Welcome to the Pepper Money privacy notice.

Pepper Money respects your privacy and is committed to protecting your personal data. This privacy notice explains:

• What personal information we hold and how we collect it;
• How we may use it (and when we cannot);
• Who we may share it with; and
• Your privacy rights and how the law protects you.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

This privacy notice may be updated from time to time. This means we may send you an updated copy (where required). For access to historic versions, please contact us.

Purpose

This privacy notice provides information on how Pepper Money collects and processes your personal data, including through:

• Any data you may provide when applying to enter, or before entering, into a contract with us;
• Your use of our website, mobile device applications, web chat, secure messaging, and/or face identification, verification and recognition technology;
• A secure third-party messaging platform (e.g. WhatsApp for Business), which may be integrated with an AI-powered chatbot provided by a trusted service provider, to enable us to enhance customer service through automated interactions. The AI bot may process personal data shared during conversations in order to fulfil a range of services and respond to customer enquiries. The data processed through this service will be used in accordance with this privacy notice;
• Emails or letters;
• When you talk to us, including recording of calls and notes we make;
• Our records or records created by our service providers, for example where a profile or account is set up for you;
• Customer feedback surveys to help us assess the clarity of the information we provide, whether we are meeting the relevant regulatory requirements, and whether the products, propositions and services we offer before and during the term of your mortgage are suitable;
• Your participation in our competitions and/or promotions; or
• When third parties share certain data (with your consent) with us.

The website is not intended for children.

It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data, so that you are fully aware of how and why we are using your data. This privacy notice supplements such privacy notices and is not intended to override them.

Controller

UK Mortgage Lending Ltd trading as Pepper Money (“Pepper Money”, “we”, “us” or “our” in this privacy notice) is the data controller responsible for ensuring that your personal data is processed in compliance with applicable data protection laws.

Pepper Money belongs to the Pepper Money Group (meaning UK Mortgage Lending Ltd, Pepper Money Limited and Pepper Money (PMB) Limited). We may share your information, where necessary, with other entities within the Pepper Money Group.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions relating to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Contact details

Full name of legal entity: UK Mortgage Lending Ltd

Email address: [email protected]

Postal address: 4 Capital Quarter, Tyndall Street, Cardiff CF10 4BZ

Complaints

If you have concerns about how we collect, use, share or otherwise process your personal information, you have the right to make a complaint to us.

You can make a data protection complaint using the contact details and process set out in the complaints section of our website: Make A Complaint.

We will acknowledge your complaint within 30 days of receiving it. We will investigate your complaint and inform you of the outcome without undue delay, in accordance with our complaints procedure and applicable data protection laws.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO and would be grateful if you could contact us in the first instance (however you have the right to complain to the ICO directly).

Using our online calculators

We have a mortgage calculator for each of our products. If you use one of our online calculators, you may be asked to provide us with details of your financial situation and requirements. The information we ask for will depend on the mortgage calculator you choose. If you would like the results of the calculator (for first mortgage calculators only) to be sent to you, we will need your name and email address. We do not retain any of the details entered into the calculators.

Personal data, or personal information, means any information about an individual from which that person can be identified, whether directly or in combination with other information. It does not include data where the identity has been removed so that the individual is no longer identifiable (anonymous data).

We process your personal information for the primary purpose of providing our services, depending on the basis of your relationship with us (whether as an intermediary and/or broker, a customer (commercial and residential, including first and second charge), or as a visitor to our website).

Intermediary/Brokers

The information we generally process about you includes information that you provide by filling in forms on our website, by communicating with us, by attending face to face events, by phone, email or any other means. This information may include:

Identity Data

• Your full name and title;
• Your email address, work and mobile telephone numbers;
• Your date of birth and/or age;
• Company registration details;
• Company director details (name, email address, date of birth);
• Professional indemnity insurance cover; and
• Your social media profile.

Regulatory Data

• Your FCA registration number, status and permissions;
• Data protection public register details held by the Information Commissioner’s Office (ICO);
• Company registration details; and
• Company director details (name, email address, date of birth).

Financial Data

• Your bank account and payment card details.

Business Interactions Details

• Information about products you are searching for or applying for on behalf of your customers;
• Anonymised and aggregated data about your customers, which allows us to track your performance;
• Information about the commission you earn on sales of our products to your customers; and
• Feedback you provide about our products and services.

Credit Reference Agency Data

• Credit Data; and
• Information about you from third parties such as credit reference agencies, fraud prevention agencies, insolvency practitioners, debt advisers, tracing agents, commercial databases, marketing databases, public records, and other publicly available information sources, including information about your business or company (e.g. previous credit applications, personal credit information, the electoral register and fraud prevention information).

Technical and Profile Data

• Security identifiers including, for instance, your mother’s maiden name;
• Your username and password;
• Your interests, preferences, feedback and survey responses;
• Your mobile phone location data, IP address and MAC address, if you get in touch with us online;
• Information about how you use our website, mobile device applications, secure messaging, and web chat services for products and services;
• Information created, aggregated and/or added to your account/profile by our systems/our supplier’s systems where we use them to process and/or supplement your personal data; and
• Pixel data (a pixel is a tiny image that may be embedded within web pages and emails and requires a server call to provide device and visit information in order for the pixel to be rendered). We use pixels to learn more about your interactions with email content or web content, such as whether you interact with ads or posts, and the times of the day when you are most likely to engage with our communications. Pixels can also enable us and third parties to place cookies on your browser. We may use this data, where you have consented to cookies, to improve your experience with our brand and to market to you via our marketing channels, including (but not limited to) email, web experience and social media.

Marketing and Communications Data

• Information about your marketing preferences, communication preferences and your interactions with marketing communications from us and/or companies within the Pepper Money Group; and
• Your responses to any surveys that we send you. These may include but are not limited to: the products you are sourcing and placing for your customers, your experience working with us, your customers’ experience of us, the literature and information that we are providing you.

Borrowers (including commercial applicants, joint applicants, and guarantors, and individuals acting under a power of attorney)

If you make a joint application with your spouse, partner or family member, or an application on behalf of a company, we will also collect the personal information mentioned below about that person, or, where relevant, shareholder and/or co-director. You must show this privacy notice to the other applicant and ensure they confirm to you that they agree to you sharing their personal information with us for the purposes described in it. If you refer to the section on “How we use your personal data”, you will see reference to consent and a description of some limited scenarios where it may be relevant to what we do with personal information.

If you apply for your mortgage with a guarantor, we will make  this privacy notice available to that person where we collect their information. They will also be able to access the privacy notice via our website.

If there is somebody who has power of attorney for your affairs, then we will make that person aware of this privacy notice when we contact them directly.

The information that we generally process in connection with our services includes:

Identity Data

• Your full name and title;
• Your home address (including address history) and correspondence address (where different from your home address);
• Your email address, home and mobile telephone numbers;
• Your date of birth and/or age;
• Identification documents, including document type, date of expiry and country of issue;
• Your e-signature;
• Your nationality, where necessary to comply with legal and regulatory requirements; and
• Records of how you have contacted us and, if you get in touch with us online, details such as your mobile phone location data, IP address and MAC address.

Financial Data

• Details of shareholdings, prominent functions, directorships and/or employment, including, for instance, your occupation, salary, employer and length of service;
• Where relevant, information about any co-director or guarantor which you provide in any application;
• Information about your employment status, including whether you are employed/self-employed, retired or receive benefits;
• Information about the performance of your mortgage;
• Where relevant, in relation to adverse credit, information about creditors and supporting references; and
• Your bank account and payment card details (including the full legal name of any account holders, account status (open/closed), account number, sort code, account balance, and details of transactions over the preceding 12 months).
• Information about your income, expenditure, assets, liabilities, indebtedness, credit commitments and overall financial circumstances;
• Bank statements, utility bills, payslips, tax records, accounts, management accounts, accountant certificates and other financial documents or evidence that you provide to us, or which are provided to us on your behalf, in connection with an enquiry, application or account;
• Information obtained through Open Banking services where you have authorised this;
• Information relating to the affordability of a loan, your ability to repay amounts owed, and assessments of your financial position;
• Information generated during the administration and performance of your mortgage or other financial products with us, including payment history, account balances, arrears information, transaction records, settlement information, redemption information and records of account activity; and
• Information relating to any security provided, including details of properties offered as security and valuations relating to those properties.

Residency Data

• Information about your occupancy status, such as whether you are a tenant, live with parents or are an owner-occupier of the property in which you live at the time of your application;
• Information relevant for your residency and/or citizenship status, such as your nationality, your length of residency in the UK and/or whether you have the permanent right to reside in the UK; and
• For residential customers, your marital status, family, lifestyle or social circumstances where relevant to the mortgage product (e.g. the number of dependants you have or if you are a widow or widower).

Credit Reference Agency Data

• Personal information which we obtain from Credit Reference Agencies and fraud prevention agencies (see the section on “Fraud Prevention Agencies”).

Health Data

• Information about your health, medical conditions, disabilities, support needs, vulnerability or other circumstances that may affect how we provide our products and services to you.

Biometric Data

• Where we use facial identification, verification or recognition technologies as part of our application, onboarding, identity verification or customer authentication processes, biometric data derived from images or video recordings used to uniquely identify or verify you.

Technical and Profile Data

• Details of your services with us, including, for example, application information (including online applications), affordability assessments (including online calculators, tools and guides), credit history, customer ID number, account number, account balance, account history, security or collateral held by us, and details relating to any other signatories and/or guarantors;
• Your interests, preferences, feedback and survey responses;
• Information about how you use our website, mobile device applications, secure messaging, and web chat services for products and services;
• Information created, aggregated and/or added to your account/profile by our systems/our supplier’s systems where we use them to process and/or supplement your personal data;
• Details about payments to and from you and other details of products and services you have purchased from us.
• Pixels data (a pixel is a tiny image that may be embedded within web pages and emails and requires a server call to provide device and visit information in order for the pixel to be rendered). We use pixels to learn more about your interactions with email content or web content, such as whether you interact with ads or posts, and the times of the day when you are most likely to engage with our communications. Pixels can also enable us and third parties to place cookies on your browser. We may use this data, where you have consented to cookies, to improve your experience with our brand and to market to you via our marketing channels, including (but not limited to) email, web experience and social media.

Marketing and Communications Data

• Information about your marketing preferences, communication preferences and your interactions with marketing communications from us and/or companies within the Pepper Money Group;
• Your responses to any surveys that we send you. These may include, but are not limited to: your products, your credit profile, the service we have provided you, the clarity of and your understanding of the information we have provided you.

Aggregated Data

• Aggregated data, such as statistical or demographic data, for any purpose. Aggregated data may be derived from your personal data but will not be considered personal data in law where   it does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data such that it directly or indirectly identifies you, we treat  that aggregated data as personal data, and use it in accordance with this privacy notice.

If you fail to provide personal data

We are unable to provide you with products and services or to process your application without your personal information. Your personal information is required before you can enter into the relevant contract with us, during the life of that contract, and  to comply with legal obligations that apply to us. If we already hold some of the personal information that we need (for instance, if you are already a customer), we may not need to collect it again when you make your application.

In cases where providing some personal information is optional, we will make this clear in any discussions regarding the provision of that information. For instance, we will indicate in application forms, or via the broker or other intermediary, if certain fields (such as work telephone number) can be left blank.

Visitors to our website

Our website will collect your IP address, MAC address, device type, location and onsite behaviour. This data will be aggregated and anonymised.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements and/or notices. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Intermediary/Brokers

Directly from you

We will generally collect your personal information from you directly, including face-to-face interactions, application forms, letter or email correspondence, secure messaging, telephone, or via our website/mobile device applications.

We collect Technical and Profile Data about your equipment, interactions, voice analysis, browsing actions, usage data and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

We may also receive Technical and Profile Data about you if you visit other third-party websites that use our cookies. Please see the section on “Cookies” for further details.

Indirectly from third parties

From third parties such as credit reference agencies, the FCA, fraud prevention agencies, insolvency practitioners, debt advisers, tracing agents, commercial databases, marketing databases, public records and other publicly available information sources, including information about your business or company (e.g. previous credit applications, personal credit information, the electoral register and fraud prevention information).

We may also receive Technical and Profiling Data about you from third party suppliers, third party analytics or search providers, or we might create some of this data using our own systems.

Borrowers (includes commercial applicants, joint applicants, and guarantors, and individuals acting under a power of attorney)

Directly from you

We will generally collect your personal information from you directly, including application forms, letter or email correspondence, secure messaging, telephone, or via our website/mobile device applications.

We collect Technical and Profile Data about your equipment, interactions, voice analysis, browsing actions, usage data and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

We may also receive Technical and Profile Data about you if you visit other third-party websites that use our cookies. Please see the section on ”Cookies” for further details.

Indirectly from third parties

If you are introduced to us by a broker or other intermediary, we will obtain some personal information about you indirectly from them at the point they introduce you to us.

With your permission via Open Banking, we may access specific details about accounts you hold with other banks to help us make lending decisions.

We might receive information from other individuals involved in your mortgage application, or where you are a dependant of or guarantor for an applicant.

From other third-party sources such as fraud prevention agencies, Credit Reference Agencies, your employer, landlord, other lenders, HM Revenue & Customs (HMRC), The Department for Work and Pensions (DWP), publicly available directories and information (e.g. telephone directory, social media, the internet and news articles), debt recovery and tracing agents, other organisations that assist in the prevention and detection of crime, and the police and law enforcement agencies.

We may also receive Technical and Profiling Data about you from third party suppliers, third-party analytics or search providers, or we might create some of this data using our own systems.

Face Identification, Verification and Recognition Technology
Where we use face identification, verification or recognition technologies as part of our application, onboarding, identity verification or customer authentication processes, we may collect images, video recordings and other information required to verify your identity.

Where this involves the processing of biometric data, we will only do so where we have both a lawful basis under Article 6 UK GDPR and where an appropriate condition under Article 9 UK GDPR applies.

For your own privacy and protection, please ensure that during any live identification session your  surroundings do not include items or information that you do not wish to be recorded.

Secure Instant Messaging

We, either on our own or in conjunction with a broker or other intermediary engaged by us, may process your personal information to set up and administer your account. The secure instant messaging platform will be used to:

• provide correspondence, data, documentation and personal information (between you and us) as part of joining and applying for a mortgage and before entering into a contract with us;
• provide images of documentation and yourself to support our identification checks and fraud and money laundering controls; and
• discuss any queries about your account.

Electronic Signatures

We utilise electronic signature applications to enable contracts and notices to be signed. In utilising such tools, our employees, brokers acting on our behalf, third-party suppliers and you may provide limited personal data for the purposes of:

• business execution, in particular the conclusion and execution of agreements between us and you;
• compliance with legal or regulatory requirements, including litigation and the defence of claims; and
• the prevention, detection and investigation of fraud.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform  a contract that we are about to enter into, or have entered into, with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where necessary to protect your or someone else’s vital interests.
• Where we need to comply with a legal obligation.

Where we process health data, for example to record a vulnerability or other circumstances that may affect how we provide our products and services to you, or where we process biometric data for the purpose of uniquely identifying or verifying an individual, these categories of data may constitute special category personal data under the UK GDPR. In those circumstances, we will only process such data where we have both a lawful basis under Article 6 UK GDPR and an applicable condition under Article 9 UK GDPR. Depending on the circumstances, this may include your explicit consent or processing that is necessary for reasons of substantial public interest. Where we rely on a substantial public interest condition in connection with health data, this may include processing necessary to support individuals with a particular disability or medical condition, or to comply with regulatory requirements. Where we rely on a substantial public interest condition in connection with biometric data, this may include processing necessary to prevent fraud or to comply with regulatory requirements.

Purposes for which we will use your personal data

We have set out below, in table form, a description of all the ways in which we plan to use your personal data, and the lawful bases on which we rely to do so.

Please note that we may process your personal data for more than one purpose. The lawful basis on which we rely may differ depending on the purpose for which we are processing your personal data.

Please contact us if you need details about the specific lawful basis on which we rely to process your personal data where more than one lawful basis has been set out in the table below.

Intermediary/Brokers

Borrowers (includes commercial applicants, joint applicants, and guarantors and individuals acting under a power of attorney)

Much of what we do with your personal information is not based on your consent. Instead, we rely on other lawful bases for processing your personal information as permitted under data protection law. For processing that is based on your consent, you have the right to withdraw that consent at any time, although this will not affect the lawfulness of any processing carried out before consent was withdrawn. You can do this by contacting us using the details set out in the “Who are we and how can you contact us?” section.

We may send you marketing communications about our products and services where permitted by law. Depending on the circumstances, we may rely on your consent or, where permitted, our legitimate interests. Where we send electronic marketing communications, we will do so in accordance with the Privacy and Electronic Communications Regulations, including relying on the “soft opt-in” exemption where applicable.

Where we rely on the soft opt-in exemption, this will generally be where you have previously enquired about, applied for, obtained or held products or services with us, and we wish to contact you about our own similar products and services. Where consent is required by law, we will only send you marketing communications where you have provided that consent.

You can opt out of receiving marketing communications at any time by using the unsubscribe link included in our marketing emails or by emailing [email protected]. Opting out of marketing communications will not affect service communications that we need to send you in relation to your mortgage, account or use of our products and services.

If you receive marketing communications from your intermediary or broker, you should contact them directly to manage your marketing preferences and how they use your personal information, as they act as a separate data controller in their own right.

We work hard to protect your personal data. We use both technical and organisational measures to maintain the integrity and security of our systems and databases, including encryption for data transfer, firewalls and restricted access to data.

What do we do with your data and who do we share it with?

We may share your personal data with the parties set out below for the purposes set out in the table above:

• Internal third parties, including subsidiaries of the Pepper Money Group;
• External third parties such as:
  • Your guarantor (if you have one);
  • Joint account holders, co-directors, trustees and beneficiaries and any person with a power of attorney over your affairs (in each case only if relevant to you);
  • Credit reference agencies and fraud prevention agencies;
  • Other payment services providers, such as when you ask us to share information about your account with them;
  • Other account holders or individuals when we have to provide your information to them because money paid to you by them should not have been credited to your account;
  • The broker or other intermediary who introduced you to us;
  • Our legal and other professional advisers, auditors and actuaries;
  • Our service providers who undertake tasks on our behalf, which may involve the use of artificial intelligence (AI) for the processing purposes set out in this notice;
  • Financial institutions and trade associations;
  • Governmental and regulatory bodies such as HM Revenue & Customs (HMRC), the Financial Conduct Authority (FCA), the Financial Ombudsman Service (FOS), the Information Commissioner’s Office (ICO) and the Financial Services Compensation Scheme (FSCS);
  • Tax authorities outside the UK. For instance, if you are subject to tax in another jurisdiction, we may share your personal information directly with relevant tax authorities in that jurisdiction (instead of via HMRC);
  • Other organisations and businesses that provide services to us, such as debt recovery agencies, backup and server hosting providers, IT software and maintenance providers, providers of artificial intelligence (AI) services that support the administration and servicing of mortgage accounts, document storage providers and suppliers of other back-office functions;
  • Insurers of any asset securing, or proposed to secure, your liabilities;
  • Our funding partners and equity providers to facilitate our funding through forward flow and securitisation transactions. This may include any prospective or actual funder, investor, purchaser, or transferee of all or part of our business and assets (or their advisors). In some cases, the funder will act as an independent controller of your data, meaning they will process your data according to their own privacy notice. You can view a list of our current funders who are independent controllers here;
  • Rating agencies and other relevant parties and their professional representatives as part of any actual or potential restructuring or sale of any or all of our assets; and
  • Market research organisations who help us to develop and improve our products and services. These firms may get in touch to ask you for your opinions and feedback. Sometimes these firms will combine what you tell them with data from other sources for analysis. They will use this to produce reports and advice that help us understand our customers’ views so that we can improve the way we operate as a business.

To comply with payment services regulations, we have to share some of your personal information with other payment service providers in some circumstances such as when you ask us to share information about your account with them. Whilst those payment services regulations mention ‘consent’, the term, ‘consent’ in that context does not have the same meaning as ‘consent’ under data protection laws. The lawful bases which may be relevant to this are compliance with our legal obligations, performance of our contract with you, our legitimate interests, or a combination of these.  As a result, even if you withdraw consent you have provided under data protection laws, we may still need to hold and use your personal information where this is necessary to comply with payment services regulations or for another applicable lawful basis.

We are based in the UK but sometimes your personal information may be transferred outside the UK or the European Economic Area (EEA). If it is processed within the UK, the EEA or countries that benefit from an adequacy decision, then it is protected by applicable data protection laws and standards. Some countries outside the UK and EEA are recognised as providing an adequate level of protection for personal information. We will ensure that appropriate safeguards are in place before transferring your personal information to countries outside the UK or EEA where an adequate level of protection is not recognised. These safeguards may include use of the UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting us at the details set out at the beginning of this notice.

Where the borrowing is on behalf of a company, we will obtain a Credit Safe Report. This may involve the transfer of personal information outside of the UK or EEA.  We ensure that appropriate safeguards are in place to protect any transfer of your personal information outside of the UK or EEA.

For more information about the safeguards we use to protect your personal information when it is transferred outside of the UK or EEA, please contact us using the details above.

Credit reference agencies

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies.

Where you obtain mortgage services from us, we may also make periodic searches at Credit Reference Agencies to help us manage and review your account.

To do this, we will supply your personal information to Credit Reference Agencies, and they will provide us with information about you. This will include information from your credit application and information about your financial situation and financial history.

Where you are making a commercial application, this will include information about you and any co-directors.

Credit Reference Agencies will supply to us with both public information (including information from the electoral register) and shared information relating to your credit history, financial situation, financial history,  and fraud prevention records.

We will use this information to:

• Assess your, or where the borrowing is on behalf of a company, your company’s creditworthiness and whether you/it can afford to take out the product;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Manage your account(s);
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate for your circumstances.

We will continue to exchange information about you with Credit Reference Agencies while you have a relationship with us. We will also inform the Credit Reference Agencies about your settled accounts. If you, as a residential customer, borrow money and do not repay it in full and on time, Credit Reference Agencies will record the outstanding debt. This information may be supplied to other organisations by Credit Reference Agencies.

The identities of the Credit Reference Agencies, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, their data retention periods, and your data protection rights in relation to the Credit Reference Agencies are explained in more detail later in this privacy notice.

When Credit Reference Agencies receive a search from us, they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a commercial application, a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them and share with them this privacy notice, before submitting the application.

Credit Reference Agencies will also link your records together, and these links will remain on both your and their files until you or your partner successfully apply for a disassociation with the relevant Credit Reference Agency, to break that link.

Fraud prevention agencies

The personal information we have collected from you will be shared with fraud prevention agencies, which will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your personal information will be used by us and these fraud prevention agencies, and details of your data protection rights, can be found later in this privacy notice.

When your personal information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently anonymise it.

However, most of the personal information will be retained by us for up to twelve years after your account is closed, unless a longer retention period is required because of queries from you, legal claims made by you or against you, and/or legal or regulatory requirements to which we are subject. We will not retain your personal data for longer than is necessary for the purposes for which it was collected. If you would like further information about our data retention practices, please contact us.

Applications that do not proceed

If we do not proceed with your application or if you decide not to proceed with the rate we have proposed, we will retain some of your personal information related to the application or the pre-application quotation searches (including information about whether you applied through a broker or other intermediary) for the following legitimate interests:

(a) We have a legitimate interest in managing the risk to our business of money laundering, fraud and other crimes, and in meeting our legal and regulatory obligations in these circumstances. We need to be able to identify where there is a particular risk of these serious issues arising. For example, if an individual (or an individual acting on behalf of a company) resubmits an application or makes a second pre-application enquiry for a rate quotation, and does so through a different broker or intermediary while amending certain details or circumstances, it would be important for us to identify that.

Similarly, if our identity checks, anti-money laundering checks, checks with fraud prevention agencies or Credit Reference Agencies carried out before or during the application process reveal a potential risk, we would retain the relevant details until we were satisfied that we no longer needed them for the legitimate interest described above.

(b) Where an individual decides not to proceed with the rate that we offer, we have a legitimate interest in keeping a record of that rate and some of the personal information related to our offer so that we can  take it into account if an individual (or an individual acting on behalf of a company) resubmits an application or makes a second enquiry. It would be contrary to this legitimate interest if individuals were able to resubmit an application through another broker or intermediary soon afterwards and we were unable to identify the rates we had already offered following consideration of their initial application.

It is necessary to process and retain personal information for these legitimate interests, and we have balanced these against your own interests, rights and freedoms. In circumstances such as these, we do not retain your personal information for longer than necessary, nor do we do not share it with third parties for these purposes. Your personal information is used for our business purposes and in accordance with data protection laws.

When processing your personal data for the purposes set out in this notice (including when making certain decisions about you), we may use artificial intelligence, machine learning or similar technologies (“AI”) to support our products, services and business operations. For example, we may:

• use AI to help us in providing our services and products to you or to your customers, and to help make our internal processes and those of our suppliers more efficient. For example, these technologies may help us to review whether documentation provided to us is sufficient for our purposes and required checks, to undertake an initial review of a mortgage application to identify issues for an individual to review and consider, or to draft and refine documentation; and
• use AI to assist with fraud prevention, identity verification, customer communications and other operational processes.

For certain second charge mortgage products, where you apply through a broker or intermediary, we use an automated product eligibility assessment tool to help identify which products may be available to you. The tool assesses information submitted by or on behalf of you, together with information obtained from credit reference agencies, and compares that information against our product eligibility criteria.

The tool is designed to assist brokers and intermediaries in identifying second charge mortgage products that may be available based on the information provided. Depending on the outcome of the assessment, the tool may indicate that one or more products are available or that no products are currently available based on the information submitted. Where no products are returned, your broker or intermediary may be able to review the information provided, update or correct it where appropriate, and submit revised information to determine whether different products may be available.

The outcome of this assessment may affect which second charge mortgage products are presented as potentially available based on the information submitted, including indicating that no products are currently available.

The results generated by this tool are intended to indicate potential product availability and should be considered by your broker or intermediary alongside their understanding of your circumstances. The tool does not make a final lending decision and any subsequent mortgage application will be subject to review by appropriately authorised individuals as part of our underwriting and lending processes.

Because this process uses automated processing to assess information and determine potential product availability, it may constitute automated decision-making for the purposes of applicable data protection laws. Where this applies, you have the right to obtain information about the decision, make representations regarding the decision, request human intervention and contest the outcome.

If you wish to exercise any of these rights, you should contact the broker or intermediary who submitted the information on your behalf in the first instance. Alternatively, you may contact us using the details set out in “Who are we and how can you contact us?” section.

Outside of the second charge mortgage product eligibility assessment process described above, we do not solely rely on automated processing when making decisions that produce legal or similarly significant effects concerning you. In particular, final lending decisions are made by appropriately authorised individuals and are not based solely on automated processing.

You have a number of legal rights in relation to the personal data that we hold about you. They do not apply in all circumstances, and your exercise of these right may be restricted. If there is such a restriction, we will explain it in more detail when you contact us to exercise your rights. 

Here is a list of the rights that all individuals have under data protection laws:

• The right to be informed about our processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed (“right to rectification”);
• The right to object to the processing of your personal information (“right to object”);
• The right to restrict the processing of your personal information (“right to restrict processing”);
• The right to have your personal information erased (the “right to be forgotten”);
• The right to request access to your personal information and to obtain information about how we process it (“right of access”) – you are entitled to receive a copy of your personal data free of charge, subject to certain exemptions;
• The right to move, copy or transfer your personal information to another organisation in a structured, commonly used and machine-readable format (“right to data portability”);
• Rights related to automated decision-making that has a legal effect on you or otherwise significantly affects you, including the right to obtain human intervention, to express your point of view, and to contest the decision.
• The right to complain to us if you believe we have not complied with data protection law when handling your personal information.
• The right to complain to the Information Commissioner’s Office, which enforces data protection laws: https://ico.org.uk/

If you wish to access your personal information, please contact us in writing at 4 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ or via email using the address: [email protected]

If you wish to exercise any of these rights against the Credit Reference Agencies, the fraud prevention agencies, or a broker or other intermediary who is a data controller in its own right, you should contact them separately. 

In this section, monitoring means any listening to, recording viewing, intercepting, or taking and keeping records (as applicable) of calls, emails, text messages, social media messages, face-to-face meetings, and other communications.

We may monitor where permitted by law, and we will do so where required by the law. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or face-to-face meetings (as relevant), we will do so.

Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, to protect the security of our communications systems and procedures, to maintain  a record of discussions and agreed actions, to protect you, to help keep your account secure (including in relation to fraud risks) and for quality assurance and staff training purposes.

Our monitoring may include checks for obscene or profane content in communications.

We may conduct carefully controlled, short-term monitoring of activity on your account(s) where this is necessary for our legitimate interests or to comply with our legal obligations. For instance, where we suspect fraud, money laundering or other criminal activity.

Telephone calls, written communications, emails (including mobile device applications, secure messaging and webchats) and/or  face-to-face meetings between you and us in connection with your application and/or your account(s) may be recorded to ensure that we have an accurate record of what has been discussed and any instructions you have provided. We may also record these communications for quality assurance and staff training purposes.

We may use your home address, business address, phone numbers, email address and social media accounts to provide you with information about our products and services. In all instances, we will only send you marketing communications in accordance with your marketing preferences.

You can stop our marketing at any time by contacting us or by following the unsubscribe instructions included in any marketing email or other marketing communications that we send you.

We may also use cookies and similar technologies from visits to our website to market to you across Google and other search engines, certain websites, social media platforms and other messaging platforms. You can opt out of this by managing your cookie preferences on our website.

• gather information about your computer to help us provide content to you in the most appropriate way;
• help us better understand your customer journey, for example, how you arrived at our site and which page you visited before leaving; and
• capture general information, such as your geographical location.

What are cookies? 

• Essential cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website while they are using it. This helps us to improve the way our website works, for example, by ensuring that users can easily find what they are looking for.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests.

Potential consequence of allowing cookies 

• Google Analytics
• Facebook

How do I change my cookie setting?

We may also use cookies for remarketing or re-engagement purposes. Our website and other technologies use the remarketing function of third-party sites. This feature is designed to show interest-based ads to visitors to our website.

This means that your browser will store cookies that allow you to be recognised when visiting websites operated by third parties. As a result, we may advertise to you if you have not completed a task on our website. This  may take the form of an advertisements displayed on social media platforms or other websites that support remarketing.

Third-party vendors, including search engines and social media platforms, use cookies to serve advertisements based on your previous visits to our website. Any personal information collected will be used in accordance with our privacy notice and the relevant third party’s privacy notice.

You can opt out of a third party’s use of cookies or device identifiers by adjusting your advertising settings on the relevant platform. Alternatively, you can opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt-out page or manage the use of device identifiers through your device settings.

You will see in the body of this privacy notice that we may share your personal information with fraud prevention agencies and Credit Reference Agencies. They require us to pass on to you information about how they will use your personal information when performing their services or functions as data controllers in their own right. These notices are separate from our own. 

Here are links to the information notices of four Credit Reference Agencies that we use:

• Callcredit
• Equifax
• Experian
• Creditsafe 

Further details of how your information will be used by us and fraud prevention agencies, and your data protection rights, can be found by accessing the following link: Fair Processing Notices for Cifas’ Databases | Cifas