Notice before consent
Before collecting personal data, tell the person what data you collect, why, and how to withdraw consent or complain. Keep the notice short and in plain language, and offer it in the language of the form.
Consent that is specific and unbundled
Consent should be free, specific, informed and unambiguous, given by a clear affirmative action. Avoid pre-ticked boxes, and separate consent for being contacted about a loan from consent for unrelated marketing.
- One checkbox for the loan enquiry, a separate optional one for offers.
- Name who will contact the user, including lender partners.
- Link to the full privacy notice next to the button.
Withdrawal and retention
Withdrawing consent should be as easy as giving it, for example a reply keyword on WhatsApp or a link in every message. Delete or anonymise lead data once its purpose is served, and keep a record of when and how consent was captured.
Frequently asked questions
- Does a Meta instant form count as consent?
- It can be part of it, if the form includes a clear notice, a privacy policy link and an affirmative submit action. Keep a record of the form version used.
- Do DSAs need their own privacy policy?
- Yes. A DSA collecting lead data is responsible for how it uses that data, separately from its lender partners.
This guide is a marketing summary, not legal advice. Platform policies and regulations change; always confirm against the official source and your compliance team.