Your personal information will be held securely so that we and any other companies in our Group that you have dealings with, either now or in the future, can manage your relationship with us. This will include information you provide when you apply to us, and any additional information provided by you or others.

Payment Services Directive 2 (PSD2) and your data

The Payment Services Directive 2 (PSD2) is a new regulation which has been introduced to help protect you from online fraud. You may have had communications already from other suppliers or heard of it being referred to as Strong Customer Authentication or SCA.

This new regulation means we'll take additional steps to verify your identity when you log in to your online account to manage your loan or credit card, rather than just asking for your password or fingerprint.

From the 14th of March 2020, every time you log in to your 118 118 Money online account, we will be sending you a one-time passcode and you will need to enter this to complete your log in. If you use our app to manage your account you won't have to do this every time you log in but we will be asking you to verify your identity every so often.

The passcode will be sent to the mobile phone number you have registered with us as a text message. Please ensure that your mobile phone details are up-to-date and should you need to change them, please contact our Customer Assistance team on 02920 548118 or via the mobile app.

What is Eligibility Check?

Eligibility Check is an online service we offer which will tell you if you might be eligible for one of our products and services (such as a loan or a credit card) without it affecting your credit rating.

If you wish to use Eligibility Check you will be asked to submit certain personal information to us— please see the Using credit reference agencies (CRAs) section below for further details of the information you will be asked to provide.

Eligibility Check allows us to check your credit record (you’ll be able to see our search on your credit file, but other organisations won’t be able to see it which means that it will not impact your credit rating). We will use our search, together with the information you have provided to tell you if we’re likely to accept you for our products and services, solely on a credit basis using our own credit scoring methods.

Following the Eligibility Check, we’ll tell you if you’re likely to be accepted by us for our products and services, but this is not an offer of credit.

If, following the Eligibility Check, you decide to complete your application for our products and services we will run further checks (including a credit check which other organisations will be able to see on your credit file) and, if:

• we find certain information on fraud prevention databases or we can’t verify your identity or other information you’ve given us; or
• based on the information you’ve given us we don’t believe that the product or service is affordable or sustainable for you,

we will not be able to offer you the product or service.

As we are a finance broker (as well as being a lender), if we are not able to offer you one of our products or services, we may pass your information to our lending partners Aspire Money Limited (Aspire) or Monevo Limited (Monevo). Aspire Money/Monevo is a consumer credit lending platform who may use your information to assist you in a finding an alternative appropriate product which meets your needs by sharing your application data with other providers.

To enable us to legitimately pass your application information (including personal data you have provided) to one of our lending partners, we will request your consent and this consent will be recorded for audit purposes.

Once your data has been passed to one of our lending partners, you will retain a relationship with both 118 118 Money and the lending partner in line with the terms as stated in the respective privacy policies.

For further information on Monevo, please visit www.monevo.com.

For further information on Aspire, please visit www.aspiremoney.co.uk.

We also partner with Money Wellness for debt advice, and where we do not have any products which meet your requirements, we may pass you through to Money Wellness to see if they are able to help you further with debt advice/consolidation, support and methods to help your financial wellbeing. For further information, please see https://www.moneywellness.com/privacy.

Who do we share your personal information with?

Our Group companies

We may share your personal information with any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries. This enables us, and other companies within our Group, to better understand your needs and run your accounts in the efficient way that you expect. We will always treat your personal information as private and confidential.

Fraud prevention agencies

We will also need to confirm your identify before we can provide you with our products and services and will need to share your personal information to help detect fraud and money laundering risks. We use fraud prevention agencies to help us with this.

Should fraud or money laundering be suspected, we will pass your personal information to a law enforcement agency so that they can investigate, prosecute and prevent financial crime. A fraud prevention agency may also share your personal information with a law enforcement agency.

Online banking and you providing us with bank statements

As part of our checks in respect of your application for one of our products and services, we may also ask you to supply your bank statements in order to verify your identity and/or to verify details of your income and expenditure.

If we ask you for your bank statements, we will tell you how to supply these securely to us directly or we may offer you the option to supply them to us using MOGObankconnect (which is a free of charge service offered by TransUnion (a CRA) which enables us to see the transactions on your bank account securely).

For more information on this service, please see www.TransUnion.co.uk/consumer-solutions/mogo- bank-connect.

We also partner with Credit Kudos Limited, who provide open banking services. This means that during the application process we may direct you to Credit Kudos for you to link your online banking account with your application. This delivers to us the information held within your bank statements and the ability to use these within our decision process for the application and up to 90 days following your application.

You are in complete control of this service and may rescind permission at any time, we will store the information provided by Credit Kudos as per the retention tables in this Policy. Credit Kudos’s Privacy Policy can be found at https://www.creditkudos.com/legal/privacy

118 118 Money’s Use of Open Banking Services (credit card customers only)

What is Open Banking?

Open Banking is an initiative led by the UK's Competition and Markets Authority (CMA) to facilitate innovation, competition and collaboration between banks, financial technology and online service providers through the creation of new products and services for customers using the Application Programming Interfaces (APIs).

118 118 Money and Open Banking

118 118 Money provides you with a payment facility in the form of a credit card and is therefore defined as Account Servicing Payment Service Provider withinOpenBanking. This means that you may provide your consent to FCA regulated third party providers, so that your 118 118 Money related financial information is shared in a controlled and secure manner.

If you choose to share information, you will be automatically be asked to refresh your consent every 90 days to ensure that you continue to understand and consent to the information being shared. At any point you can remove your consent instantly through your online account with 118 118 Money, or through the third party provider's software.

Data that may be shared viaOpenBanking, with your consent, could include the following:-

• Account name
• Account number
• Balance
• Incoming transactions
• Outgoing transactions
• Detailed statement view
• Product details
• Offers available to you

Please be aware that if we share your data, with your consent, you will also be able to review this data within your chosen third party Open Banking provider.

Using credit reference agencies (CRAs):

CRAs collect and maintain information about consumers’ and businesses’ credit behaviour. This includes Electoral Register, fraud prevention and credit information. This will include details of previous applications and the conduct of your accounts—and public information such as County Court Judgments, decrees, and bankruptcies.

We carry out credit and identity checks when you apply for our products and services. This helps us to:

• check the information you have given us;
• check your identity;
• assess your financial status;
• analyse your spending habits and your management of your accounts with us;
• determine your chances of being accepted for our products and services;
• help detect and prevent fraud and money laundering;
• identify and, where applicable, rank the most appropriate products and services for you, taking into account your personal circumstances.

We will use CRAs who will make credit searches and will pass your information to CRAs (such as TransUnion Limited, Equifax Limited and Experian Limited). We will give details of your accounts and how you manage it/them to CRAs. We will also do this on a periodic basis to manage your accounts with us.

The CRA will supply us with both public (including the Electoral Register) and shared credit and fraud prevention information. This information may be supplied to other organisations by CRAs and fraud prevention agencies to perform similar checks and to trace your whereabouts and recover debts that you owe. We may also ask CRAs to give us information about you.

The CRAs will keep a record of this search and place a “footprint” on your credit file, whether or not the application proceeds, this is deemed a soft search during the application process and is only viewable by you.

This information may be supplied to other organisations by CRAs and fraud prevention agencies to perform similar checks and to trace your whereabouts and recover debts that you owe. We may also ask CRAs to give us information about you.

The information we provide CRAs together with any information you provided us to assess your application may be shared between us, the CRAs and fraud prevention agencies and used by them and us to make decisions, for example when:

• checking details on applications made by you;
• managing your accounts;
• recovering debt;
• checking details of job applicants and employees;
• detect and prevent crime, fraud and money laundering;
• check your credit history;
• analyse your income;
• assess your spending habits;
• verify your identity if you apply, or someone financially linked with you applies, for products or services;
• trace your whereabouts;
• undertake research, statistical analysis and systems testing;
• manage your accounts, for example, in the event that we are considering, or you ask us to consider, changing your credit limit;
• to see if you might be eligible for any of our other products and services.

Where the data, we have received, identifies that the data we hold on you is inaccurate, in accordance with the accuracy principle of UK GDPR, we will ensure that the data is rectified without delay.

Monitoring for fraudulent applications

118 118 Money utlises services provided by TransUnion which assist us in identifying potentially fraudulent applications and activity. These services are able to check ID, email addresses and characteristics about the mobile phone or computing device being used to apply for or use of our financial services. For this purpose the services may include, but not be exclusive to, CallValidate UK, EmailRisk, DeviceRisk, MobileRisk, MobileSimSwap and MobileKYC.

For TransUnion to provide these services, 118 118 Money automatically transfers these details to TransUnion for their analysis and to contribute to central databases. During normal service this information is stored within the UK and European Economic Area (EEA), however, during times of recovery or business continuity, this information may be stored by TransUnion outside of the UK and EEA.

TransUnion may also use other TransUnion group companies, or approved sub-contractors, to provide these services to you.

For further information, please review the TransUnion privacy policy, which can be found at:

https://www.transunion.co.uk/legal/privacy-centre

Relating to the DeviceRisk service, please see the privacy policy at the link https://www.iovation.com/privacy

Your rights

You have the right to apply to the CRAs for a copy of your credit file.

We use different agencies so please be aware that the information they hold may not be the same. There is a small fee that you may need to pay to each agency that you apply to. The addresses of the CRAs we currently use are:

Experian Consumer Help Service, PO Box 9000, Nottingham NG80 7WP or call 0844 481 8000 or log on to http://www.experian.co.uk/crain/index.html

 

TransUnion Consumer Services Team, PO Box 491, Leeds LS3 1WZ or call 0870 060 1414 or log on to www.TransUnion.co.uk/crain

 

Equifax Customer Service Centre, PO BOX 10036, Leicester LE3 4FS or call 0800 014 2955 or log on to

https://www.equifax.co.uk/crain

You can also find out more information about the CRAs we use by reading the Credit Reference Agency Information Notice each CRA makes available on its website (see http://www.experian.co.uk/, https://www.equifax.co.uk, and www.TransUnion.co.uk). This notice will:

• tell you about the CRA;
• provide further details on the information held by the CRA and how they use it;
• let you know who the CRA shares information with and why;
• explain how the CRA works with fraud prevention agencies;
• give you information on your rights.

Using fraud prevention agencies:

As part of our due diligence when assessing your application, we have systems that protect our customers and ourselves against fraud and other crime.

Customer information can be used to prevent crime and trace those responsible. We will share your personal information from your application with fraud prevention agencies.

If false or inaccurate information is provided and fraud is identified, details of this fraud will be passed to these agencies. We and other organisations may access and use from other countries the information recorded by fraud prevention agencies. Law enforcement agencies may access and use this information.

If your details are passed to these agencies because we believe that you have committed fraud, you may find it more difficult to obtain services, finance or employment with us and other participating organisations.

We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

• checking details on applications for credit and credit related or other facilities;
• managing credit and credit related accounts or facilities;
• recovering debt;
• checking details on proposals and claims for all types of insurance; and
• checking details of job applicants and employees.

We may also make periodic searches at fraud prevention agencies to manage your account with us.

The Fraud Prevention Agency we use is:

• CIFAS, with registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London, WC1H 9LT.
• You can contact CIFAS at https://www.cifas.org.uk/contact_us.

Using debt collection agencies

We may have referred the collection of your debt with us to a third party, and may have sent them your personal data (as per previous Privacy Policy versions), along with the financial standing of your account and advise of any missed payments, and/or balances outstanding.

118 118 Money does not use debt collection agencies at this time.

There may be circumstances where your debt is returned to 118 118 Money and the third-party debt collection agency may retain your personal data for 180 days from the date the debt is returned. The purpose for this is to ensure that any queries by you or 118 118 Money can be adequately responded to. All other data retention is as per this statement.

The partner may need to refer to your personal data when contacting 118 118 Money with regard to a complaint or enquiry you raise with them.

Using debt sale partners

We may review your debt as part of our overall collections strategy and decide that the debt is to be sold to a third party. We may negotiate with a number of debt sale organisations as part of this process.

The information we will need to send to these debt sale organisations will include personal data (contact details) and financial records denoting the performance of your debt with us. These organisations must keep your information confidential (though they may share it with credit reference agencies) and take all adequate and appropriate technical and organisational measures to keep your information confidential.

If your debt is sold by 118 118 Money to one of its debt sale partners then you will be informed by letter.

Using debt advice partners

In circumstances where your account may be in arrears or, you may be experiencing financial difficulty, we may suggest that you engage with a debt advice provider.

As part of this, we may ask you to agree a date and time for the debt advice partner to contact you and will subsequently provide your contact details and account reference number to them. If we are already on the telephone to you, we may ask if you wish to be connected immediately on the call to the third party and will facilitate that transfer by providing your contact details and account reference number.

You will be asked for consent for processing your personal data, at the time where the call-back is set up, or your telephone call with us is transferred, and if you do not consent then no further data (personal or otherwise) will be shared.

Our debt advice partner is Benesse Advice Limited (trading as Money Wellness).

Analysis of call recordings

All calls to 118 118 Money are recorded for quality monitoring and training purposes. You are able to request an audio copy of your call recordings by emailing the Data Protection Officer at dpo@118118money.com.

Analysis of your journey on our website or mobile app

We use a partner called Glassbox (previously SessionCam) to help us analyse your customer experience and journey through our website and mobile app.  This process enables us to see where you stop on our web/app pages and how you manoeuvre within our pages, this helps us identify areas where our customers may experience difficulties or where areas of our customer experience/journey may need improvement or changes.

All personal data within the journey is masked and not stored or seen by Glassbox.

Communications with you

We have partnered with Braze.com to provide a multi-channel communication platform between 118 118 Money and our customers.

Service messages will be sent via this channel, updating you of the terms of your financial product with us, regulatory notifications etc.

Where you have consented to receive marketing messages, we may also send these via Braze Inc.’s secure messaging platform.

We may occasionally reach out to you using Survey Monkey for your opinions to help us improve our services.
118 118 Money ensures that only employees that have a business need to access the data via our communications channels receive this access and we have performed industry-standard security reviews on all partners processing personal data to be assured that your data is protected at all times.

Privacy policies for our communications partners can be found below:

https://www.surveymonkey.co.uk/mp/legal/privacy/ (customer surveys)
https://www.braze.com/company/legal/privacy (messaging platform)
https://hightouch.com/privacy-policy (management of customer personal data between 118 118 Money and Braze)

Making payments via our telephone system

118 118 Money provides the option for you to use an electronic service for processing debit or credit card payments, for this we use the services of keyIVR.  Following you choosing to make a payment, you are transferred automatically to the keyIVR service which will ask you to enter your card details (card number, expiry date and CVC) using your phone keypad.  Once you have completed this, your details are processed by keyIVR and your card is tokenised, this is a secured method of ensuring that keyIVR do not store your card details.

keyIVR are a PCI-DSS compliant provider of payment services and has passed 118 118 Money’s stringent security due diligence procedures.  Further information can be found at https://www.keyivr.com/pci-dss-solutions/payment-ivr/.

Our other service providers and agents

We will share your personal information with:

• third parties involved in managing accounts and services for you or collecting what you owe to us;
• our suppliers of underwriting and analysis services;
• IT service providers including those which provide our website and mobile app hosting and maintenance services;
• sanction screening, identity and fraud prevention check providers;
• our call centre operators;
• business process outsourcing providers;
• your digital wallet provider (Samsung, Apple or Google) for the purpose of setting up your credit card in their digital wallet service;
• HM Revenue & Customs or other authorities;
• third parties where we are required to do so by law (for example, we are required to screen applications that are made to us to ensure we are complying with the international fight against terrorism and other criminal activities) or by our regulatory bodies such as the Financial Conduct Authority or if we require or are required by others to investigate or prevent crime;
• market research companies to assist in providing better products and services for you;
• third parties who may be connected with your accounts; and
• where we are required as part of our duty to protect your accounts, for example, we are required to disclose your information to the UK Financial Services Compensation Scheme (FSCS).

We will also share your personal information:

• with any person from whom we borrow funds to finance our business or part of it (or with whom we enter into negotiations to finance our business) and their professional advisers;
• with any person to whom we sell, merge or transfer (or enter into negotiations to sell, merge or transfer) our business or part or all of our business or assets or enter into a merger with it;
• to a potential buyer, transferee, or merger partner or seller and their advisers so long as they agree to keep it confidential and to use it only to consider the possible transaction;
• if the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your personal information in the same way as set out in this Privacy Policy.

We will always ensure your information remains safe and secure.

Why we may process special categories/sensitive personal information about you:

Some personal information under data protection law has special protection. This information is known as special categories of personal information but it may also be called sensitive personal information. This type of personal information includes information which relates to your racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, trade union membership, genetic or biometric data or data concerning your health, sex life or sexual orientation.

When you apply to us for our products and services and, as part of managing any products and services you have with us, we may ask you for special categories of personal information. We will only use this information to provide the service you require or help to manage your products and services and/or your account.

If we need to obtain special categories of personal information, we will ask for your explicit consent first.

Where will we transfer your personal information?

There will be times when we share your personal information within our Group and with our third party providers who are located in in countries outside of the European Economic Area (EEA).

Your personal information will be transferred to countries outside the EEA such as the USA and the Philippines. For example, if you’ve got a loan or credit card with us, we use our call centre in the Philippines for customer service calls, payment reminder calls, payment collections calls and to obtain outstanding documentation from our loan customers.

When we transfer your personal information outside the EEA, we will take reasonable steps to ensure that your personal is protected. To do this we use a set of standard data protection clauses which have been approved by the European Commission.

Whenever fraud prevention agencies transfer your personal data outside of the EEA, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the EEA. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

The above approach is compliant with data protection law (being Article 46.2 of the UK GDPR). For further information about these transfers and the safeguards in place, please get in touch via the Contacting us section below.

How we use your personal information to make automated decisions

When you apply for our products and services, we use both a manual and an automated system known as credit scoring to determine your eligibility for them. This is a method of assessing your likely conduct of an account based on a range of data, including the conduct of previous similar accounts. Credit scoring is a system widely used by credit providers to help make fair and informed decisions on lending.

This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

Some of these decisions do not involve human input and the systems apply pre-defined logic programming and criteria to make a decision. For example, we use information about your income, expenditure, other financial commitments and payment history. This information is analysed by automated means which uses statistical models and rule based systems to evaluate your credit worthiness, affordability and overall financial health.

Credit scoring takes into account information usually from three sources:

• the information you provide in connection with your application;
• information provided by searches conducted at CRAs and fraud prevention agencies; and
• information that may already be held about you by us or companies in our

A credit scoring system will consider information from these sources to make an overall assessment of your application. This assessment will extend to anyone with whom you are linked financially or other members of your household.

The information we obtain may be used:

• to check the information you have given us;
• debt tracing;
• analysing your income and spending habits;
• for the detection and prevention of fraud or money laundering;
• the management of our service to you.

If you provide a credit or debit card as part of your application or as part of a continuous payment authority, we may also use a third party to check the validity of the sort code, account code and card number that you submit in order to prevent fraud. The information you provide us will be transferred to CRAs and fraud prevention agencies who will record details of any search whether or not your application succeeds.

We may transfer personal and financial data to a partner called DataRobot Inc., they assist us in refining our lending strategy.

The credit scoring methods used are regularly tested to ensure they remain fair, effective and unbiased. Using a credit scoring system helps us to lend responsibly.

Your rights

You have the right to challenge any automated decision with us directly. You can ask that we do not make automated decisions about you and you can object to an automated decision and ask that a person reviews it.

If you want to know more details about your rights, please get in touch via the Contacting us

section below.

Use of artificial intelligence (AI)

118 118 Money utilises Ultimate.AI who provide us with ChatBot services.  This technology masks any personal data, so Ultimate.AI will not see it, and identifies patterns of questions to assist us in answering quickly the most popular questions and where you need to talk to a member of our customer assistance team, routes your enquiry more effectively.

Asking you for reviews of our products and services

After you have applied for one of our products, we may send your email address to TrustPilot who may ask you to leave a review of the service you have been provided. Should you not wish to leave a review or wish TrustPilot to stop processing your personal data, please contact TrustPilot as stated in their Privacy Policy, https://uk.legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Should you download our 118 118 Money app via the Google Play Store or Apple AppStore and leave a review, we may reach out to you to thank you for your review or to determine any issues you may have in accessing your account or with our app. We will only contact you if we are able to determine unique data to identify you as an individual and we will not divulge any personal data during that conversation (email or telephone) without requiring identification and verification checks to be passed to ensure that we are speaking to you.

Retention of your personal information

How long we keep your information for depends on the basis on which it was provided.

Generally, however, we will keep the information that is necessary to enable us to provide you with the products or services you have requested through our website for as long as it takes us to provide that product or service.

If you have asked that we do not use your details for marketing purposes, we may still need to keep them to ensure our systems reflect your preferences.

We will keep records of any transactions you enter into on our website for a minimum of 6.5 years from the end of our relationship with you. This is so that we can respond to any complaints or disputes that arise in that period.

We will not keep any personal information about you once you no longer have an account with us (e.g., when you no longer have a credit card or loan with us) unless we need to retain your personal information in accordance with applicable statutory requirements and any relevant industry guidelines.

Fraud prevention agencies may hold your personal data for different periods of time, and if

you are considered to pose a fraud or money laundering risk, they may hold your data for up to six years.

If you would like to know more about how long we hold your personal information please get in touch using the Contacting Us section below.

Your rights

You have certain rights with respect to your personal information. The rights will only apply in certain circumstances and are subject to certain exemptions.

Full details of the information we store relating to you and your relationship with 118 118 Money is held in the Customer Data Protection Statement section, please choose whether you are a loan or credit card customer.

Please see the table below for a summary of your rights and who to contact to exercise them.

Your rights	What this means	Who to contact
Right of access to your personal information	You have the right to receive a copy of your personal information that we hold about you, subject to certain exemptions.	Write to us at: The Data Protection Officer 118 118 Money 5th Floor, 1 Capital Quarter Tyndall Street Cardiff, CF10 4BZ Email: dpo@118118money.com
Right to rectify your personal information	You have the right to ask us to correct your personal information that we hold where it is incorrect or incomplete.	Email: dpo@118118money.com
Right to erasure of your personal information	You have the right to ask that your personal information be deleted in certain circumstances. For example: • where your personal information is no longer necessary for the purpose(s) it was collected or otherwise used; • if you withdraw your consent and there is no other legal reason to permit us to continue to use your personal information; • if you object to the use of your personal information (see below); • if we have used your personal information unlawfully; or • if your personal information needs to be erased to comply with a legal obligation.	Email: dpo@118118money.com
Right to restrict the use of your personal information	You have the right to suspend our use of your personal information in certain circumstances. For example: • where you think your personal information is inaccurate; • the use of your personal information is unlawful but you don’t want us to delete it; • we no longer need your personal information, but your personal information is required by you for the establishment, exercise or defense of legal claims; or • you have objected to the use of your personal information and we are verifying whether our grounds for the use of your personal information override your objection.	Email: dpo@118118money.com
Right to data portability	You have the right to obtain your personal information in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. This right only applies where the use of your personal information is based on your consent or for the performance of a contract, and when the use of your personal information is carried out by automated (i.e. electronic) means.	Email: dpo@118118money.com
Right to object to the use of your personal information	You have the right to object to the use of your personal information in certain circumstances. For example: • where you have grounds relating to your particular situation and we use your personal information for our legitimate interests (or those of a third party); and • if you object to the use of your personal information for direct marketing purposes.	Write to us at: The Data Protection Officer 118 118 Money 5th Floor, 1 Capital Quarter Tyndall Street Cardiff, CF10 4BZ Email: dpo@118118money.com
Right to withdraw consent	You have the right to withdraw your consent at any time where we rely on consent to use your personal information.	Write to us at: The Data Protection Officer 118 118 Money 5th Floor, 1 Capital Quarter Tyndall Street Cardiff, CF10 4BZ Email: dpo@118118money.com
Right to complain to the relevant data protection authority	You have the right to complain to the Information Commissioner’s Office (ICO), where you think we have not used your personal information in accordance with data protection law.	Contact the ICO: • ICO Telephone: 0303 123 1113 • ICO website: www.ico.org.uk

Links to third party websites

Our website (www.118118money.com) contains links to other websites over which we have no control.

We are not responsible for privacy policies or practices of other websites to which you choose to link from our website. We encourage you to review the privacy policies of those other websites so you can understand how they collect, use and share your information.

Marketing

If you opted to receive newsletters, commercial emails or other communications from us or selected third parties but subsequently change your mind, you may opt-out by Contacting us as set out at the end of this Privacy Policy.

Cookies

We use cookies on our website (www.118118money.com) to distinguish you from other users of the website. This helps us to provide you with a good experience when you browse the Website and also allows us to improve the Website.

For information on the cookies we use and the purposes for which we use them, please see our Cookie Policy.

Changes to this Privacy Policy

If our Privacy Policy changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures that you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

Where appropriate we will give you reasonable notice of any changes.

This Privacy Policy was last updated in July 2023.

Contacting us:

If you have any questions about this Policy or your personal information and/or if you wish to see what information we hold about you, please contact the Data Protection Officer on dpo@118118money.com.

If you no longer wish to receive any marketing communications or wish us to stop using your personal information, please contact us:

By accessing your 118 118 Money customer portal or via the 118 118 Money app. Login to your account, via a browser, and go to the Marketing Preferences section.

By phone: 02920 548118 or 02920 893300 is charged by your provider as UK national number.

By mail: Data Protection Officer, 118 118 Money, 5^th Floor, 1 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ By email: dpo@118118money.com

How to complain

If you think there is a problem with how your personal information is being handled, you have a right to complain to the Information Commissioner’s Office (ICO).

The ICO can be contacted on 0303 123 1113 or please visit their website at www.ico.org.uk.

DATA PROTECTION STATEMENT

FOR LOANS PRODUCTS – CUSTOMERS OF 118 118 MONEY

IF YOU ARE REFERRED TO OUR UNDERWRITING TEAM (IN ADDITION TO THE APPLICATION PERSONAL DATA)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name (including Title, First name and Surname)	Identification during application process ID verification if you call us	You	Ireland & UK Loan management system Data-warehouse   USA Email system   EU ZeroBounce email verification	Yes Passed to credit reference agencies (TransUnion and Experian)	See application decision for retention periods   ZeroBounce retain checked email addresses for a maximum of 30 days.
Email address	Contact during application process			Yes - ZeroBounce – email address verified by ZeroBounce to ensure that we have captured live email account details.
Mobile number	Contact during application process			No
Date of birth	Identification during application process ID verification if you call us			Yes Passed to credit reference agencies (TransUnion and Experian)
Employer	Identification during application process			No
Net monthly income	Affordability checks during application process			No
Monthly outgoings	Affordability checks during application process			No
Address including postcode	Identification during application process ID verification if you call us			Yes Passed to credit reference agencies (TransUnion and Experian)
Time at address	Identification during application process
Name, address, date of birth	PEPs and Sanctions checking	You	UK	Yes Factiva (Compliance Assist)	See application decision for retention periods
Marital Status	To review financial relationships with others	You	Ireland & UK Loan management system Data-warehouse	No	See application decision for retention periods
Bank details	Identification during application process
Nationality or confirmation of being UK citizen	We can only provide service to UK citizens or those with right to reside in the UK
Debit card Details	Identification during application process

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

Where you have applied via a broker/affiliate (or comparison website) and not taken up our product(s) then data is anonymised (to remove personal data) after 30 days and is retained in the anonymised state for a further 6 months from the date it was anonymised.

IF YOU ARE REFERRED TO OUR UNDERWRITING TEAM (IN ADDITION TO THE APPLICATION PERSONAL DATA)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
TransUnion (CallValidate)	Check validity of bank account	TransUnion	Ireland & UK Loan management system Data-warehouse	No	See application decision for retention periods
TransUnion (Credit Search)	Assessment of current and previous lending
TransUnion (TAC)	Affordability checks as required by FCA
Experian	Affordability checks as required by FCA	Experian	Ireland & UK Loan management system Data-warehouse		See application decision for retention periods
Bank statements	Affordability checks as required by FCA	You	Ireland & UK Loan management system Data-warehouse		See application decision for retention periods
Photo identification	Identification verification
Right to reside	We can only provide service to UK citizens or those with right to reside in the UK

REPORTING OF POTENTIALLY FRAUDULENT LOAN APPLICATIONS

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Personal information provided by you during the loan application process	To CIFAS for reporting potential fraudulent activity	Loan management system	Ireland & UK Loan management System Data-warehouse	Yes CIFAS	6 years from date uploaded
Loan application date

 

APPLICATION DECISION – IF YOU ARE AUTOMATICALLY DECLINED OR WE HAVE ASSESSED YOUR APPLICATION AS NOT BEING ELIGIBLE/YOU CHOOSE NOT TO PROCEED WITH YOUR LOAN APPLICATION/YOU WITHDRAW FROM THE AGREEMENT

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
CallValidate	Check validity of bank account	TransUnion	Ireland & UK Loan management system Data-warehouse	No	24 months
Credit Search	Assessment of current and previous lending
TAC	Affordability checks
Experian	Affordability checks	Experian	Ireland & UK Loan management system Data-warehouse
All personal information provided by you during application	To refine our scoring procedures	You (with permission to re-use)	UK Loan declines database   Ireland Data-warehouse	Yes Passed to credit reference agency (TransUnion: https:// www. TransUnion. co.uk/crain) maximum twice within 24 months

Where we have declined your application, we may contact you to offer the services of our debt advice partner, Money Wellness. They may be able to help you further with debt advice/consolidation, support and methods to help your financial wellbeing. For further information on how Money Wellness process your personal data, please see https://www.moneywellness.com/privacy.

LOAN APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN

Analytics and Scoring Procedures

As mentioned in row 5 above, 118 118 Money may retain your personal data if you are declined as a loan customer, or decide not to proceed with your loan application, for the purpose of improving the scorecards for our financial services products.

The legitimate interest requirement is to enable us to further refine our scoring based on the information submitted as part of the application process. This applies to both declined and approved customers. This information may be passed to relevant third parties (such as Credit Reference Agencies) to assist us in building better models for credit scoring in the future.

This information is retained for declined applications for 24 months.

APPLICATION DECISION – APPROVED FOR A LOAN

Type of data	Why do we need this information?	Source of data	Where stored?	Shared	Retained for?
Agreement number	For loan products, you are assigned a unique reference number.	System generated	Ireland & UK Loan management system Data-warehouse	No	End of product term + 6 years and 6 months
CallValidate	Check validity of bank account	TransUnion
Credit Search	Assessment of current and previous lending
TAC	Affordability checks
Credit score	Score indicating credit worthiness
Experian	Affordability checks	Experian	Ireland & UK Loan management system Data-warehouse	No	End of product term + 6 years and 6 months

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Financial Statement	Assessment of ability to repay your debt   Analysing your payment behaviour with 118 118 Money and other creditors to assess whether we are able to help with your financial situation	Debt Management Company Insolvency Practitioner Credit reference agencies	Ireland & UK Loan management system Collections task system Internal Network Drive Data-warehouse	Yes Financial Ombudsman (where appropriate) Financial Conduct Authority (where appropriate)	End of product term + 6 years and 6 months
List of other creditors including reference numbers
Motor Vehicle details
Personal information of Partner/Family members
Age of dependent
Total Liabilities
Asset information including values
Estimated Deficiencies
Credit reference agency/credit file payment history
Customer circumstances		Medical Professional
Medical professional information including Name and address.
Medical History

MARKETING MESSAGES (WHERE YOU HAVE OPTED IN)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name	For sending personalized marketing messages based on the preferences you have stated and your interest in our products	You	Ireland & UK Customer Relationship Management System     EU ZeroBounce email verification Braze – email system	Yes         Email addresses are verified by ZeroBounce to ensure that we are sending to live email accounts.	Until you opt out of receiving marketing messages     ZeroBounce retain checked email addresses for maximum of 30 days.
Address including postcode
Mobile number
Email address

 

You are able to manage your marketing preferences by logging into your online account, via the mobile app or by calling our Customer Services team.

The default setting for marketing is opt-out by all methods.

The above may be shared with selected third parties in circumstances where you have provided permission for this.

DATA PROTECTION STATEMENT

CREDIT CARD CUSTOMERS – 118 118 MONEY

WHEN APPLYING FOR A CREDIT CARD ON OUR WEB SITE OR VIA A MOBILE APP

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (including Title, First name and Surname)	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)	You	Ireland & UK Internal credit card customer databases Data-warehouse   USA Email system   EU ZeroBounce email verification	Yes TransUnion Experian Equifax (credit reference and scoring)   ZeroBounce – email address verified by ZeroBounce to ensure that we have captured live email account details.	See application decision for retention periods   ZeroBounce retain checked email addresses for a maximum of 30 days.
Email address	Contact during application process Checking for duplicate applications (potential fraud)
Mobile number
Date of birth	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)
Net monthly income	Affordability checks during application process
Monthly outgoings	Affordability checks during application process
Address including postcode	Identification during application process ID verification if you call us
Time at address	Identification during application process
Residential Status	Identification during application process	You You	Ireland & UK Internal credit card customer Databases Data-warehouse Ireland & UK Internal credit card customer databases data-warehouse	Yes TransUnion Experian Equifax (credit reference and scoring) Yes TransUnion, for their CallValidate service to verify identification	See application decision for retention periods Maximum of 24 months if application is unsuccessful or not taken up by the customer. 6 years, 6 months from the termination of your credit card agreement with us, if application is successful
Bank Details (including account holder, sort code and account number)	During application as part of identification process
Balance Transfer (BT) product
Primary account number (PAN)   Expiry date	Ownership check, to establish that the originating card belongs to you. For making the transfer from your new 118 118 Money card to your originating card.	You	Ireland & UK Internal credit card customer databases data-warehouse (masked to protect the card data)	Yes Transmitted to TransUnion to verify cardholder identity matches you.	6 months in all cases, to ensure data is available within an appropriate time for you to contact us about your transfer.

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

Where you have applied via a broker/affiliate (or comparison website) and not taken up our product(s) then data is anonymised (to remove personal data) after 30 days and is retained in the anonymised state for a further 6 months from the date it was anonymised.

REPORTING OF POTENTIALLY FRAUDULENT CREDIT CARD APPLICATIONS

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Personal information provided by you during the loan application process	To CIFAS for reporting potential fraudulent activity	Third Party TSYS (Credit card management)	Third Party TSYS (Credit card management)	Yes CIFAS	6 years from date uploaded
Credit card application date

 

CREDIT CARD APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN

Where we have declined your application, we may contact you to offer the services of our debt advice partner, Money Wellness. They may be able to help you further with debt advice/consolidation, support and methods to help your financial wellbeing. For further information on how Money Wellness process your personal data, please see https://www.moneywellness.com/privacy.

Analytics and Scoring Procedures

118 118 Money may retain your personal data if you are declined as a credit card customer, or decide not to proceed with your credit card application, for the purpose of improving the scorecards for our financial services products.

The legitimate interest requirement is to enable us to further refine our scoring based on the information submitted as part of the application process. This applies to both declined and approved customers. This information may be passed to relevant third parties (such as Credit Reference Agencies) to assist us in building better models for credit scoring in the future.

This information is retained for declined applications for 24 months.

CREDIT CARD APPLICATION IS APPROVED

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (including Title, First name and Surname)	ID verification if you call us	You	Third Party – UK TSYS (credit card management) Ireland & UK 118 118 Money database records Data-warehouse   USA Email system	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)	6 years, 6 months from the termination of your credit card agreement with us
Email address				Yes TSYS (credit card management)
Mobile number
Date of birth
Address including postcode				Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)

 

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (as shown on credit card)	To print plastic card showing your name   To answer your questions through customer services, fraud investigations or collections team.   To send you regular service-related mail and monthly statements	You	Third Party – UK TSYS (credit card management) Ireland & UK 118 118 Money database records Data-warehouse	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers)	6 years, 6 months from the termination of your credit card agreement with us
Primary Account Number (PAN – 16 digit credit card number)	To refer to your account along with your name, address and other personal data   Printing on your credit card   Used as a reference in reporting within 118 118 Money	Third Party TSYS (Credit card management) Originating from Mastercard	Third Party – UK TSYS (credit card management)	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)	6 years, 6 months from the termination of your credit card agreement with us
Bank details (including Bank Account Number, Sort Code And Account Holder name for Direct Debit)	For taking regular payments via direct debit	You		Yes TSYS (credit card management)
Credit Card details (including card number, expiry date and balance to transfer)	For the purpose of transferring a balance from an existing credit card to the 118 118 Money Credit Card. We may also use this information plus your name to verify that the credit card is yours.	You		Third Party – UK TSYS (credit card management)	6 years, 6 months from the termination of your credit card agreement with us

IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Financial Statement	Assessment of ability to repay your debt   Analysing your payment behaviour with 118 118 Money and other creditors to assess whether we are able to help with your financial situation	Debt Management Company Insolvency Practitioner Credit reference agencies	Ireland & UK Loan management system Collections task system Internal Network Drive Data-warehouse	Yes Financial Ombudsman (where appropriate) Financial Conduct Authority (where appropriate)	End of product term + 6 years and 6 months
List of other creditors including reference numbers
Motor Vehicle details
Personal information of Partner/Family members
Age of dependent
Total Liabilities
Asset information including values
Estimated Deficiencies
Credit reference agency/credit file payment history
Customer circumstances
Medical professional information including name and address		Medical Professional
Medical History

MARKETING MESSAGES (WHERE YOU HAVE OPTED IN)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name	For sending personalized marketing messages based on the preferences you have stated and your interest in our products	You	Ireland & UK Customer Relationship Management system EU ZeroBounce email verification Braze – email system	Yes Email addresses are verified by ZeroBounce to ensure that we are sending to live email accounts.	Until you opt out of receiving marketing messages ZeroBounce retain checked email addresses for maximum of 30 days.
Address including postcode
Mobile number
Email address

You are able to manage your marketing preferences by logging into your user portal, via the mobile app or by calling our Customer Services team.

The default setting for marketing is opt-out by all methods.

The above may be shared with selected third parties in circumstances where you have provided permission for this.

IF YOU CHOOSE TO ADD AN ADDITIONAL CARDHOLDER AT ANY TIME

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name of additional cardholder (as shown on credit card)	To print plastic card showing their name Identification when you contact us	You	Third Party TSYS (credit card management)	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers)	6 years, 6 months from the termination of the main account holder’s credit card agreement with us
Name (including Title, First name and Surname) of additional cardholder	To register details	You (we assume that you have permission from the additional cardholder to use their personal information)		Yes TSYS (credit card management)
Date of birth of additional cardholder	To ensure that the additional cardholder is over the age of 18

 

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Address of additional cardholder (including postcode)	Requirement is that the additional cardholder lives at the same address as the main cardholder	You (we assume that you have permission from the additional cardholder to use their personal information)	Third Party TSYS (credit card management)	Yes TSYS (credit card management)	6 years, 6 months from the termination of the main account holder’s credit card agreement with us
Mobile number of additional cardholder	For providing service messages relating to the additional cardholder Identification when you contact us
Relationship to main cardholder	Terms and conditions require additional cardholder to be a family member
Primary Account Number (PAN – 16 digit credit card number)	To refer to your account along with your name, address and other personal data   Printing on your credit card   Used as a reference in reporting within 118 118 Money	Third Party TSYS (Credit card management) Originating from Mastercard		Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers)

 

Under UK GDPR (General Data Protection Regulation), you have the right to:

1. Be informed of why, how and where we process your personal data

This statement meets this requirement, advising you on what data we collect, who we may share it with and how long we may store it for.

2. Access your data

To access the data we keep on you, please email your subject access request to dpo@118118money.com. Please provide as much scope and timelines as possible to assist us in retrieving your data as quickly as possible.

3. Have your data corrected/updated

The data we keep on you should always be up-to-date and relevant, if you require changes to the

data, then please contact our Customer Services team as shown above..

4. Have your data deleted (right to erasure)

Please contact dpo@118118money.com to have your data deleted, please state what data and why.

5. Restrict processing, enabling 118 118 Money to store the data but no longer process it Should you require us not to process your information as described in the table, please contact the information holder or the data protection officer (dpo@118118money.com) immediately and request it to be restricted.

6. Data portability

If you need us to port your data elsewhere, please contact data protection officer (dpo@118118money.com) with full details of your requirements.

7. Object

You have the right to object or opt out of processing based on performance of the process and or direct marketing or profiling. To object, please contact Customer Services on 02920 548118 or you can escalate your concerns to the Information Commissioner by completing the form on https:// ico.org.uk/concerns/handling/

8. Rights related to automated decision making and profiling

118 118 Money will use automated decisioning when considering your eligibility for one of our financial services products. You are able to contact us via our Customer Services lines (as shown above) to discuss the outcome of our assessment.