Privacy Policy

Introduction

Boshhh Group Limited is committed to protecting your privacy and handling personal data lawfully, transparently, and securely in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, share, and retain personal data when you interact with our websites, platforms, services, and tools.

By accessing our website or using our services, you acknowledge that you have been provided with this Privacy Policy and understand how your personal data is processed as described below.

Who we are

Boshhh Group Limited is a UK-based fintech and data services provider. We offer technology and analytics tools to regulated organisations, service providers, and consumers, including affordability assessment, open banking insights, data verification, identity checks, and related intelligence services.

For the purposes of UK data protection law, Boshhh Group Limited acts as a data controller where it determines how and why personal data is processed, and as a data processor where it processes data strictly on the documented instructions of a third party.

Our registered address is 253 Monton Road, Eccles, Manchester, England, M30 9PS. Data protection enquiries can be sent to privacy@boshhhgroup.com.

How we collect personal data

We collect personal data directly from you when you interact with our website, request information, download materials, contact our teams, or use our services. We may also receive personal data indirectly from third-party organisations that use our services, for example where a provider uses our tools as part of their own assessment or verification process.

Where permitted by law and relevant to the service provided, we may receive data from regulated sources such as credit reference agencies, identity verification providers, or secure open banking connections authorised by you. We also collect limited technical data through cookies, logs, and security monitoring tools.

Categories of personal data we process

Depending on the service, we may process identity and contact details, account and service usage information, financial and transactional data obtained via open banking, credit or affordability indicators, verification results, identification documents and biometric data where required for functionality, technical information such as IP address and device type, and communication or preference data.

If you join earnr (see earnr cashback below), we also process your earnr membership details, the bank transactions we collect for earnr, and records of your choices to join or leave earnr.

We process only the personal data necessary for the relevant purpose.

Purposes of processing

We process personal data to provide and operate our services, including affordability, eligibility, verification, and compliance checks. We use data to manage enquiries, customer relationships, platform security, fraud prevention, and misuse detection, and to comply with legal and regulatory obligations.

Where appropriate, and subject to user choice, we may review information to identify other claims or related services that an individual may be eligible for. Any such review is limited to closely related services and is not required to access core functionality.

If you join earnr, Boshhh Group’s free cashback app, we use your open banking data to find you cashback. For this we use up to six years of your past transactions, or as much history as your bank provides, and we collect new transactions every day through the same open banking connection. The earnr cashback section below explains this in more detail.

Lawful bases for processing

We rely on contractual necessity where processing is required to provide services requested by the user. We rely on legitimate interests where processing is necessary to operate, secure, and improve our services, provided those interests are not overridden by the individual’s rights and freedoms. Where we rely on legitimate interests, we assess the impact of our processing on individuals’ rights and freedoms and document those assessments in line with UK GDPR requirements.

We rely on legal obligations where processing is required to comply with applicable laws or regulatory requirements.

Where consent is required, for example for optional eligibility reviews or communications, consent is obtained separately, is freely given, informed, and unambiguous, and can be withdrawn at any time.

We rely on your consent to use your open banking data for earnr and to share matching purchases with our cashback partner, Boogi. You give that consent by ticking the earnr box on our open banking connection page. You can withdraw your consent at any time by leaving earnr, as explained in the earnr cashback section. Withdrawing stops any further processing of your data for earnr; it does not affect processing carried out before you withdrew.

earnr does not change the lawful bases we rely on for our other purposes, including the claims and statements services provided through our open banking connection page. Those continue to rely on the bases described above, whether or not you remain an earnr member.

Existing data relationships and third-party use

In some circumstances, personal data is obtained indirectly where a third party uses our services as part of their own process. In these cases, the third party determines the purpose of the initial processing, and Boshhh Group Limited acts as either a processor or an independent controller depending on the service.

Where Boshhh Group Limited acts as an independent controller, this Privacy Policy applies. Where we act as a processor, we process data only on documented instructions and in accordance with applicable data protection obligations.

Sharing personal data

We may share personal data with technology and infrastructure providers that support our platform, such as cloud hosting, analytics, communications, and security providers. We may share data with regulated organisations or clients where necessary to deliver a service, for example sharing verification or affordability outcomes.

We may also share data with credit reference agencies, fraud prevention services, or identity verification providers where relevant and permitted by law. We may disclose data to regulators, law enforcement, or professional advisers where required.

If you join earnr, we share limited information with Boogi (boogi.io), our cashback partner, so that cashback can be confirmed with retailers. Boogi is a recipient of your personal data for this purpose. The matching is done by our own systems: we check your transactions against the retailers that currently have an earnr offer, and only purchases at those retailers are shared. For each matching purchase we send the bank’s description, the amount, the date and the payee name, together with your postcode, your country and a random member reference. We never send Boogi your name, phone number, email address, account number, sort code or your full bank history. Transactions that do not match an earnr retailer stay with us.

We do not sell personal data.

Open banking data

Where you authorise access via open banking, access is secure, encrypted, and read-only. We cannot move money or make payments through it, and we never see your bank login details. Only the data necessary for the stated purpose is retrieved. Live access is not maintained unless explicitly authorised. Historic data may be retained in accordance with our data retention policy and regulatory requirements.

Open banking data is processed in line with applicable regulations and industry standards.

From 15 October 2026, the connection you make on our open banking connection page, including where a claims management firm has sent you to that page, may be ongoing rather than a one-off download. Ongoing access stays in place until it is withdrawn, may need to be renewed from time to time, and is refreshed every day to collect new transactions. It is this connection that earnr uses.

You can withdraw ongoing access at any time:

• through your bank, by removing the connection;
• by contacting us at help@boshhhgroup.com or on 0161 505 0879; or
• by leaving earnr, which stops us collecting your transactions for earnr.

earnr cashback

earnr is a free cashback app run by Boshhh Group Limited, the same company that runs our open banking connection page. When you buy from a retailer with an earnr offer, earnr receives a commission from the retailer and passes a share of it to you as cashback. earnr decides your share and shows it on each offer before you spend, and keeps the rest. earnr has its own earnr Terms and earnr Privacy Policy. This section explains how we use data obtained through our open banking connection for earnr.

Joining earnr. You join earnr by ticking the earnr box on our open banking connection page. You must be 18 or over and live in the UK. When you tick it and connect your bank, we set up your earnr account from the details you have given on the page. You sign in to earnr with your mobile number.

How we use your bank data for earnr. We use up to six years of your past transactions, or as much history as your bank provides, and collect new transactions every day through the same open banking connection. Our own systems check your transactions against the retailers that currently have an earnr offer. Most of your transactions will not match anything, and those stay with us. We share only the matching purchases with Boogi, as described under Sharing personal data above. Boogi works with the retailer to confirm the purchase, and we track the cashback in your earnr account.

What we won’t do. We cannot move money or make payments: the connection is read-only. We never see your banking login. We will not send you marketing unless you separately agree to it. We do not sell your data.

Leaving earnr. You can leave earnr at any time, and leaving does not affect your claim or statements. To leave:

• tap Leave earnr in the earnr app or on our open banking connection page;
• email help@boshhhgroup.com; or
• call 0161 505 0879.

When you leave, we stop collecting your transactions for earnr, stop sending anything to Boogi, and ask Boogi to delete what it holds, except what is needed to pay cashback you have already earned. Cashback you have already earned is not affected.

Records of your choice. We keep a record each time you join or leave earnr, so that we can show that you consented and when you withdrew. Each record holds the version of the earnr wording you were shown, the time, your IP address and your browser or device’s user agent. We add a new record for every change rather than overwriting earlier ones. We keep these records only to evidence your consent; see Data retention below.

Complaints

If you have a complaint relating to Open Banking services provided through the Boshhh platform, please contact us in the first instance at complaints@boshhhgroup.com.

If you are not satisfied with the outcome of your complaint, you may also be entitled to refer the matter to the Financial Ombudsman Service.

Data retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, taking into account legal, regulatory, and operational requirements. Enquiry and sales-related data is typically retained for up to twelve months. Customer, assessment, and verification data may be retained for longer periods where required by regulation or to establish, exercise, or defend legal claims.

Open banking and transactional data is retained for the minimum period necessary. Marketing and preference records are retained until withdrawn. Data is securely deleted or anonymised when no longer required.

Records of your choices to join or leave earnr, including the wording version, time, IP address and user agent, are kept for as long as you are an earnr member and for six years after you leave, so that we can evidence your consent.

Your rights

You have the right to access your personal data, request correction of inaccurate or incomplete data, request deletion in certain circumstances, restrict processing, and object to processing where we rely on legitimate interests. Where processing is based on consent, you have the right to withdraw that consent at any time.

You may also request data portability where applicable. Requests can be made by contacting privacy@boshhhgroup.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

Automated decision-making

Some services involve automated processing, including profiling, to support affordability, eligibility, or verification outcomes. Where decisions are based solely on automated processing and have legal or similarly significant effects, individuals have the right to request human intervention, express their view, and contest the decision.

International data transfers

Where personal data is transferred outside the United Kingdom, appropriate safeguards are applied, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include access controls, encryption, monitoring, and staff training, and are reviewed regularly to ensure ongoing effectiveness.

External links

Our websites may contain links to third-party sites or services. We are not responsible for their privacy practices and encourage users to review the relevant privacy policies.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be published with a revised effective date. We encourage users to review the policy periodically.

If the earnr wording changes in a way that matters, for example a new cashback partner or the use of a longer transaction history, we will ask existing earnr members to agree again rather than relying on their earlier consent.

Contact us

If you have any questions about this Privacy Policy or how personal data is handled, please contact privacy@boshhhgroup.com. For general support enquiries, contact help@boshhhgroup.com.