Our products and services are available through our own branches and on our own website as well as through professional and financial advisors and anyone else who acts as a person sitting in between you and us in relation to what we do for you. In this notice we will call these persons “brokers or other intermediaries”.
If you are using brokers or other intermediaries, our privacy notice only applies to the processing of your personal information that they may do on our behalf. You should receive a separate privacy notice from these brokers or other intermediaries where they are acting as a data controller of your personal information
When we refer to process or processing, this includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting, destroying, or transferring it overseas (if applicable).
The processing we do will depend on the products or services you apply for and obtain from us.
This includes:
This includes:
This includes:
If you make a joint application with your spouse, partner or family member, or they are a guarantor, power of attorney, or other third party, we will also process the personal information mentioned above about that person. It is important that they are given the opportunity to read this privacy notice.
We will generally collect your personal information from you directly. If you are introduced to us by a broker, or other intermediary, we will obtain some personal information about you indirectly from them when they introduce you to us.
Some personal information is obtained from Credit Reference Agencies and this will have originated from publicly accessible sources. Credit Reference Agencies draw on court decisions, bankruptcy registers and the electoral register (also known as the electoral roll). We explain more about Credit Reference Agencies below.
In addition, where applicable we obtain your personal information from other sources such as someone who has authority to deal with your financial affairs, fraud prevention agencies, your employer, landlord, other lenders, HM Revenue & Customs, the Department for Work and Pensions, publicly available directories and information (e.g. telephone directory, social media, internet, news articles), debt recovery and/or tracing agents, other organisations to assist in the prevention and detection of crime, police and law enforcement agencies.
Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organisations). For some processing more than one legal ground may be relevant (except where we rely on consent). Here are the legal grounds that are relevant to us:
1) Processing necessary to perform a mortgage or savings contract with you or for taking steps prior to entering into it (during the application stage):
2) Data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Where we consider that, on balance, it is appropriate for us do so, processing necessary for the following legitimate interests which apply to us and in some cases other organisations (who we list below) are:
3) Processing necessary to comply with our legal obligations:
4) Processing with your consent:
5) Processing to protect the vital interests of a person or for a substantial public interest under laws that apply to us where this helps us to meet our broader social obligations or safeguard others such as:
Much of what we do with your personal information is not based on your consent, instead it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us using the details above. The consequence might be that we cannot take into account special categories of personal data such as about your health or if you are a vulnerable customer (but these outcomes will be relevant only in cases where we rely on explicit consent for this).
To comply with Payment Services Regulations we have to share some of your personal information with other payment service providers (e.g. banks and building societies) in some circumstances, such as where you require us to cooperate with another bank or building society you hold an account with to help them recover a mistaken payment. We will obtain your consent to do this, however consent under the Payment Services Regulations does not have the same meaning as consent under data protection laws, therefore if you were to withdraw your consent for us to process your personal information, as is your right under data protection laws, we may still need to hold and use your personal information under the Payment Services Regulations. We will explain this to you if this is the case.
We are based in the UK but sometimes your personal information may be transferred outside the UK or the European Economic Area (EEA) for limited purposes. We will only send your data outside of the EEA to:
When we do transfer your data outside of the EEA, there will be protective measures in place to ensure that your personal information is treated by those third parties in a way that is consistent with, and which respects, the UK and EU laws on data protection. Appropriate protective measures include, for example, model clauses in data sharing contracts and ongoing security assessments.
In order to process your application, we will perform credit and identity checks on you with one or more Credit Reference Agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. We will use this information to:
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files with the CRAs for a disassociation to break that link. The identities of the CRAs, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the separate leaflet, Credit Reference Agency Information Notice (CRAIN). An electronic version of the CRAIN can be obtained from our chosen CRA, Equifax Ltd, at www.equifax.co.uk/crain
When we and the fraud prevention agencies process your personal information, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity in order to protect our business and to comply with the laws that apply to us. Such processing is also a contractual requirement of the mortgage and savings products we provide you.
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal information to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to six years.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse or stop providing products or services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact the Society’s Data Protection Officer on the details above. Alternatively you can contact our chosen fraud prevention agency, Synectics Solutions Ltd of Synectics House, The Brampton, Newcastle under Lyme, Staffordshire ST5 0QY.
You should tell us without delay if any of your personal information changes so that we can update our records. All notifications must be in writing by completing the Change of Details Form, which is available on request from our branches or on our website.
If you were introduced to us by a broker or other intermediary, and you want to advise them as well, you should contact them separately.
We are unable to provide you with mortgage or savings products or to process your application without having personal information about you. Your personal information is required before you can enter into the relevant contract with us, or it is required during the life of that contract, or it is required by laws that apply to us. If we already hold some of the personal information that we need – for instance if you are already a customer – we may not need to collect it again when you make your application. In cases where providing some personal information is optional, we will make this clear.
In this section monitoring means any listening to, recording of, viewing of, intercepting of, or taking and keeping records (as the case may be) of calls, post, emails, social media messages, visits to our branches including the use of CCTV, in person face to face meetings and other communications. We may monitor where permitted by law and we will do this where the law requires it. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or in person meetings (as relevant) we will do so.
Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, be in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.
Some of our monitoring may check for obscene or profane content in communications.
We may conduct short term carefully controlled monitoring of your activities on your account where this is necessary for our legitimate interests or to comply with our legal obligations, for instance, where we suspect fraud, money laundering or other crimes.
We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). In the absence of specific legal, regulatory or contractual requirements, our standard retention period for records and other documentary evidence created in the provision of services is 6 years from the date that our contractual relationship ends.
Where your application for an account does not proceed, any personal data will normally be retained for no longer than 3 months from the date your application is withdrawn or declined, in the absence of any other specific legal, regulatory or contractual requirements.
If you would like further information about our data retention practices, please contact our Data Protection Officer.
Under data protection laws you have the following rights. They do not apply in all circumstances and if you wish to exercise any of them we will explain at that time if they apply or not.
The right to be informed about the processing of your personal information. This privacy notice includes all of the information we are required to provide you under this right.
The right to request access to your personal information and obtain information on how we process it. Upon request, we will provide a copy of the personal information we hold on you. To action this right you may wish to complete the Society’s Data Subject Access Request form which is available electronically here.
The right to have your personal information rectified or corrected if it is incomplete or inaccurate. If we have disclosed your personal information to others, then where necessary we will also notify them of the change to your information.
The right to have your personal information erased. This right only applies where our processing of your information was unlawful, our processing is no longer necessary, we no longer have a legitimate interest to process your information, or where our processing is based on consent and you wish to withdraw that consent. The right to erasure does not apply if we are required to retain your information to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
The right to restrict the processing of your personal information. This means that we will continue to store your personal information but will not use it if; you believe that the information we hold relating to you is inaccurate and we are verifying the accuracy of it; we have processed your information unlawfully; we no longer need your personal information but you require us to keep it in order for you to establish, exercise or defend a legal claim; or you have objected to the processing of your personal information and we are assessing whether our legitimate grounds for processing override your rights.
The right to data portability. This means that you have the right to move, copy, or transfer your personal information from our IT environment to another in a safe and secure way, so that it can be reused for your own purposes across different services. This right is different to the right of access (see above) and you will not be able to obtain a copy of all of your personal information by exercising your right to portability. The right to portability applies to personal information that you have provided directly to us, where we process it based on your consent or for the performance of a contract, and where it is carried out by automated means (thereby excluding paper records).
The right to object to the processing of your personal information. You have the right to object to us processing your information on the basis of legitimate interests or for the purposes of direct marketing. We will stop processing your personal information unless we are able to demonstrate that we have compelling legitimate grounds for processing which override your rights, interests or freedoms or if processing is needed for the establishment, exercise or defence of legal claims.
The rights relating to automated decision making and profiling. Automated decision making is when a computer-based decision is made about you without a person being involved. We do not undertake any automated decision making with your personal information.
Profiling is where this is done to make predictions about you. We may place you in groups with similar customers. These are called customer segments. We use these to study and learn about our customers’ needs, and to make decisions based on what we learn. This helps us to design products, services and offers for different customer segments, and to manage our relationships with them. It also helps us tailor the marketing that customer segments receive or are shown on our own and other websites and mobile apps, including social media.
You also have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk. For more details on all of the above rights, you can contact our Data Protection Officer.
If you wish to exercise any of these rights against the Credit Reference Agencies, the fraud prevention agencies, or a broker or other intermediary who is a data controller in its own right, you should contact them separately.
Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.
Occasionally, we may provide you with information about other products and services offered by the Society. We do this only if we have a legal ground which allows it under data protection laws – see section on ‘What are the legal grounds for our processing of your personal information?’ above for what is our legal ground for direct marketing. The Society does not share your data with any other organisation for marketing or promotional purposes.
Your marketing preferences are obtained during the product application stage, however you may change your marketing instructions at any time by writing to us.
Please note, should you choose not to receive any direct marketing from us you will still receive all regulatory required mailings and, where you are an eligible member of the Society, notice of the Society’s Annual General Meeting.