This Privacy Notice sets out how we’ll use your personal data. Your personal data is data which by itself or with other data available to us can be used to identify you. We use your personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
The types of personal data we collect and use
Whether or not you become a customer, we’ll use your personal data for the reasons set out below and if you become a customer we’ll use it to manage your loan.
The sources of personal data collected indirectly are mentioned in this statement. The personal data we use about you may include:
- Full name and personal details including contact information (e.g. home address and address history, email address, home and mobile telephone numbers);
- Date of birth and/or age (e.g. to make sure that you’re eligible to apply);
- Financial details (e.g. salary and details of other income, expenditure and details of accounts with other providers);
- Information from credit reference or fraud prevention agencies, electoral roll, court records of debt judgements and bankruptcies and other publicly available sources;
- Family, lifestyle or social circumstances (e.g. the number of dependants you have);
- Employment details/employment status for credit and fraud prevention purposes; and Personal data about other named applicants. You must have their authority to provide their personal data to us and share this Privacy Notice with them beforehand together with details of what you’ve agreed on their behalf.
Providing your personal data
You must provide your personal data so we can process your application (unless you’re a customer and we already hold your details).
Using your personal data: the legal basis and purposes
We’ll process your personal data:
- As necessary to perform our contract with you for the relevant loan:
To take steps at your request prior to entering into it;
To decide whether to enter into it;
To manage and perform that contract;
To update our records; and
To trace your whereabouts in order to contact you about your loan and recovering debt.
- As necessary for our own legitimate interests or those of other persons and organisations, e.g.:
For good governance, accounting, and managing and auditing our business operations;
To search at credit reference agencies (CRA’s) at your home address;
To monitor emails, calls, other communications, and activities on your account;
To send you marketing communications
- As necessary to comply with a legal obligation, e.g.:
When you exercise your rights under data protection law and make requests;
For compliance with legal and regulatory requirements;
For establishment and defence of legal rights; and
For activities relating to the prevention, detection and investigation of crime;
To verify your identity, make credit, fraud prevention and anti-money laundering checks;
- Based on your consent, e.g.:
When you request us to disclose your personal data to other people;
To send you marketing communications where we’ve asked for your consent to do so.
You’re free at any time to change your mind and withdraw your consent. The consequence might be that we can’t do certain things for you.
Sharing of your personal data
Subject to applicable data protection law we may share your personal data with:;
- Companies and other persons providing services to us;
- Our legal and other professional advisors;
- Fraud prevention agencies, CRA’s, and debt collection agencies when we open your loan account and periodically during your loan;
- Government bodies and agencies in the UK and overseas (e.g. HMRC and with regulators e.g., the Financial Conduct Authority, the Information Commissioner’s Office);
- Courts, to comply with legal requirements, and for the administration of justice;
- In an emergency or to otherwise protect your vital interests;
- To protect the security or integrity of our business operations;
- To other parties connected with your loan e.g. guarantors and other people named on the application including joint loan holders who will see your transactions;
- When we restructure or sell our business or its assets or have a merger or re-organisation; and
- Anyone else where we have your consent or as required by law.
Identity Verification and Fraud Prevention Checks
The personal data we’ve collected from you at application or at any stage will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment in future. We may also search and use our internal records for these purposes.
Credit Reference Checks
In order to process your application, we’ll perform credit and identity checks on you at your home address with one or more credit reference agencies (CRA’s). To do this we’ll supply your personal data to the CRA’s and they’ll give us information about you. When we carry out a search at the CRA’s they’ll place a “footprint” on your credit file. A credit search will be undertaken where you’ve agreed/requested Us to proceed with your application for credit and this will leave a footprint. This footprint will be viewable by other lenders and may affect your ability to get credit elsewhere. We may also continue to exchange information about you with CRA’s while you have a relationship with us. The CRA’s may in turn share your personal information with other organisations. Details about your application (whether or not it’s successful) will be recorded and we may give details of your loans and how you manage them to CRA’s. If you do not repay any debt in full or on time, they’ll record the outstanding debt and supply this information to others performing similar checks, to trace your whereabouts and to recover debts that you owe. Records remain on file for 6 years after they are closed, whether settled by you or defaulted. A financial association link between joint applicants will be created at the CRA’s. This will link your financial records and be taken into account in all future applications by either or both of you until either of you apply for a notice of disassociation with the CRA’s.
The identities of the CRA’s, and the ways in which they use and share personal information is explained in more detail in the ‘Using My Personal Data’ booklet, or via the Credit Reference Agency Information Notice (CRAIN) document which can be accessed via any of the following links:
Criteria used to determine retention periods (whether or not you become a customer)
The following criteria are used to determine data retention periods for your personal data:
- Retention in case of queries. We’ll retain your personal data as long as necessary to deal with your queries (e.g. if your application is unsuccessful);
- Retention in case of claims. We’ll retain your personal data for as long as you might legally bring claims against us; and
- Retention in accordance with legal and regulatory requirements. We’ll retain your personal data after your loan account has been closed or has otherwise come to an end based on our legal and regulatory requirements.
Your rights under applicable data protection law
Your rights are as follows:
- The right to be informed about our processing of your personal data;
- The right to have your personal data corrected if it’s inaccurate and to have incomplete personal data completed;
- The right to object to processing of your personal data;
- The right to restrict processing of your personal data;
- The right to have your personal data erased (the “right to be forgotten”);
- The right to request access to your personal data and information about how we process it;
- The right to move, copy or transfer your personal data (“data portability”);
If you have question, want to exercise your rights or make a complaint, please contact us.
You can also make a complaint to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 SAF, telephone 0303 123 1113, www.ico.org.uk