Group means any company within the STB Leasing Limited s group of companies and/or the ThinkSmart group of companies.

Transcription

1 PRIVACY DECLARATION In this Privacy Declaration, unless the context otherwise requires: We, us, our means STB Leasing Limited, and/or RentSmart Limited trading as ThinkSmart ( ThinkSmart / we / us ), and any person to whom any of our respective rights and/or duties in connection with the agreement with you are transferred. Please note that in certain circumstances STB has appointed ThinkSmart as its agent any queries concerning this Privacy Declaration should be directed to ThinkSmart. Group means any company within the STB Leasing Limited s group of companies and/or the ThinkSmart group of companies. More information on ThinkSmart can be found at DATA PROTECTION LAW We are the data controller in respect of the information that you give to us and which we hold about you. From 25 May 2018, data protection law is changing the new law is called the General Data Protection Regulation or GDPR for short. From this date, you will have additional rights (and we will have additional obligations) in respect of your personal information. This Privacy Declaration (under the Your Rights section) sets out the rights you will have when the GDPR comes into force. If we propose to enter into an agreement with you, it is a condition of you being assessed for that purpose for you to provide us with the personal information that we request from you (or from the retailer who introduces you to us) which it is necessary for us to have for the purpose of entering into the agreement with you, administering the agreement and for the purposes described below. If you fail to provide us with the information we request from you, we will not be able to proceed with the checks that we need to perform to enter into the agreement (described below) and, subsequently, we will not enter into the agreement with you. HOW WE USE YOUR INFORMATION (A) Before We Enter Into an Agreement with You Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, to verify your identity and to assess whether you are sufficiently likely to repay amounts which you would owe to us if we were to enter into an agreement with you. These checks require us to process personal data about you (for example, name, address, date of birth, contact details and employment details) which you have provided, we have collected from you or we have received from third parties. This personal data will be used to prevent fraud and money laundering, to allow us to assess the credit risk of entering into an agreement with you and to verify your identity. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business, to assess the credit risk of entering into an agreement with you and to comply with laws that apply to us. Such processing is also a contractual requirement of the financing you have requested. (B) Administration Our main use of your information is to administer your agreement with us. We will use your information to process payments, notify you of any late or overdue payments and to contact you regarding any other matter relating to your agreement.

2 The use of your information in this way is necessary for the performance of the agreement with you and, initially, to take steps to enter into the agreement with you. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering. (C) Credit Referencing and Fraud Prevention When processing your personal data, decisions about your application will be made by automated means. We will use a scoring matrix (or other automated process) to assess your application and may automatically decide that we consider your credit risk to be too high or that you pose a fraud or money laundering risk if our processing reveals your behaviour to be similar to that of fraudsters or money launderers. You have rights in relation to automated decision making: if you want to know more please contact us using the details set out at the end of this Privacy Declaration. If you have a financial associate (such as someone with whom you have a joint mortgage or a joint bank account or have jointly applied for an account with in the past), we will link your records together. Credit reference agencies will also link your records together and these links will remain on your and their files until such time as you or your financial associate successfully files for a disassociation with the credit reference agencies to break that link. If you apply to us for credit, when processing applications, we will use the information that you provide to us to obtain information about you from credit reference agencies to assess whether you are sufficiently likely to repay amounts which you would owe to us if we were to enter into an agreement with us (credit search), to verify your identity and prevent fraud and money laundering. We will record information about you with them to help make decisions about your application. Following the credit search, if we determine that you pose a fraud or money laundering risk, we may refuse to provide the credit that you have requested. A record of any fraud or money laundering risk will be retained by us. When we perform a credit search this will leave a footprint on your credit file and this may affect your chances of obtaining credit in the future. This is necessary for the purposes of our legitimate interests in establishing any risks in entering into an agreement with you and any risks throughout the agreement and to prevent, detect and prosecute fraud and other crimes. We will give details of any loan agreement that you have with us and how it is conducted to credit reference agencies and fraud prevention agencies. If you do not make repayments in full and on time, we will tell credit reference agencies who will record the outstanding debt. The information at the end of this Privacy Declaration (under How To Find Out More ) provides a link which gives you further details about how credit reference agencies, fraud prevention agencies, we and other lenders use your information in this way we currently submit data to both Experian and Callcredit. Use of your information in this way is necessary for the purposes of our legitimate interests in recovering any debt owed to us and detecting and preventing fraud. We currently obtain information from Experian and Callcredit (relating to the credit search ) and we currently pass information about you to Experian and Callcredit.

3 Please contact us at the details provided below in the How to find out more section, if you would like the details of those credit reference agencies from which we obtain information (relating to the credit search ) and the credit reference and fraud prevention agencies to which we pass information about you in accordance with this Privacy Declaration. (D) Introducers, Agents and Other Third Parties We may pass your information to companies within our Group, who may use and update your information to assess lending risks, to recover debts, to prevent, detect and prosecute fraud and other crimes, and to manage our and any member of our Group s relationship with you. This is necessary for the purposes of our legitimate interests in establishing any risks in entering into an agreement with you and any risks throughout the agreement, the ability for us to recover any debt owed to us by you and for the administration of the agreement with you. The Group also has legal obligations that it must comply with (such as to report fraud). Sometimes we need to give information to the retailers who introduce you to us for the following purposes: - to enable the relevant retailer to deal with complaints made by you; - to coordinate responses to requests made by you relating to you rights under the Data Protection Laws; - to effect the exercise of any rights that you have under applicable laws and regulations. This is necessary for the purposes of our legitimate interests in order to protect our business and to comply with relevant Data Protection Laws that apply to us. If we become entitled to terminate any agreement we have with you, we may pass your information to a debt collection agency in connection with recovery of monies due on your agreement. Use of your information in this way is necessary for the purposes of our legitimate interests in recovering any debt owed to us. We will share your information with other organisations if we sell or buy any business or assets (as we will share your data with the prospective seller or buyer), or if we or substantially all of our company assets are acquired by another party, in which case your information will be one of the transferred assets. This is necessary for the purposes of our legitimate interests to ensure that we or our business remains commercially viable. We will share your information with any funder who provides the finance for your agreement.

4 This is necessary for the purpose of our legitimate interests in maintaining our funding lines so that our business remains commercially viable. (E) Call Recording We will record phone conversations with our customers. This is necessary for the purposes of our legitimate interests to enable us to properly resolve complaints, to improve our service standards and for staff training purposes. (F) Analytics We use analytics tools on our website that are provided to us by third parties acting on our behalf; we will ensure that your information is secure and protected in accordance with our obligations under data protection law. We use your information in this way as it is necessary for our legitimate interests in (i) detecting fraud by understanding behaviours and patterns that correlate to committing fraud; and (ii) understanding the customer journey so that we can understand your needs and provide a better service to you, and to help us develop and improve our products and services. These tools may process some of your personal data by converting it into statistical or aggregated data. MARKETING PREFERENCES You can change the marketing preferences that you have selected at any time please call ThinkSmart on RETENTION OF YOUR INFORMATION Information that we provide to credit reference agencies remains on their file for 6 years after any loan agreement with us is closed, whether settled by you or upon default. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years. If we have an agreement with you, when the agreement ends for any reason, we retain your records for a period of six years plus the current year after your agreement with us has ended, after which your information will be removed from our records. All other information that we hold about you will be held for a period of six years plus the current year from the date of your application. LOCATION OF YOUR INFORMATION The information that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ( EEA ). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the processing of your payment details and the provision of support services. Where adequate protections for your information do not exist under the applicable laws of that third country, we (or the party transferring your information) will take necessary steps to ensure that appropriate safeguards are put in place to maintain the same levels of protection as are needed under UK data protection legislation. Safeguards include imposing contractual obligations on the recipient of your information or subscription to international frameworks that ensure adequate protection (for example, the EU-US Privacy Shield for transfers to the US). Please contact us for more information about the protections that are in place.

5 Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to international frameworks intended to enable secure data sharing. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Declaration. YOUR RIGHTS Under the Data Protection Act 1998 you have certain rights including the right of access to your personal data. We may charge a fee of 10 for this service. If anything is inaccurate or incorrect, please let us know and we will correct it. From 25 May 2018 (when the GDPR comes into force in the UK), you have certain rights in relation to your information. From this date, you will have the right to (i) be informed about how your information will be used (at no cost to you), (ii) ask us to restrict processing, (iii) if it is technically feasible, transmit your information from our systems to a third party s system in a safe and secure way, (iv) object to our use of your information where we are using it for the purposes of our legitimate interests as described in this agreement, (v) not to be subject to a decision when is it based on automated processing and it produces a legal effect or a similarly significant effect on you and if it does then you have the right to request a human intervention please contact us using the contact details below for more information about exercising this right (vi) access your information at no cost (unless your request is unfounded or unreasonable), (vii) if your information is inaccurate or incomplete, then you can ask us to have it rectified, (viii) in certain circumstances, you have the right to ask us to delete your personal information. For more information or to exercise your data protection rights, please contact us using the contact details below. CUSTOMER COMPLAINTS You have the right to lodge a complaint with the Information Commissioner s Office where your data has or is being used in a way that you believe does not comply with data protection laws. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. CHANGES TO THIS PRIVACY DECLARATION We may make changes to this Privacy Declaration at any time by sending you an with the modified terms or by posting a copy of them on the customer area of our website. Any changes will take effect 7 days after the date of our or the date on which we post the modified terms on the customer area of our website, whichever is the earlier. Your continued use of the website after that period expires means that you agree to be bound by the modified policy. HOW TO FIND OUT MORE You can contact the credit reference agencies currently operating in the UK; the information they hold may not be the same so it is worth contacting them all. They will charge you a small statutory fee. CallCredit, Consumer Services team, PO Box 491, Leeds, LS3 1WZ or call Equifax PLC, Credit File Advice Centre, PO Box 3001, Bradford, BD1 5US or call or log on to Experian, Consumer Help Service, PO Box 8000, Nottingham NG80 7WF or call or log on to These three credit reference agencies have together produced a joint Credit Reference Agency Information Notice (CRAIN) which provides further information as to how they use your personal data. You can find the most up to date version of the CRAIN at If you have any queries or concerns about the way in which we use your information, or if you want details of the relevant fraud prevention agencies, you can contact us at:

6 Data Protection Officer ThinkSmart 7 th Floor, Oakland House, Talbot Road, Manchester, M16 0PQ or send an to customerservice@thinksmartworld.com with the subject heading data protection query.