Privacy Notice

Tried and trusted since 1859, Chorley and District Building Society takes Members’ privacy seriously.

Based at Key House, Foxhole Road, Chorley, Lancashire, PR7 1NZ, the building society is officially classed as a data controller of your ‘personal information’. This is information about you or from which we can identify you, such as names, addresses, phone numbers, email addresses and financial details.

We are registered with the UK’s Information Commissioner’s Office (ICO) under registration number Z5708404.

As a data controller, we have to follow rules on the way your personal information is processed and this privacy notice explains how and why we do so.

When we use terms such as ‘we’, ‘us’ and ‘our’ in this notice, we mean Chorley and District Building Society.

Our Data Protection Officer can be contacted if you have any queries about this privacy notice or wish to exercise any of the rights mentioned in it by writing to Key House, Foxhole Road, Chorley, Lancashire PR7 1NZ or by email to DPO@chorleybs.co.uk

This privacy notice may be updated from time to time. You should check this page regularly so that you can read the up to date version.

Our products and services are available through our own branches and on our own website as well as through professional and financial advisors and anyone else who acts as a person sitting in between you and us in relation to what we do for you. In this notice we will call these persons “brokers or other intermediaries”.

If you are using brokers or other intermediaries, our privacy notice only applies to the processing of your personal information that they may do on our behalf. You should receive a separate privacy notice from these brokers or other intermediaries where they are acting as a data controller of your personal information

When we refer to process or processing, this includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting, destroying, or transferring it overseas (if applicable).

The processing we do will depend on the products or services you apply for and obtain from us.

This includes:

  • Your title, full name, any previous names (where applicable) and contact details such as your email address and telephone numbers;
  • Your address, correspondence address (where different from your home address) and address history;
  • Your date of birth and/or age e.g. to make sure that you are eligible to apply for the product and/or that it is suitable for you;
  • Your nationality and national identifiers such as National Insurance Number or US Tax Identification Number;
  • Your signature;
  • Telephone voice recordings and video images (including CCTV) where applicable;
  • Information which is relevant for your residency and/or citizenship status, such as your length of residency in the UK and/or whether you have the permanent right to reside in UK;
  • Your financial details, such as your salary, income and expenditure and where necessary details of your other income and assets;
  • Your marital status, family, lifestyle or social circumstances if relevant to the product (e.g. the number of dependents you have and their ages);
  • Information about your employment status including your occupation, whether you are employed, self-employed, retired, student, homemaker or receive benefits;
  • Information about your tax position;
  • The purpose for obtaining the products or services you are applying for;
  • Records of how you have contacted us and, if you get in touch with us online, details such as your mobile phone location data, IP address and MAC address;
  • Personal information which we obtain from fraud prevention agencies (see the section on fraud prevention agencies below);
  • Some special categories of personal data such as about your health if you are a vulnerable customer;
  • Whether you hold a prominent public function (or if you are a family member or known close associate of such a person); and
  • Details of any unspent criminal convictions, pending convictions, bankruptcy/receivership, county court judgements, court records and pending orders. This will also include any sanctions or suspensions from any financial services regulator.

This includes:

  • Your financial details e.g. your salary and details of other income including any expected future changes, details of your savings, details of your expenditure, details of account(s) held with other providers if you pay your mortgage from those account(s), and the source of your deposit;
  • Details about all of your existing borrowings and loans;
  • Information about your occupier status, such as whether you are a tenant including landlord name and address (if applicable), live with parents or are on owner occupier of the property in which you live at the time of your application, together with your recent address history and details of the property you wish to mortgage;
  • Your credit history which we obtain from Credit Reference Agencies (see the section on Credit Reference Agencies below); and
  • Source of funds for any overpayments.

This includes:

  • Your financial details e.g. details of account(s) held with other providers to administer payments to and from you;
  • Where a person other than the savings account holder makes a withdrawal from the account, information about that person and the transaction;
  • Where a withdrawal is made to another person, information about that person and the transaction; and
  • Information relating to transactions, i.e. source of funds for deposits and purpose of withdrawals.

If you make a joint application with your spouse, partner or family member, or they are a guarantor, power of attorney, or other third party, we will also process the personal information mentioned above about that person. It is important that they are given the opportunity to read this privacy notice.

We will generally collect your personal information from you directly. If you are introduced to us by a broker, or other intermediary, we will obtain some personal information about you indirectly from them when they introduce you to us.

Some personal information is obtained from Credit Reference Agencies and this will have originated from publicly accessible sources. Credit Reference Agencies draw on court decisions, bankruptcy registers and the electoral register (also known as the electoral roll). We explain more about Credit Reference Agencies below.

In addition, where applicable we obtain your personal information from other sources such as someone who has authority to deal with your financial affairs, fraud prevention agencies, your employer, landlord, other lenders, HM Revenue & Customs, the Department for Work and Pensions, publicly available directories and information (e.g. telephone directory, social media, internet, news articles), debt recovery and/or tracing agents, other organisations to assist in the prevention and detection of crime, police and law enforcement agencies.

Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organisations). For some processing more than one legal ground may be relevant (except where we rely on consent). Here are the legal grounds that are relevant to us:

1) Processing necessary to perform a mortgage or savings contract with you or for taking steps prior to entering into it (during the application stage):

  1. a) Administering and managing your account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and in the case of mortgages doing this for recovering debt;
  2. b) Sharing your personal information with other payment services providers such as when you ask us to share information about your account with them;
  3. c) All stages and activities relevant to managing your account including enquiry, application, administration and management of accounts.

2) Data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Where we consider that, on balance, it is appropriate for us do so, processing necessary for the following legitimate interests which apply to us and in some cases other organisations (who we list below) are:

  1. a) Administering and managing your account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and in the case of mortgages doing this for recovering debt;
  2. b) To test the performance of our products, services and internal processes;
  3. c) To carry out monitoring and to keep records (see below);
  4. d) To administer our good governance requirements such as internal reporting and compliance obligations or administration required for AGM processes;
  5. e) For market research, analysis and developing statistics to better understand our customers’ needs and circumstances in order to improve our service/products;
  6. f) For direct marketing communications; and
  7. g) When we share your personal information with these other people or organisations;
  • Your guarantor (if you have one on any mortgage account you hold);
  • Joint account holders, trustees and beneficiaries and any person with power of attorney over your affairs (in each case only if relevant to you);
  • Other payment services providers such as when you ask us to share information about your account with them;
  • Direct Debit Scheme (if you use Direct Debits);
  • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
  • The broker or other intermediary who introduced you to us;
  • Our legal and other professional advisers, auditors and actuaries;
  • Financial institutions and trade associations;
  • Tax authorities who are overseas for instance if you are subject to tax in another jurisdiction we may share your personal information directly with relevant tax authorities overseas (instead of via HMRC);
  • Other organisations and businesses who provide services to us such as back up and server hosting providers, IT software and maintenance providers, our Valuer Panel Management Partner, our Legal Services Partner, our Fraud Prevention Agency, our chosen mail and print house, our Mortgage Indemnity Guarantee (MIG) provider and suppliers of other back office functions;
  • Buyers and their professional representatives as part of any restructuring or sale of our business or assets;
  • Credit Reference Agencies (see below where we explain more and refer to a separate leaflet for more information); and
  • Market research organisations who help us to develop and improve our products and services.

3) Processing necessary to comply with our legal obligations:

  1. a) For compliance with laws that apply to us;
  2. b) To fulfil our compliance obligations or administration required for Annual General Meeting (AGM) processes;
  3. c) For establishment, defence and enforcement of our legal rights;
  4. d) For activities relating to the prevention, detection and investigation of crime;
  5. e) To carry out identity checks, anti-money laundering checks, and checks with fraud prevention agencies pre-application, at the application stage, and periodically after that;
  6. f) To carry out monitoring and to keep records (see section below);
  7. g) To deal with requests from you to exercise your rights under data protection laws;
  8. h) To process information about a crime or offence and proceedings related to that (in practice this will be relevant if we know or suspect fraud); and
  9. i) When we share your personal information with these other people or organisations:
  • Your guarantor (if you have one on any mortgage account you hold);
  • Joint account holders, trustees and beneficiaries, and the person with power of attorney over your affairs;
  • Other payment services providers such as when you ask us to share information about your account with them;
  • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
  • Fraud prevention agencies;
  • Law enforcement agencies and governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Financial Ombudsman Service, the Information Commissioner’s Office and under the Financial Services Compensation Scheme (depending on the circumstances of the sharing); and
  • Courts and to other organisations where that is necessary for the administration of justice, and to protect the security or integrity of our business operations.

4) Processing with your consent:

  1. a) When you request that we share your personal information with someone else;
  2. b) When you consent to us sharing your contact details with Accord Legal Services (for Will Writing Services) for them to contact you directly about the services you are interested in;
  3. c) For direct marketing communications; and
  4. d) For some of our processing of special categories of personal data, such as about your health or if you are a vulnerable customer, (and it will be explained to you when we ask for that explicit consent what purposes, sharing and use it is for).

5) Processing to protect the vital interests of a person or for a substantial public interest under laws that apply to us where this helps us to meet our broader social obligations or safeguard others such as:

  1. a) Processing of your special categories of personal data such as about your health or if you are a vulnerable customer;
  2. b) Processing that we need to do to fulfil our legal obligations and regulatory requirements;
  3. c) When we share your personal information with other people and organisations if they need to know that you are a vulnerable customer such as your relatives, social services, your carer, or the person who has power of attorney over your affairs; and
  4. d) To protect vital interests.

Much of what we do with your personal information is not based on your consent, instead it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us using the details above. The consequence might be that we cannot take into account special categories of personal data such as about your health or if you are a vulnerable customer (but these outcomes will be relevant only in cases where we rely on explicit consent for this).

To comply with Payment Services Regulations we have to share some of your personal information with other payment service providers (e.g. banks and building societies) in some circumstances, such as where you require us to cooperate with another bank or building society you hold an account with to help them recover a mistaken payment. We will obtain your consent to do this, however consent under the Payment Services Regulations does not have the same meaning as consent under data protection laws, therefore if you were to withdraw your consent for us to process your personal information, as is your right under data protection laws, we may still need to hold and use your personal information under the Payment Services Regulations. We will explain this to you if this is the case.

We are based in the UK but sometimes your personal information may be transferred outside the UK or the European Economic Area (EEA) for limited purposes. We will only send your data outside of the EEA to:

  • Follow your instructions;
  • Comply with a legal duty; or
  • Work with other organisations for the purpose of providing a service on our behalf in connection with the operation of your account or membership.

When we do transfer your data outside of the EEA, there will be protective measures in place to ensure that your personal information is treated by those third parties in a way that is consistent with, and which respects, the UK and EU laws on data protection. Appropriate protective measures include, for example, model clauses in data sharing contracts and ongoing security assessments.

In order to process your application, we will perform credit and identity checks on you with one or more Credit Reference Agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. We will use this information to:

  • Assess your creditworthiness and whether you can afford to take the product;
  • Verify the accuracy of the data you have provided to us;
  • Prevent criminal activity, fraud and money laundering;
  • Manage your account(s);
  • Trace and recover debts; and
  • Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files with the CRAs for a disassociation to break that link. The identities of the CRAs, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the separate leaflet, Credit Reference Agency Information Notice (CRAIN). An electronic version of the CRAIN can be obtained from our chosen CRA, Equifax Ltd, at www.equifax.co.uk/crain

When we and the fraud prevention agencies process your personal information, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity in order to protect our business and to comply with the laws that apply to us. Such processing is also a contractual requirement of the mortgage and savings products we provide you.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal information to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to six years.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse or stop providing products or services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact the Society’s Data Protection Officer on the details above. Alternatively you can contact our chosen fraud prevention agency, Synectics Solutions Ltd of Synectics House, The Brampton, Newcastle under Lyme, Staffordshire ST5 0QY.

You should tell us without delay if any of your personal information changes so that we can update our records. All notifications must be in writing by completing the Change of Details Form, which is available on request from our branches or on our website.

If you were introduced to us by a broker or other intermediary, and you want to advise them as well, you should contact them separately.

We are unable to provide you with mortgage or savings products or to process your application without having personal information about you. Your personal information is required before you can enter into the relevant contract with us, or it is required during the life of that contract, or it is required by laws that apply to us. If we already hold some of the personal information that we need – for instance if you are already a customer – we may not need to collect it again when you make your application. In cases where providing some personal information is optional, we will make this clear.

In this section monitoring means any listening to, recording of, viewing of, intercepting of, or taking and keeping records (as the case may be) of calls, post, emails, social media messages, visits to our branches including the use of CCTV, in person face to face meetings and other communications. We may monitor where permitted by law and we will do this where the law requires it. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or in person meetings (as relevant) we will do so.

Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, be in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.

Some of our monitoring may check for obscene or profane content in communications.

We may conduct short term carefully controlled monitoring of your activities on your account where this is necessary for our legitimate interests or to comply with our legal obligations, for instance, where we suspect fraud, money laundering or other crimes.

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). In the absence of specific legal, regulatory or contractual requirements, our standard retention period for records and other documentary evidence created in the provision of services is 6 years from the date that our contractual relationship ends.

Where your application for an account does not proceed, any personal data will normally be retained for no longer than 3 months from the date your application is withdrawn or declined, in the absence of any other specific legal, regulatory or contractual requirements.

If you would like further information about our data retention practices, please contact our Data Protection Officer.

Under data protection laws you have the following rights. They do not apply in all circumstances and if you wish to exercise any of them we will explain at that time if they apply or not.

The right to be informed about the processing of your personal information. This privacy notice includes all of the information we are required to provide you under this right.

The right to request access to your personal information and obtain information on how we process it. Upon request, we will provide a copy of the personal information we hold on you. To action this right you may wish to complete the Society’s Data Subject Access Request form which is available electronically here.

The right to have your personal information rectified or corrected if it is incomplete or inaccurate. If we have disclosed your personal information to others, then where necessary we will also notify them of the change to your information.

The right to have your personal information erased. This right only applies where our processing of your information was unlawful, our processing is no longer necessary, we no longer have a legitimate interest to process your information, or where our processing is based on consent and you wish to withdraw that consent. The right to erasure does not apply if we are required to retain your information to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

The right to restrict the processing of your personal information. This means that we will continue to store your personal information but will not use it if; you believe that the information we hold relating to you is inaccurate and we are verifying the accuracy of it; we have processed your information unlawfully; we no longer need your personal information but you require us to keep it in order for you to establish, exercise or defend a legal claim; or you have objected to the processing of your personal information and we are assessing whether our legitimate grounds for processing override your rights.

The right to data portability. This means that you have the right to move, copy, or transfer your personal information from our IT environment to another in a safe and secure way, so that it can be reused for your own purposes across different services. This right is different to the right of access (see above) and you will not be able to obtain a copy of all of your personal information by exercising your right to portability. The right to portability applies to personal information that you have provided directly to us, where we process it based on your consent or for the performance of a contract, and where it is carried out by automated means (thereby excluding paper records).

The right to object to the processing of your personal information. You have the right to object to us processing your information on the basis of legitimate interests or for the purposes of direct marketing. We will stop processing your personal information unless we are able to demonstrate that we have compelling legitimate grounds for processing which override your rights, interests or freedoms or if processing is needed for the establishment, exercise or defence of legal claims.

The rights relating to automated decision making and profiling. Automated decision making is when a computer-based decision is made about you without a person being involved. We do not undertake any automated decision making with your personal information.

Profiling is where this is done to make predictions about you. We may place you in groups with similar customers. These are called customer segments. We use these to study and learn about our customers’ needs, and to make decisions based on what we learn. This helps us to design products, services and offers for different customer segments, and to manage our relationships with them. It also helps us tailor the marketing that customer segments receive or are shown on our own and other websites and mobile apps, including social media.

You also have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk. For more details on all of the above rights, you can contact our Data Protection Officer.

If you wish to exercise any of these rights against the Credit Reference Agencies, the fraud prevention agencies, or a broker or other intermediary who is a data controller in its own right, you should contact them separately.

Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.

Occasionally, we may provide you with information about other products and services offered by the Society. We do this only if we have a legal ground which allows it under data protection laws – see section on ‘What are the legal grounds for our processing of your personal information?’ above for what is our legal ground for direct marketing. The Society does not share your data with any other organisation for marketing or promotional purposes.

Your marketing preferences are obtained during the product application stage, however you may change your marketing instructions at any time by writing to us.

Please note, should you choose not to receive any direct marketing from us you will still receive all regulatory required mailings and, where you are an eligible member of the Society, notice of the Society’s Annual General Meeting.