We will not pass your information on to
third parties except in accordance with this notice.
6.1
Our suppliers
We will provide your information to our service
providers to allow them to assist us with delivering the products or services
that you have requested, under the following categories:
- credit reference agencies;
- crime prevention agencies;
- fraud prevention agencies;
- payment service providers;
- ID verification providers;
- debt collection agencies;
- accountants;
- auditors;
- lawyers;
- retailers or brokers;
- business consultants;
- information technology and information security providers;
- market research and analytics companies;
- translation and accessibility support providers; and
- quality assurance providers.
We share your personal information with these service providers for the purposes of:
- providing our services to you;
- facilitating the application process;
- complying with our legal and regulatory obligations;
- market research;
- analytical and statistical purposes;
- maintaining a record of our relationship;
- tracing and recovery of debts; and
- quality assurance purposes.
We may also share your personal information if there is a potential or
actual change to the Castle Trust Group in the future:
- We may choose to sell, transfer, or
merge all or parts of our business, or our assets. Or we may seek to acquire
other businesses or merge with them. It is within our legitimate interests
to share your personal information in order to run, manage and/or reorganise
our business, assets and operations (including in anticipation of the same)
- During any such process, we may share
your personal information with other parties. We’ll only do this if they agree to
protect your personal information in accordance with UK data protection law
If you would like further information regarding the specific named
recipients that we share data with, please contact us by writing to the Data
Protection Officer.
6.2 Credit Reference Agencies
In order to process your application, we will perform
credit and identity checks on you with one or more credit reference agencies
(“CRAs”). We will also perform these checks periodically while you have a relationship with us.
To do this, we
will supply your personal information to CRAs and they will give us information
about you. This will include information from your credit application and about
your financial situation and financial history. CRAs will supply to us both
public (including the electoral register) and shared credit, financial
situation and financial history information and fraud prevention information.
We will use
this information to:
- Verify your identity and address;
- Assess your creditworthiness and whether you
can afford to take the product;
- Verify the accuracy of the data you have
provided to us;
- Prevent criminal activity, fraud and money
laundering;
- Manage your account(s);
- Trace and recover debts; and
- Ensure any offers provided to you are
appropriate to your circumstances.
We will
continue to exchange information about you with CRAs while you have a
relationship with us. We will also inform the CRAs about your settled accounts.
If you borrow and do not repay in full and on time, CRAs will record the
outstanding debt. This information may be supplied to other organisations by
CRAs.
When CRAs
receive a search from us they will place a search footprint on your credit file
that may be seen by other lenders.
If you are
making a joint application or tell us that you have a spouse or financial associate,
we will link your records together, so you should make sure you discuss this
with them, and share with them this information, before lodging the
application. CRAs will also link your records together and these links will
remain on your and their files until such time as you or your partner
successfully files for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud
prevention agencies, the data they hold, the ways in which they use and share
personal information, data retention periods and your data protection rights
with the CRAs are explained in more detail at www.experian.co.uk/crain. CRAIN is also accessible from
each of the three CRAs – clicking on any of these three links will also take
you to the same CRAIN document:
6.3 Fraud prevention agencies, law enforcement agencies and other non-marketing users
The personal
information we have collected for you will be shared with fraud prevention
agencies who will use it to prevent fraud, money-laundering and to verify your
identity. If
we, or a fraud prevention agency, determine that you pose a fraud or money
laundering risk, we may refuse to provide the services or financing you have
requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or
money laundering risk will be retained by the fraud prevention agencies, and
may result in others refusing to provide services, financing, or employment to
you. If you have any questions about this, please contact us on the details
above.
Your personal data can be held by fraud prevention agencies for up to six years where there is considered to be a risk of fraud or money laundering. The reports may result in other companies refusing to provide services, financing, or employment.
We share personal information with CIFAS, National Hunter, RiskNarrative and Veriff. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found via their websites.
The personal information you provide (including your email and internet
protocol (IP) addresses) may also be copied, stored, used and licensed to
assist with identity verification, prevention of fraud and money laundering,
service delivery and process implementation.
We may share your information if we are under a duty to disclose or
share your information with HM Revenue & Customs (HMRC), who may transfer
it to the government or the tax authorities in another country where you may be
subject to tax.
We
may also share your personal information with any other third parties where we are required to do so by law.
The results of your identity check may also be disclosed to authorised
third parties through credit referencing, fraud prevention, risk assessment and
identification products.
For our Saving account customers, we may share the name of the account holder or holders with third parties paying money into your account if it is necessary to confirm the payment is being made to the right account. This is a requirement of Confirmation of Payee regulations. We will only do this where the name submitted by the payer is a close match with the account holder’s or holders’ name.
6.4 International transfers
We transfer, use and/or store your personal information outside of the
European Economic Area (“EEA”) and the laws of some of these destination
countries may not offer the same standard of protection for personal
information as in the UK.
We currently transfer data outside of the EEA, to:
- India for the purposes
of managing the software used to administer our products
- United States of America for the purposes of workflow management, software support and data analytics
We may update this list from time to time and any changes will be
communicated to you via an update to this privacy notice.
Transfers to our third-party service providers
are to enable them use and store your personal information on our behalf. We will, however, put in place appropriate
security procedures in order to protect your personal information. We also
ensure that, where your information is transferred to any country outside the
EEA this is done using specific legally-approved safeguards. You can request further details and a copy of
these by contacting the Data Protection Officer (see section 9).