We have put in place a number of measures to ensure that any personal data we obtain from you is processed and maintained in accordance with legal requirements and the accepted principles of good information handling in accordance with the Data Protection Act 1998 (the “DPA”) and the General Data Protection Regulations (“GDPR”).
The Data Controller is Culbone Ltd. We determine the purposes for which and the manner in which your personal data will be processed.
This Policy applies to customers who seek finance facilities from us (where we broker deals to other funders). It will cover how we process data in connection with the initial finance application and then our ongoing management and servicing of the account. As well as individuals, “customers” will also include partnerships, unincorporated and incorporated bodies (including limited companies and limited liability partnerships). This policy also applies to guarantors.
Although in general the legal requirements only apply to the handling of personal data in relation to individuals, we also seek to apply the same standards of good information handling in respect of all customers.
Where there are two or more persons named in the finance agreement or guarantee, this Policy applies to each of them separately.
What is personal data?
This is any information that either alone, or in combination with other information, would identify a person as a living individual, for example your name and date of birth.
How we collect your personal information
We may as a result of your interaction with our website and when you apply for finance, process and store your information on our computer systems and our manual files. We will also collect and store personal and financial information about you when you or an introducer (such as a dealer or broker) provide us with information over the telephone or by email, when you or an introducer sends us documents (which may be in paper form or electronic) and when we access information held by credit
reference, fraud prevention and business information agencies about you.
We also collect personal information when we communicate with you during our servicing of your agreement with us.
We will collect the data shown below, whether or not you become a customer in connection with your application. If you become a customer we will use it to manage and service your account.
The types of data we collect and use
The type of data we collect and the reasons why include the following:
- Credit Assessment. We collect personal and financial information from you and from credit reference agencies (CRAs) and fraud prevention agencies to help us carry out identity checks and to assess your ability to meet your financial commitments and to check that you are creditworthy. Where you have applied to act as a personal guarantor we will assess your financial suitability to act as a guarantor.
For individuals, such information includes your current and recent addresses, whether you are on the electoral role, your age, email address and telephone number, whether you are a home owner or tenant, personal data about bank accounts, credit cards, mortgages and other agreements that involve a credit arrangement like utilities and communications contracts (including mobile and internet) and how you are meeting your payment obligations to these organisations and whether you have any court judgments. We will also search and record information gathered from the Land Registry to confirm your property ownership.
We may also collect information about a business you own or are involved with including requesting financial records, such as accounts and information held by public bodies such as Companies House. Similar information will also be collected where you are an incorporated body and may include your registered office, business addresses and contacts details, bank details, VAT number, number of employees, business history and information gathered from credit information providers to inform us about your financial performance and credit standing.
- Prevent and detect crime: We collect personal and financial information from you and from CRAs, fraud prevention agencies and public or government bodies to help us to detect and prevent crime and fraud and to verify your identity (or in the case of an incorporate body, its beneficial owners) under our anti-money laundering obligations.
- Servicing of your facility: The information we collect will enable us to communicate with you about your finance facility and to service your account, for example to issue statements, to process your payments onto our systems, to contact you about any missing payments and to trace you. We will make a record of our communications with you and your account activity to help us to monitor and manage your account, check that we are providing an adequate service and to help us to deal with any complaints. We will collect information about your bank account to enable us to process your rental or finance repayments.
- Improve our services and products: We will use your information, for research, assessment and analysis (including market and product analysis) and to develop and improve our services to you and other customers.
The legal basis for processing your personal data
The UK’s data protection law allows us to process your personal data where we have a proper reason for doing so. Such reasons include to fulfil a contract we have with you, where it is in our legitimate interest, where we have a legal duty and when you consent to it.
a) We rely on the legitimate reason basis in respect of our credit assessment activities described above. We will also share your data with credit reference and fraud prevention agencies. A legitimate interest is when we have a business or commercial reason to use your information and this is not unfairly against your interests.
b) We rely on the contract performance basis in order to take steps to arrange a finance contract for you and to service your facility.
c) We rely on the legal duty for processing by collecting information in order to prevent and detect crime and by sharing such data with fraud prevention and government agencies and authorities. We will also collect information necessary for us to maintain records as required by government and regulatory bodies.
d) We will rely on your consent where:
- you request that we disclose your information to others,
- in the event that we process any special categories of personal data at your request where you are an individual (for example about your racial or ethnic origin or concerning your political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation), and
- To send you marketing communications (see below).
We may wish to make you aware, from time to time, of products or services which are similar to the ones you have recently taken out with us. We will only do this if we consider this to be a legitimate business interest of ours or with your consent. If we do this you may notify us to cease sending these messages at any time.
Disclosure of your personal information
We may give information about you and how you manage your account to the following organisations and where we do shall take reasonable steps to ensure that your rights are protected and that they will keep the information confidential:
a) People who provide a service to us or are acting as our agents. This includes any organisation where we have decided to outsource all or part of the administration or servicing of your facility including in respect of data storage, direct debit processing and to debt collecting, tracing and asset recovery agents;
b) To the manufacturers or suppliers of the goods in connection with any repairs or maintenance of the goods.
c) Our insurers, auditors and accountants, solicitors, consultants and other professional advisers;
d) Any funders or investors (or prospective funders or investors) of our business (including other leasing and finance companies where we act as a broker);
e) To credit reference agencies and fraud prevention agencies (see below);
f) We may also give out personal information about you if we have a duty to do so in order to comply with any legal obligation (including with any Government agencies or regulators).
We may from time to time send your personal information for some of the above reasons outside of the UK, for example we send your personal data to an organisation outside the UK that provides us with a back up data service and holds such data on their server. They hold such data on our behalf as data processors acting under our strict instructions and are unable to use such data other than for our requirements. In such an instance and on any other occasions where the person or organisation we send your personal information to is located outside of the European Economic Area we will make sure that they agree to apply the same levels of protection as we are required to apply to information held in the UK and to use your information only for the purpose of providing the service to us.
Credit Reference Agencies
In order to assess a finance application, we will perform credit and identity checks on you with one or more CRAs. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders and funders.
They supply to us both public (including the electoral register) and shared credit and fraud prevention information.
We and other organisations may also access and use CRA information to:
a) assess your credit worthiness and whether you can afford the rental or credit repayments (and are suitable to act as a guarantor for such payments) ;
b) verify the accuracy of the data provided to us;
c) prevent criminal activity, fraud and money laundering;
d) manage the accounts; and
e) Trace and recover debts
If you tell us that you have a spouse or financial associate, we will link your records together so you must be sure that you have their agreement to disclose information about them. CRAs also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
Information relating to your applications will be shared by us and sent to CRAs and will be recorded by them. We will give details of your account and how you manage it to them. We will continue to exchange information about you with CRAs while you have a relationship with us. If you do not repay in full and on time, CRAs will record the outstanding debt and that you have defaulted. This information may be supplied to other organisations by CRAs to perform similar checks. Records remain on file for six years after they are closed, whether settled by you or defaulted. We will also notify the CRAs when you settle your account.
Further information about the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at:
The CRA we normally use is Equifax and their details are Equifax plc, Credit File Advice Centre, PO Box 3001, Bradford, BD1 5US or call 0870 010 0583 or visit www.myequifax.co.uk
For incorporated customers and guarantors we may also share your information with Creditsafe of Bryn House, Caerphilly Business Park, Van Road, Caerphilly, CF83 3GR or visit http://www.creditsafe.com
Retention of your personal information
The length of time we retain your information will depend on the purpose for which the information was provided. In general, however:
a) We will keep the information that is necessary to enable us to manage your account and provide you with a service that you have requested for as long as it takes us to provide that service.
b) We will keep your contact details for as long as we have your consent to send you marketing information.
c) We will keep records of your account history for a period that will not usually exceed six years after your rental payments or loan has been repaid. This is to allow us to respond to any complaints or disputes that may arise during that period.
d) We will keep other information about you if it is necessary for us to do so to comply with the law or regulatory requirements.
Access to your information and your other rights
The rights set out in this section are set out in the GDPR and apply to individuals. We will however seek to apply the same standards to incorporated bodies.
You have the right to request a copy of the information that we hold about you (sometimes called a “subject access request”). If you would like a copy of some or all of your personal information, please email or write to us at our above address. This is free of charge although we can charge a reasonable fee if your request is excessive or repetitive.
You also have the following rights. In most cases we generally must respond within a month.
- You may ask us to rectify information you think is inaccurate.
- You are entitled to request that the personal data we hold about you be erased if you can show that the data (or some of it) is no longer necessary in relation to the purpose for which it was originally collected or processed by us. This is because it has been obtained in order to provide finance to you and to service and maintain your account and therefore we would usually have a legitimate interest in retaining it. There may also be legal or regulatory reasons why we need to continue to retain it.
- In certain circumstances you have the right to restrict and/or object to certain processing if it meets legal requirements.
- Where we rely on your consent to process your personal data, you may withdraw your consent at any time. However we may continue to process your personal data if we have other legitimate or lawful reasons to do so. If you withdraw your consent, we may not be able to provide our products and services to you. If this is the case, we will tell you.
- You have the right to ask us not to use your information for marketing purposes and to stop sending marketing communications.
You have a right to complain to us if you are dissatisfied in the way that we have handled your personal data. You may contact us for details of our complaints policy. If you are an individual, you also have a right to complain to the Information Commissioner’s Office if you are unhappy with the way we handle your data. Their details are Customer Contact, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, telephone 0303 123 1113 or email email@example.com. You can also download and complete a complaint form by following the link at https://ico.org.uk/concerns/
Pump Lane North
Marlow, SL7 3RD
Tel: 01628 485697