Data Privacy Notice

Name, title, address, contact details (including any previous changes), date of birth and/or age

To:

• identify you
• communicate with you
• manage your relationship with us
• use for crime and fraud prevention purposes

Business Role (e.g. director, partner, shareholder, sole trader, company secretary)

To:

• identify you
• communicate with you
• manage your relationship with us
• use for crime and fraud prevention purposes

Account data (including performance information)

To:

• manage your relationship and accounts with us
• use for crime and fraud prevention purposes

Criminal convictions, pending convictions bankruptcy/receivership, county court judgements and court records

To:

• assess the suitability of our accounts and services
• use for crime and fraud prevention purposes

Information about your computer and your visits to and use of our website

(including your IP/MAC address, geographical location, browser type and version, operating systems, referral source, length of visit, page views, and website navigation)

To:

• understand your needs and experience with us
• manage your subscription to our website services
• improve our systems and website services

Solicitors, accountants, brokers and other professional advisers

To:

• provide professional services
• manage your ongoing relationships
• administer and manage disputes and / or legal claims

Financial organisations

To:

• review and assess your suitability and application for products and services
• manage payments (including the use of payment services involving the transfer of electronic payments into or out of your account) and transactions
• respond to requests for the postponement of a charge on your property
• detect and prevent fraud
• assist with enquiries and investigations

Mailing houses and printers

To provide you with:

• service information (eg account statements)
• a range of other communications about our products, services, news and offers

We will only send you marketing material when you have given us your consent.  Upon giving us your consent, you will also be entitled to opt out of any future marketing related communications.

Information Technology service providers

To:

• provide third party systems, storage, software and application support

Credit reference agencies

To:

• verify your identity
• assess your suitability and affordability for accounts and services
• assess and confirm your credit worthiness

Fraud prevention agencies

To:

• carry out checks for the purposes of preventing fraud and money laundering
• verify your identity
• to assess your suitability for products and services

Law enforcement agencies including police forces, private investigators, security organisations and prosecuting authorities

To:

• assist with any ongoing investigations relating to the security and / or safety of individuals to detect and prevent crime

Courts and tribunals

To:

• respond to court and tribunal requests, manage and resolve complaints, disputes and / or legal claims

Ombudsmen and regulatory organisations (e.g. Financial Ombudsman Service, Financial Conduct Authority, Prudential Regulation Authority, Financial Services Compensation Scheme, Information Commissioners Office)

To:

• provide our regulatory and governing bodies with data about our business
• assist with enquiries, investigations, complaints and assessments

Trade associations and industry groups

To:

• assist with enquiries, investigations, complaints and assessments
• develop industry standards
• understand and predict trends in customer and financial behaviours

HMRC

To:

• provide information for tax reporting purposes 
• assist with enquiries, investigations, complaints and assessments
• detect and prevent fraud

Central and local government departments and agencies (eg Department of Work and Pensions (DWP), Jobcentre Plus, local councils)

To:

• confirm payments received and ongoing benefits
• assist with enquiries, investigations, complaints and assessments

Field agents, debt collection agencies, tracing agents and appointed receivers and trustees in bankruptcy

To:

• understand your circumstances and financial situation
• assist in recovering debt
• locate you when we have been unable to contact you via our usual communication channels
• meet the law where receivers or trustees in bankruptcy have been appointed to deal with your financial affairs

Research and insight agencies

To:

• better understand our customers including their experiences, life‐stages, circumstances, needs and responses to current and potential Skipton Business Finance products, services and wider initiatives
• support a wide range of business decision making such as product development

In addition we use data for profiling and customer segmentation to create a broad understanding of our customers.

This helps shape our communications, products and the overall customer experience including how we handle phone calls and other customer contacts.

Management Consultancy firms

To:

• gain insights into market trends, consumer behaviour, competitors, technological change
• help make recommendations into future development and strategy
• get support with a range of business decisions

Other organisations involved in handling mergers, acquisitions and other corporate transactions

To:

• enable the sale or purchase of all or part of our business

We will only do this with adequate protection and with a contract in place to protect the security and confidentiality of your information.

External auditors, risk and rating agencies (eg Moodys, Fitch)

To:

• support a wide range of business decision making such as product development
• validate reports
• facilitate the management and audit of business operations
• assist in meeting our legal obligations

Data modelling and risk organisations

To:

• understand and predict trends in customer and financial behaviours
• support a wide range of business decision making including the provision of credit to customers
• review and validate the accuracy of reports and / or model outputs from other organisations

Skipton Building Society and other affiliates of the Skipton Group

• internal audit / compliance and financial crime regulatory requirements
• IT support
• Executive board requirements
• Escrow account support

Legal obligation

Where we are required by law to collect, use, share or keep personal data we will do so.

As an organisation operating in a regulated industry we have to comply with the laws and regulations set by government bodies and our regulators.

Our regulators are the Financial Conduct Authority, Prudential Regulation Authority, and for personal data the Information Commissioner’s Office. If we are unable to meet our legal obligations we will be unable to continue with your application and provide the ongoing management of your accounts, products and services.

Contract

This is where you choose to enter into an agreement with us or make an enquiry with the intention of entering into an agreement. This includes the terms and conditions for the ongoing management of those accounts, and products and services once opened.

If you do not enter into an agreement with us we will be unable to continue with your application and provide the ongoing management of your accounts, products and services.

Legitimate business interest

This is where we or another third party has a valid interest in the personal data we collect, use, share and keep as long as it does not unduly affect you or cause you undue detriment, damage or distress.

You have a right to challenge our legitimate interest if you believe we do not have a valid reason to collect, use, share or hold your data.

Marketing Consent

This is where we ask for your agreement to contact you specifically promote to our services to you.

You can withdraw your consent at any time.

If you withdraw your consent for marketing you may miss out on information about our products, services, offers and other news that may be of interest to you.

You can change your marketing consents at any time by calling 0113 242 3237 or emailing info@skiptonbf.co.uk

Explicit consent

Where we collect, use, share or keep special category (sensitive) personal data we will tell you and ask for your explicit consent before we do this.

Vital interest

This is applied in very limited circumstances where we feel you or another individual may be at serious risk (e.g. life or death circumstances) and no other lawful basis can be applied.

Be informed

The purpose of this privacy statement is to do this. We also do this by giving a notice in our application process, web pages and telephone scripts when we collect new or additional data from you. See the list below for details of the information we are required to include:

• who is collecting, using, sharing and keeping your personal data
• the reason it is being collected
• what it will be used for
• what allows its collection, use, sharing and storing
• how we work out how long it will be kept
• what countries outside the European Economic Area (EEA) it will be transferred to and the security measures in place
• what your rights are

Access your personal data

We will allow you access and give you details of the personal data we hold about you including the data covered in your right to be informed above.

Have inaccurate or incomplete personal data corrected

We will correct and/or update your personal data if you inform us or we identify that it is inaccurate or incomplete.

Request erasure

We will delete your personal data if:

• we no longer need it for the reason(s) we told you
• you withdraw your consent and this is the only lawful basis (as explained in section 4 of this Privacy Statement) allowing us to collect, use, share and/or keep it
• you object and we do not have a valid business interest that does not unduly affect you or cause you undue detriment, damage or distress
• the collection, use, sharing, keeping of it is unlawful
• we are required by law to do so

Restrict the collection use, sharing and keeping of personal data

We will put on hold the collection, use, sharing and deletion of your personal data when:

• its accuracy needs to be verified
• you have objected and we need to consider if our legitimate business interest overrides your request
• it has been collected, used, shared or kept unlawfully and you have requested that it’s not deleted but want it to be restricted
• we no longer need it but you request it to establish, exercise or defend a legal claim

We will tell you before we remove any restrictions.

Object

You can object to the collection, use, sharing and retention of your personal data where:

• you feel our legitimate business interest will cause you undue detriment, damage or distress where this is the lawful purpose for collecting, using, sharing or keeping data
• You do not agree to direct marketing (including profiling)