and their associated attachments is secured right from the connection with a customer's email server.

7.4  Do Not Track. Some browsers may have the option to transmit a “do not track” signal to websites. The Site does not respond differently or limit its practices under the terms of this Privacy Policy when you visit the Site with a browser that uses a “do not track” signal or similar mechanism.

7.5  It is our policy not to email you or send you unsolicited electronic communication to request non-public Personal Information or account information (such as username or password). If you receive an unsolicited email or other electronic communication that appears to be from Capital on Tap but you suspect may be from another source and might be fraudulent, please contact us by email to support@capitalontap.com or by phone at 833-972-1323.

Storage limits

7.6  Typically, we keep your personal information for 10 years after the account or service inquiry has been closed or completed. Our retention periods for personal data are based on business needs and legal requirements. We retain personal data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we may retain certain transaction details and correspondence until the time limit for claims arising from the transaction has expired, or to comply with regulatory requirements regarding the retention of such data. When personal data is no longer needed, we either irreversibly anonymize the data (and we may further retain and use the anonymized information) or securely destroy the data.

8. Provisions Applicable to California Residents

8.1 California Privacy Rights

Overview

This section supplements the information contained in our Privacy Policy and only applies to individuals who reside in the State of California. The California Consumer Privacy Act ("CCPA") grants residents of the State of California (hereinafter “you”) certain privacy rights regarding their personal information. The CCPA requires that a business that collects personal information from a natural person disclose, at or before the point of collection, the categories of personal information to be collected and the purposes for which that information is to be used.

This Privacy Policy sets forth our practices with respect to information that can reasonably be linked with an individual or household (“Personal Information”), as required by the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).

Legal Rights

The CCPA provides you with certain rights regarding the collection, use, and disclosure of your Personal Information. As described in more detail below, the CCPA provides you with the following rights:

• The Right to Know/Access what Personal Information we have collected about you as stated in this Privacy Policy. Before or when we collect your Personal Information, you have the right to know:

  • The categories of Personal Information (including Sensitive Personal Information) we collect, the business or commercial purpose for which we collect and use the Personal Information, and whether we sell or share that information;  and

  • How long we intend to keep each category of Personal Information, including Sensitive Personal Information.

You also have the right to request that we provide you with certain information about the Personal Information we collect, use, share, disclose, or sell, as well as the categories and specific pieces of information that we have collected about you. Specifically, you have the right to request the following information:

• • The categories of Personal Information we collect.

  • The categories of sources from which the Personal Information is collected.

  • The business or commercial purpose for collecting, selling, or sharing Personal Information.

  • The categories of third parties to whom we disclose Personal Information. 

  • If we have sold or shared your Personal Information, which we do not, the categories of Personal Information that we collected and shared about you and, for each category identified the categories of third parties to which we, shared that particular category of Personal Information.

  • If we disclosed your Personal Information for a business purpose, the categories of Personal Information that we disclosed about you and the categories of third parties to which we disclosed that Personal Information for a business purpose.

  • The specific pieces of Personal Information the business has collected about you.

• The Right to Delete the Personal Information we collected and maintained about you once we verify your request. However, this right is not absolute and there may be reasons we need to keep your Personal Information and we will inform you if that is the case.

• The Right to Correct inaccurate Personal Information we have collected from you and maintained about you. Once we verify your request, including the inaccurate information, we will update your inaccurate Personal Information from our records and our service provider’s records.

• The Right to Limit the Use and Disclosure of Sensitive Personal Information if we use the information for reasons that are not aligned with why we obtained such information.  However, we can use this information:

  • To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

  • To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and or confidentiality of stored or transmitted Personal Information.

  • To resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions.

  • To ensure the physical safety of natural persons.

  • For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us.

  • To perform services on our behalf.

  • To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us.

  • To collect or process sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

• The Right to Non-Discrimination or Non-Retaliation, which means we cannot discriminate or retaliate against you if you exercise your rights under the CCPA.

• You also have the Right to Opt-Out of the sale or sharing (for targeted advertising) your Personal Information. However, we do not sell or share your Personal Information.

8.2 Exercising Your Rights

To exercise your Right to Know, Correct, or Delete your Personal Information, please submit a request to us by:

• Phone: 1-833-972-1323    

• Email: Privacy@capitalontap.com            

• Mail: 33 Irving Place, Suite 3009, New York, NY 10003               

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request.  We may need to request additional Personal Information from you in order to verify your identity and protect against fraudulent requests.  If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information. We will verify and respond to your request in compliance with the timeframes set forth in the CCPA.

If you request access to, or the correction or deletion of, your Personal Information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your:

• Business Name*

• Personal Guarantor's First name*, Middle initial, Last name*

• Address*

• Email address

• Phone number

*Required field

Verification of Identity

When you make a request, you will be asked to answer a few questions about yourself to help us verify your identity. Third-party identification services may help us with verification to prevent the disclosure of your Personal Information resulting from fraudulent requests. You may be asked to log into your online account to complete this request or provide the information described above. In the event more documentation is necessary to verify your identity, we will notify you directly.

If we can’t verify your identity, we will notify you, and your request(s) to access, request, or delete your Personal Information may not be processed. Any requests may be denied if we have reason to believe they are fraudulent.

Authorized Agents

If you’d like an authorized agent to exercise your rights for you, they may use the same methods described above to submit requests. We require documentation demonstrating your agent’s authority to submit requests on your behalf. For example, a valid power of attorney or other documentation, including a letter, signed by you (the California resident) authorizing the agent to submit your requests. Documentation may be uploaded at the time you submit your request on our website or provided to us up to 10 business days after. If you submit your request by calling, you can email to privacy@capitalontap.com.

8.3 Use and Disclosure of Sensitive Personal Information

We only collect or use sensitive Personal Information for the following business or commercial purposes:

• To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and or confidentiality of stored or transmitted Personal Information.

• To resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions.

• To ensure the physical safety of natural persons.

• For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us.

• We may use approved third party tools to conduct analytics and create profiles for personalized advertising.

• To perform services on our behalf.

• To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us.

• To collect or process sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

9. Contact Us

9.1   If you have any questions about this Privacy Policy or our treatment of your personal data, please write to us by email to privacy@capitalontap.com or by phone at 833-972-1323.

9.2   If you would like to correct, amend, add, or delete personal information associated with your account, please contact us by email to privacy@capitalontap.com. However, even after you update information, we may maintain a copy of the original information in our records.

10. Cookies policy

10.1   You will be prompted to opt-in before any sensitive data is used for analytics. You can read our full cookies policy here: Cookies Policy.

11. Changes to our Privacy Policy

11.1   We reserve the right to change our Privacy Policy from time to time and without prior notice. Please check this page periodically for changes. Your continued use of the Services following the posting of changes to this policy will mean you accept those changes. If we make any changes to this Privacy Policy, we will post the updated Privacy Policy here and will update the date it was last changed below.  Please check our Site regularly to review updates to this Privacy Policy.

11.2   This Privacy Policy was last updated in January 2026.