We are Castle Trust Group consisting of “Castle Trust” and “Omni Capital Retail Finance (OCRF)”. This policy details the types of data we use, why we use it and how.
1.1 “We” and “Us” refers to Castle Trust Group which consists of:
Registered office for all companies: 10 Norwich Street, London, EC4A 1BD. Registered in England and Wales.
1.2 For the purposes of data privacy laws, we are a Data Controller in relation to the information that we collect and hold about you. This means that we are responsible for ensuring that your data is processed fairly and lawfully by us.
You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this policy. You might need a copy
of the information we hold, or you may ask us to correct it or delete it amongst other things. This section explains your rights and what to do if you’re not happy.
2.1 Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
Where you have previously given us your permission to use your personal information, withdraw that permission. Where your permission is withdrawn, your previous consent will remain valid in respect of our use of your information prior to the date you withdrew it, or if any marketing material has been sent prior to you advising that you do not wish us to contact you again.
If you want to exercise any of these rights then please contact the Data Protection Officer (see section 9) in writing.
Please note that in some cases even when you make a request concerning your personal information, we may not be required, or may not be able, to honour it as this may result in us not being able to fulfil our legal and regulatory obligations or there is a minimum statutory period of time for which we have to keep your information. If this is the case then we will let you know our reasons.
2.2 Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). In some cases, we may charge a reasonable fee if your request for access is clearly unfounded or excessive, or if you request multiple copies of the information.
Alternatively, we may refuse to comply with the request in such circumstances.
2.4 What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
2.5 Right to complain
If you wish to request further information about any of the above rights, or if you are unhappy with how we have handled your information, contact the Data Protection Officer (see section 9 for contact details).
If you are not satisfied with our response to your complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office: https://ico.org.uk/global/contact-us/ 0303 123 1113.
We collect the following kinds of information about you:
3.1 Information you provide to us
You provide us with certain information when you apply for one of our mortgage, investment or consumer credit products. This includes:
3.2 Information obtained from credit reference agencies
We obtain your credit file from credit reference agencies TransUnion (formerly known as Callcredit Limited), Experian and Equifax. For detailed information on the information obtained and how it is used, see section 6.2.
3.3 Combining data
The information you give us may be combined with other information about you that is obtained from other sources. The combination is usually undertaken with a view to enhancing an existing database with more information. This will include:
3.4 Information provided from your use of our website
We gather information about how often you and other users access the website, the way in which you navigate around it, and how long you spend on particular pages.
3.5 Information from your devices when you use our website
We gather information about the devices that you use to access the website, such as the operating system, hardware, software versions, browser configuration, display size, browser configuration and connection information such as IP addresses.
3.6 Other information
We monitor or record your communications with us to meet our regulatory obligations and to improve our services.
We collect information about you for the following purposes:
4.1 Verifying your identity
The information you provide will help us to verify your identity so that we know we are dealing with the correct person. We do this by checking the information you give us against external databases such as the electoral roll and your credit file.
4.2 Providing you with our services
We will use the information that we hold about you in order to enter or look to enter into a contract with you for our services and to fulfil our obligations under such contract. This includes contacting you to communicate with you in connection with our services and to deal with any queries concerning the data that we hold.
4.3 Fraud prevention and other legitimate interests
We will use the information in order to detect or prevent fraud and to comply with our legal obligations (for example, to ensure that no-one has fraudulently used your details or to confirm you have only entered information about yourself). Information can be used to corroborate your details (including using third parties to undertake those checks on our behalf).
Information is also being used, by us or third parties (see section 6), for credit and risk assessment and management, identification, debt collection and returning assets to you.
4.4 Securing and monitoring the relevance of our services
Information about your devices and your use of the website is used to ensure that our service is user- friendly and to help improve the content and user experience of the website. It also allows us to tailor the website to match your interests and preferences better and understand who has visited which pages to determine the most popular areas of the website.
We use your information to identify products and services that we think may be of interest to you.
We will only send you marketing messages where you have consented to such contact, or in the case of
products and services, where these are like those that we have already provided to you.
You have the right to ask us not to send you marketing messages by post, telephone or e-mail or any combination of these at any time.
You can also do this by:
You can withdraw your consent for postal marketing from anyone by adding your details to the Mail Preference Service. For more details please go to www.mpsonline.org.uk.
4.5.2 Email or SMS (text message)
You can unsubscribe from receiving e-mail or SMS marketing communications by using the instructions in any email or SMS communication we send you.
4.5.3 Telephone calls
To withdraw your consent for live or automated calls from anyone you can add your name to the Telephone Preference Service which is maintained at this website address: www.tpsonline.org.uk.
4.5.4 Social media and online
You can configure your advertising preferences
on social media such as Facebook, Twitter, Instagram or Pinterest by accessing your settings or preference options on the relevant platform.
4.6 Automated decision making and decisions made based on profiling
We use your information for making automated decisions about you and profiling you in order to determine your eligibility for our products and services.
When you apply for credit, for example for the purchase of goods, the information we use to support our automated decision is taken from information you give us about your identity and from your credit report. Our decisions involve the use of systems, such as our underwriting and acceptability tools to help us decide your ability to meet your financial commitments. The
decision to offer credit is automatically delivered to you without any prior and meaningful assessment by any person.
When you apply for a mortgage loan, we decide whether to agree the loan using information from a profile automatically produced from your credit report. We personally review your application and make a decision regarding whether to lend and the affordability of the payments.
These decisions help us make fair and responsible lending decisions. Where we choose to lend or offer credit, we will notify Credit Reference Agencies (CRAs) of our decisions and this will be noted in your credit report. If we decide not to lend, a record of our search will be left in your credit report. These searches may affect your eligibility for future financial service related products.
If you object to an automated decision that is required to determine your eligibility for our services, then we will be unable to provide you with them.
4.7 Statistical Analysis
Your data may be used for any legal or general statistical analysis. This usually will not include personally identifiable information and will be collected on an anonymous basis. The statistical data used within our business helps us to judge performance and to make improvements to how we operate
In terms of the legal bases we rely on to process your information, these are where the processing is necessary:
We process your sensitive and special categories of information (this includes data concerning your health, personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or data concerning sexual orientation) where we have asked for your explicit consent or otherwise where this is necessary for the establishment, exercise or defence of legal claims.
If you do choose to provide your consent you can withdraw it at any time by contacting the Data Protection Officer.
We will not pass your information on to third parties except in accordance with this notice.
6.1 Our suppliers
We will provide your information to our service providers to allow them to assist us with delivering the products or services that you have requested, under the following categories:
We share your personal information with these service providers for the purposes of:
If you would like further information regarding the specific named recipients that we share data with, please contact us by writing to the Data Protection Officer.
6.2 Credit Reference Agencies
In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take banking services from us we may also make periodic searches at CRAs to manage your account with us.
To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application
and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We will use this information to:
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.experian.co.uk/crain. CRAIN is also accessible from each of the three CRAs – accessing any of these three links will also take you to the same CRAIN document: TransUnion www.callcredit.co.uk/ crain; Equifax www.equifax.co.uk/crain; Experian www. experian.co.uk/crain.
6.3 Fraud prevention agencies, law enforcement agencies and other non-marketing users
The personal information we have collected from you may be shared with fraud prevention agencies who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected you could be refused certain services or employment.
Your personal information may also be used to verify your identity. Further details of how your information will be used by us and fraud prevention agencies, can be found at the following websites: www.nhunter.co.uk/privacypolicy/ and www.cifas. org.uk/fpn
The personal information you provide (including your email and internet protocol (IP) addresses) may also be copied, stored, used and licensed to assist with identity verification, prevention of fraud and money laundering, service delivery and process implementation.
We may share your information if we are under a duty to disclose or share your information with HM Revenue & Customs (HMRC), who may transfer it to the government or the tax authorities in another country where you may be subject to tax.
We may also share your personal information with any other third parties where we are required to do so by law.
The results of your identity check may also be disclosed to authorised third parties through credit referencing, fraud prevention, risk assessment and identification products.
6.4 International transfers
We transfer, use and/or store your personal information outside of the European Economic Area (“EEA”) and the laws of some of these destination countries may not offer the same standard of protection for personal information as in the UK.
We currently transfer data outside of the EEA, to India for the purposes of managing the software used to administer our products.
We may update this list from time to time and any changes will be communicated to you via an update to this privacy notice.
Transfers to our third-party service providers are to enable them use and store your personal information on our behalf. We will, however, put in place appropriate security procedures in order to protect your personal information. We also ensure that, where your information is transferred to any country outside the EEA this is done using specific legally-approved safeguards. You can request further details and a copy of these by contacting the Data Protection Officer (see section 9).
We will keep your information only for as long as necessary depending on the purpose for which it was provided. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from the Data Protection Officer.
When determining the relevant retention periods, we will take into account factors including:
We are aware of the importance of safeguarding the information under our control and endeavour to take all reasonable steps to protect it. All data collected through the website is stored on secure servers, and we have stringent security and confidentiality procedures covering the storage and disclosure of such information in accordance with the current data protection regulations.
We link to a wide variety of other sites. We are not responsible for the content or privacy policies of these sites, nor for the way in which information about their users is treated. In particular, unless expressly stated, we are not agents for these sites nor are we authorised to make representations on their behalf.
You may write to us at:
Data Protection Officer
Omni Capital Retail Finance Ltd PO Box 6990
Basingstoke RG24 4HX
Castle Trust Bank PO Box 6966
Basingstoke RG24 4XF
Or by email at: DPO@castletrust.co.uk