Norwich Trust Limited – Privacy Policy

This Privacy Policy sets out what information Norwich Trust Limited will collect about you and how Norwich Trust Limited uses and protects any information that you give us (via this website or during any other transactions with us). Norwich Trust Limited may change its Privacy Policy wording from time to time by updating this page.
This policy was last updated 25.10.2024
By submitting your application to Norwich Trust Limited, you confirm you have read this Privacy Policy and the Norwich Trust Limited Terms of use and Cookie Policy.

Some concepts that are important to this privacy policy

The law restricts what can be done with personal information that relates to an identifiable living person.  Commonly, such information is referred to as “personal data”, the person it relates to as the “data subject” and what is done with that information as “processing”.  Providing that information to another person and storing that information are both examples of processing.  A person who gets to say what personal data is collected and/or how personal data is processed is commonly referred to as a “controller” in respect of that personal data.  A person who carries out processing under the direction of someone else is commonly referred to as a “processor” in respect of that personal data.

The main pieces of law that apply to us regarding the processing of personal data is the Data Protection Act 2018 (or the “DPA”) and the UK General Data Protection Regulation (or the “UK GDPR”).

All of the law that applies to us in respect of personal data is referred to in this privacy policy as the “data protection legislation”.

The company this privacy policy relates to

References in this privacy policy to “we”, “us”, “our”, “ours”, “company” are all to Norwich Trust Limited.

Norwich Trust Limited will only process personal data in accordance with the applicable legislation.

References in this privacy policy to Norwich Trust Limited, however referred to, include predecessors and successors to its rights and obligations in respect of:

• loans;
• applications for loans; and/or
• its business or any part of its business.

About Norwich Trust Limited

Norwich Trust Limited is a company registered in England and Wales under company number 12706211

Registered office: 25-27 Surrey Street, Norwich NR1 3NX

VAT number: 765353512

Authorised and regulated by the Financial Conduct Authority Reference (FCA) No. 979682

Registered with the UK Information Commissioner’s Office. Registration number: ZB346729.

About this privacy policy

We set out here how we process personal information that relates to would-be, current and past borrowers from Norwich Trust Limited. We also explain how we process personal information that relates to other people who act on behalf of would-be, current and past borrowers.

Such a document is referred to often as a data protection policy or a privacy policy.  We refer to it as our “privacy policy”.

If we process personal data in respect of you, then how and why we process it, and the people we may provide it to, largely depend on the nature of the relationship we have, or have had, with you at the relevant time.

In this privacy policy where we describe the personal data we may process, we explain the personal data that is involved and:

• how we have obtained it;
• the purpose of us processing it;
• the lawful grounds on which we are relying when conducting that processing;
• the other people to whom we may provide it;
• our reason for providing it to those other people; and
• how long we may retain it.

This privacy policy also sets out your principal rights in respect of personal data that we process where you are the data subject.

Who this privacy policy is relevant to

This privacy policy is relevant to you if:

• you are a current, past or prospective borrower from us (“borrower”); or
• You are a person (a “third party”) acting on behalf of a borrower, with their authority, such as a family member, carer, support worker or someone who has power of attorney (or similar authority) over a borrower’s financial affairs; or
• You are a third party who has a relationship with a borrower and make payments on their behalf.

Such persons are referred to in this privacy policy by the terms “you”, “your” and “yours” except in those sections directed specifically at third parties.

Changes to this privacy policy

The most likely reasons that we may need to change this privacy policy are:

• developments in our business, as innovations occur and/or we identify better ways of doing things that may be of benefit to us and/or to customers and/or other people that we deal with;
• changes in the law and/or the interpretation that the Courts place on it;
• certain decisions and directions of the Financial Ombudsman Service (FOS); and
• changes in the requirements or guidance of regulators that relate to our business and/or your personal data.

For these, and other reasons, we may need to change this privacy policy from time to time.

We will not notify you of changes to this privacy policy, so we recommend that you check it from time to time.  You can see here when this privacy policy was most recently updated.

Your questions about this privacy policy

If you have any questions regarding this privacy policy please contact our Data Protection Officer

Why we need to process your personal data

We cannot engage with you unless we process your personal data, but if you do not want us to process your personal data in accordance with this privacy policy you should not provide your personal data to us.

When you give us your personal data your rights in respect of it can be restricted, so, if you do not agree with the terms of this privacy policy:

• do not apply for a loan from us; and
• do not agree to act on behalf of a borrower, or make payments on their behalf.

Security of your data

Norwich Trust Limited is committed to ensuring that your personal information is held securely.
We have put in place various controls and procedures to protect and keep secure the information we collect online or hold separately.
If you contact Norwich Trust Limited,  you will be asked a number of security questions before we will discuss your personal details or loan account with us.

Telephone calls

Norwich Trust Limited records telephone calls for monitoring, staff training and compliance purposes.

Cookies

Please refer to our cookies page.

Data protection law

The data protection legislation:

• says that a controller can only process personal data if it has a lawful reason for doing so;
• sets out six lawful grounds for processing;
• says that a controller must tell data subjects how it, and any processors acting on its behalf, will process their personal data; and
• gives rights to data subjects in respect of their personal data.

Lawful grounds for processing

These are six lawful bases for processing of personal data.  At least one of these must apply whenever we process your personal data.

We explain throughout this privacy policy the lawful basis on which we undertake the processing that we carry out on your personal data.

Although not all are relevant to us, the six bases are:

Consent

For this to apply, the data subject needs to have given clear consent for us to process their personal data for a specific purpose.

Contract

For this, the processing must be necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract with us.

Legal obligation

For this, the processing must be necessary to comply with the law (but not including contractual obligations).

Vital interests

For this, the processing must be necessary to protect someone’s life.  We would only envisage this applying if were requested to provide information to a 999 service provider or government department.

Public task

For this, the processing must be necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.  We do not foresee this being relevant to us in respect of your personal information.

Legitimate interests

This can apply where the processing is necessary for our legitimate interests or the legitimate interests of someone else, unless there is a good reason to protect your personal data that overrides those legitimate interests.

How does Norwich Trust use your information?

Processing an application for a loan

What information do we collect from you/about you?

If you apply for a loan with us and a loan is not granted

• Your name and date of birth
• Your residential address and address history (including postcodes)
• Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
• Your residency status (whether or not you own your own home)
• Identification documents (where we are unable to electronically verify your identity)
• Details of your income (including details of benefits/secondary income)
• Evidence of your income eg: payslips, accounts, pension/benefits statements
• Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank accounts(s)
• Information about you held by credit reference agencies and fraud prevention agencies
• Contact information including telephone number(s) and email addresses
• Nationality / right to reside
• Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address (device location, device type etc)
• Visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, and any other written correspondence

We do not request ‘sensitive’ information (i.e. sexual orientation, religion, race, political views) during the application process.
If sensitive information is provided to us, we will ask for your explicit consent prior to recording it.

Please see the Special Category Data section of this policy for more information.

If you apply for a loan with us and a loan is granted.

• Your name and date of birth
• Your residential address and address history (including postcodes)
• Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
• Your residency status (whether or not you own your own home)
• Identification documents (where we are unable to electronically verify your identity)
• Details of your income (including details of benefits/secondary income)
• Evidence of your income eg: payslips, accounts, pension/benefits statements
• Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank statement(s)
• Contact information including telephone number(s) and email addresses
• Nationality / right to reside
• Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address (device location, device type etc)
• Visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data
• Information from credit reference agencies and fraud prevention agencies
• Loan documents including the credit agreement
• Details of the loan including the amount, term, contractual monthly payment and interest rate
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, statutory notices and any other written correspondence

We do not request ‘sensitive’ information (i.e. sexual orientation, religion, race, political views) during the application process.
If sensitive information is provided to us, we will ask for your explicit consent prior to recording it.

Please see the Special Category Data section of this policy for more information.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• Someone acting on your behalf (such as a broker)
• A third party acting on your behalf (such as a support worker)
• Your employer/accountant/pension provider (if you have one)
• Your bank
• Credit reference agencies
• Fraud prevention agencies

How we will use the information we collect about you?

The information gathered is used for the following reasons:

• To process your application
• To carry out credit searches and checks with fraud prevention agencies
• To carry out searches of other public registers such as the electoral register, the land registry and insolvency registers
• To assess your credit profile
• To keep your broker (if any) informed about the progress of your loan application
• To electronically verify your identity, income & bank account
• Anti-fraud measures
• To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
• To record and respond to complaints
• To improve our products and services
• To conduct statistical analysis, research and behavioural analysis
• To improve this website
• To manage what information, if any, is sent to you about our products and services

Legal basis for processing personal data

When we process your personal data, including conducting credit searches, we do so on the following legal bases:

• Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators.
• Legitimate interest - because we must do so to progress the loan enquiry, with a view to entering into the loan contract.

If you are uncomfortable with us processing your data, please do not proceed.

Who will we share your information with?

During the application process we may pass some of your information to the following third parties:

• Our SMS and e-mail providers – to keep you updated about the progress of the application
• Your broker (if any) - to keep them updated about the progress of the application
• Credit reference agencies (CRAs) – we will submit your information to CRAs in order to obtain credit searches to assist with our lending decision

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy

• Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – we will request details of any information held about you by fraud prevention agencies in order to assist with our lending decision. If we suspect that false information has been provided, or if fraud, money laundering or any other criminal offence is suspected we may provide information to fraud prevention agencies or other relevant authorities.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

If the application does not proceed and we have not completed any credit searches

We will keep your information for a maximum of 6 months from the date of the application, unless we have an overriding obligation to retain your details for longer.

If the application does not proceed and we have completed credit searches

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer.

If the application proceeds and we pay out a loan

Proof of identification and proof of address

We will keep this information for 5 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All other information referred to under the heading “Information collected/held” above

We will keep this information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Contacting you about your loan

What information do we collect from you/about you?

• Your name and date of birth
• Your residential address and address history (including postcodes)
• Contact information including telephone number(s) and email addresses
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, statutory notices and any other written correspondence

We may, during the course of our dealings with you, discuss sensitive information relating to your personal circumstances. If sensitive information is provided to us, we will ask for your explicit consent prior to recording it.

Please see the Special Category Data section of this policy for more information.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• Someone acting on your behalf (such as a broker)
• A third party acting on your behalf (such as a support worker)
• Tracing agents

How we will use the information we collect about you?

The information gathered is used for the following reasons:

• To update you about any changes or important information relating to the loan account
• To remind you that a payment is due or to let you know about missed payments
• To administer and manage the loan account
• Anti-fraud measures
• To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
• To record and respond to complaints
• To conduct statistical analysis, research and behavioural analysis

Legal basis for processing personal data

When we process your personal data, we do so on the following legal bases:

• Legitimate interest - because we must do so to administer the loan contract.
• Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators.

Who will we share your information with?

When we need to contact you, sometimes we use external processors to send communications to you.

To do this, we will share the following information about you with our communications providers:

• Your name
• Your address
• Your mobile phone number
• Your e-mail address
• Information about the status of the loan such as the balance, payment due dates, payment amounts, the date and amount of any late payment(s) and the amount of arrears

The third parties we may pass your information to for this purpose are:

• Commify UK Limited (trading as TextAnywhere) – if we send you text messages
• Spotler Limited (trading as MailPlus) – if we send you automated e-mails
• Precision Marketing Group Limited – if we send you automated letters

Norwich Trust Limited may also share your information with the following third parties:

• Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Credit searches

In order to process any application for a loan, Norwich Trust Limited will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you.

When we conduct a credit search against you, you may be treated as financially linked and your application will be assessed with reference to any “associated” credit records (joint accounts/loans/credit).

From time to time Norwich Trust Limited may also perform credit searches after the loan has paid out in order to enable the ongoing administration and management of the loan.

What information do we collect from you/about you?

In order to conduct credit searches, we will obtain the following information from you:

• Your name and date of birth
• Your residential address and address history (including postcodes)

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• Someone acting on your behalf (such as a broker)
• A third party acting on your behalf (such as a support worker)
• Tracing agents

What information will we obtain about you from the Credit reference Agencies?

• Information about your financial situation and financial history, including details of your current outstanding debts and repayment profiles
• Information to confirm your identity (by way of electronic identity verification)
• Public information (including the Electoral Register)
• Shared credit, financial situation and financial history information
• Fraud prevention information.

How we will use the information we collect about you?

We will use this information to:

• Assess your creditworthiness
• Assess whether you can afford the loan repayments
• Verify the accuracy of the data you have provided to us
• Prevent criminal activity, fraud and money laundering
• Manage the loan account
• Trace and recover debts
• Ensure any offers provided to you are appropriate to your circumstances.

Legal basis for processing personal data

When we process your personal data to conduct credit searches, we do so on the following legal bases:

• Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators
• Legitimate interest – because we must do so to progress the loan enquiry, with a view to entering into the loan contract and to enable the administration and management of the loan once paid out.

Who will we share your information with?

• Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

• Credit Reference Agencies (CRAs)

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs by clicking any of the links below.

• TransUnion
• Equifax
• Experian

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy

How long will we keep your information?

If the loan application does not proceed

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer.

If the application proceeds and we pay out a loan

Proof of identification and proof of address

We will keep this information for 5 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All other information referred to under the heading “Information collected/held” above

We will keep this information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Reporting to Credit Reference Agencies (CRAs)

During the life of the loan, Norwich Trust Limited will submit details of your account to the CRAs.

What information do we collect about you/your loan?

Throughout the life of the loan, Norwich Trust Limited will hold details of your loan account including:

• Your name
• Your current residential address
• Your date of birth
• The amount you borrowed
• The date the loan was arranged
• The term of the loan
• The contractual monthly repayment
• The balance
• The conduct of your account i.e. whether repayments are made
• Any arrangements which have been recorded on your account
• Any defaults which have been recorded on your account
• Whether your loan has been included as part of any Debt Management Plan
• The date your loan was settled

Where do we get your information from?

• Our own databases
• Third party debt advisors/Debt Management Companies

How we will use the information we collect about you?

Norwich Trust Limited will provide the information listed in the section “what information do we collect about you/your loan” to the CRAs on a monthly basis until your loan is settled.

This information helps create your credit report and may be viewed by other organisations or supplied to other organisations by the CRAs if you apply for credit in the future or where a credit search is carried out for another reason, for example by an employer.

Lenders and other organisations may base lending and other decisions on information held about you by the CRAs.

Legal basis for processing personal data

When we process your personal data to report to the CRAs, we do so on the following legal basis:

• Legitimate interest – because, as a responsible lender, we consider we have a duty to report information about the conduct of your loan so that other lenders and service providers can make informed decisions about whether to lend to you or provide services to you in the future, to prevent over-commitment, bad debt, fraud and money laundering and to support debt recovery and debtor tracing, and to aid responsible lending.

Who will we share your information with?

• Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

• Credit Reference Agencies (CRAs)

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs by clicking any of the links below.

• TransUnion
• Equifax
• Experian

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

How long will we keep your information?

We will keep this information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

The information recorded by the CRAs will typically remain on your credit file for a period of six years.

Processing payments

When you make payments to a loan with Norwich Trust Limited,  we will need to process certain items of your personal data in order to process those payments.

What information do we collect from you/about you?

The information we will collect from you in order to process payments to Norwich Trust Limited are:

• Your name
• Your current residential address
• The contractual monthly repayment
• The amount that you owe and any arrears balance
• Your bank details
• Your payment card details

Where do we get your information from?

• You
• Any third party acting on your behalf
• Our own databases

How we will use the information we collect about you?

We will use this information to:

• Process any payments made to Norwich Trust Limited in respect of a loan

Legal basis for processing personal data

When we process your information for the purposes of collecting/taking payments, we do so on the following legal basis:

• Legitimate interest – because we must do so in order to administer the loan contract.

Who will we share your information with?

We use third party companies to host some of our systems in respect of the administration of loan accounts and to facilitate payments.

These companies do not act as data processors but we do use the systems and platforms they provide to host information to enable us to administer loan accounts and to process payments. Although these companies have access to the information held on those systems due to their role as system hosts, they are not permitted to use the information for their own purposes.

The third party companies whose systems we use are:

• Anchor computer systems Limited (trading as Aryza)– the system we use to manage and administer loan accounts
• National Westminster Bank Plc (Natwest Bankline) - the system we use to administer payments that we make and that people make to us
• National Westminster Bank Plc (Natwest Autopay) – the system we use to administer direct debit payments
• National Westminster Bank Plc (Natwest Payment Services) – the system we use to administer bounced direct debit payments
• Elavon Financial Services DAC (Trading as Opayo) – the system we use to enable payments via our customer portal
• Lloyds Bank Plc (Trading as Lloyds Cardnet) – a the system we use to process card payments
• Acquired Limited – a system we use to process card payments

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

We will never keep your full payment card details.

Tracing and enforcement action

If we are unable to contact you for an extended period of time, or we have reason to believe that the contact information we hold for you may be inaccurate, we may take steps to trace up to date contact information for you. If we are considering an attachment of earnings order, we may also take steps to trace your employment information.

If the loan falls into arrears and we have been unsuccessful in our attempts to contact you, or are not able to negotiate a payment arrangement with you, it may be necessary for us to commence legal proceedings against you to recover any sums owed. We refer to this as enforcement action.

This may include issuing legal proceedings and obtaining a County Court Judgment (CCJ), making an application for an attachment of earnings or making an application for a charging order.

What information do we collect from you/about you?

Throughout the life of the loan, Norwich Trust Limited will hold details of your loan account including:

• Your name
• Your current/last known address and any previous residential addresses
• Your date of birth
• Your telephone number(s)
• Your e-mail address
• Your last known employment
• The amount you borrowed
• The date the loan was arranged
• The term of the loan
• The contractual monthly repayment
• The amount that you owe
• The conduct of your account i.e. whether repayments are made
• Copies of your signed credit agreement
• Correspondence between you and Norwich Trust including letters, e-mails, text messages and telephone calls
• Details of any property which you own

Where do we get your information from?

• You
• Any third party acting on your behalf
• Our own databases
• The land registry

How we will use the information we collect about you?

We will use this information to:

• Trace and recover debts

Legal basis for processing personal data

When we process your personal date to trace your information and take enforcement action, we do so on the following legal basis:

Legitimate interest – Because we must do so in order to enforce the terms of your agreement with Norwich Trust Limited.

Who will we share your information with?

If we take steps to trace your contact or employment information, or take enforcement action in relation to the loan, we will share your information with:

• Tracing Agents – if we need to trace your contact or employment information

The tracing agents Norwich Trust Limited may share your details with are:

Hunter Tracing Services (UK) Limited

• The Courts – if we take enforcement action against you

The courts we may share your information with are:

The County Court Money Claim Centre

The County Courts in England and Wales

The Sheriff Courts in Scotland

• Solicitors – if we take enforcement action against you

The solicitors we may share your information with are:

HCR Legal LLP (if you live in England or Wales)

Yuill & Kyle Limited (if you live in Scotland)

The courts may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with them or our solicitors in connection with any legal proceedings.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Complaint handling

From time to time you may have cause for complaint about an aspect of the service you have received from Norwich Trust Limited,  and ask us to investigate your concerns.

What information do we collect from you/about you?

Throughout the life of the loan, Norwich Trust Limited will hold details of your loan account including:

• Your name
• Your current/last known address and any previous residential addresses
• Your date of birth
• Your telephone number(s)
• Your e-mail address
• Your last known employment
• The amount you borrowed
• The date the loan was arranged
• The term of the loan
• The contractual monthly repayment
• The amount that you owe
• The conduct of your account i.e. whether repayments are made
• Details of your credit history
• Copies of your signed credit agreement
• Correspondence between you and Norwich Trust including letters, e-mails, text messages and telephone calls
• Details of any property which you own
• Details of any complaints you have made or are making

Where do we get your information from?

• You
• Any third party acting on your behalf
• Our own databases
• Tracing agents
• Credit Reference Agencies (CRAs)
• The land registry

How we will use the information we collect about you?

We will use this information to:

• Investigate your concerns and provide a response setting out our findings
• Calculate any sum of redress which may be due to you
• Deal with the escalation of any complaint which cannot be resolved directly between you and Norwich Trust Limited

Legal basis for processing personal data

When we process your information for the purposes of complaint handling, we do so on the following legal basis:

• Legal obligation – in order to comply with our legal obligations under the Financial Conduct Authority’s dispute resolution regulations (DISP).

Who will we share your information with?

As part of our complaint handling process we many share the information above with:

• A third party nominated to act on your behalf – for example a Claims Management Company or Solicitor who you have instructed to pursue a complaint on your behalf
• The Financial Ombudsman Service (FOS) – if you are unhappy with the outcome of a complaint and have escalated the matter to FOS to review

For more information on our complaints process and the role of the Financial Ombudsman Service, please refer to the Complaints section of this policy.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Auditing

From time to time, our funders will ask an independent external company to review some of our loan accounts.

We are also obliged to provide information to external companies to audit our finance/accounts processes which may involve the disclosure of personal information.

What information do we collect from you/about you?

• Your name, address and date of birth
• Your contact information (telephone numbers and e-mail address)
• Any information provided to us by you or by third parties during the loan application
• Any information provided to us by you or by third parties after the loan was paid out
• Any correspondence between you and Norwich Trust Limited during your relationship with us, including letters, e-mails, text messages and telephone call recordings
• Loan performance information including current balance, payment history and current status/arrears balance
• Bank details

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• Someone acting on your behalf (such as a broker)
• Any third party acting on your behalf
• Our own databases

How we will use the information we collect about you?

The information we collect about you will be used to ensure we are complying with all relevant rules, regulations and policies, and to ensure we are lending responsibly.

The information will also be used to ensure our finance/accounts processes are accurate, adequate and comply with relevant regulation and legislation.

Legal basis for processing personal data

When we process your personal data for the purposes of auditing, we do so on the following legal basis:

• Legal obligation - to comply with rules imposed on us by our regulators
• Legitimate interest – to enable us to provide funding for our loans

Who will we share your information with?

The third party auditors we may pass your information to for these purposes are:

Lovewell Blake Accountancy Services Limited– for audits of our finance and accounting processes

1. Mistry & Associates Limited (TMA) – for audits of our account management systems, responsible lending, treating customers fairly, compliance with our internal policies and procedures, and regulatory compliance

These companies do not act as data processors.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Quality Assurance

We use an external company to carry out some of our quality assurance checks. To do this, we provide them with recordings of telephone calls between you, or any third party acting on your behalf, and Norwich Trust Limited.

What information do we provide about you?

• Any information provided to us by you, or by third parties on your behalf, during telephone call recordings between you (or any third party) and Norwich Trust Limited, during the loan application and, if the loan was paid out, during your relationship with us.

This information may include:

• Your name and date of birth
• Your residential address and address history (including postcodes)
• Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
• Your residency status (whether or not you own your own home)
• Details of your income (including details of benefits/secondary income)
• Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank accounts(s)
• Information about you held by credit reference agencies and fraud prevention agencies
• Contact information including telephone number(s) and email addresses
• Nationality / right to reside
• Sensitive personal data

Legal basis for processing personal data

When we process your personal data for the purposes of quality assurance, we do so on the following legal basis:

• Legal obligation - to comply with rules imposed on us by our regulators
• Legitimate interest – to enable us to maintain and improve our customer service

Who will we share your information with?

The third party service provider we use to provide quality assurance software is:

Deepsight BV (trading as Voyc)

How will Voyc use your information?

Voyc processes personal data, including sensitive personal data, using artificial intelligence for the following purposes:

• transcription of phone calls;
• quality assurance of customer interactions; and
• internal use and improvement of Voyc’s services.

The information will be used to:

• Ensure we are complying with relevant rules, regulatory requirements and our own internal policies and procedures
• Identify complaints
• Identify customers with characteristics of vulnerability
• Identify training and development needs
• Improve customer service and outcomes
• Ensure the accuracy of information provided
• Detection and prevent fraud

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Special Category Data

The UK GDPR singles out some types of personal data as likely to be more sensitive, and gives them extra protection:

• personal data revealing racial or ethnic origin;
• personal data revealing political opinions;

• personal data revealing religious or philosophical beliefs;

• personal data revealing trade union membership;
• genetic data;
• biometric data (where used for identification purposes);
• data concerning health;
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation

What information do we collect from you/about you?

We do not request ‘sensitive’ information during the application process, however during the course of your relationship with Norwich Trust Limited there may be situations in which you provide us with information, or we ask you for information, concerning your health if, for example, it has given rise to a change in your circumstances and is affecting your ability to manage your loan repayments.

This information is classed as Special Category Data and as such we will only record and use this information with your explicit consent.

Norwich Trust Limited will never ask you for any other form of Special Category Data.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• A medical professional or other third party who you have authorised to provide us with information on your behalf

How we will use the information we collect about you?

The information gathered is used for the following reasons:

• To administer the loan and manage the account including offering appropriate forbearance options

Legal basis for processing personal data

When we process your personal data, we do so on the following legal basis:

• Consent – In order to comply with our obligations under the UK GDPR, we will ask you for your explicit consent to record and process any information which could be considered Special Category Data

Who will we share your information with?

We will never pass any Special Category Data to any third party without your explicit consent unless we are compelled to do so by law.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Third parties

If you are a person acting on behalf of a borrower, or making payments to a loan on behalf of a borrower we will process certain information about you.

What information do we collect/hold about you?

• Your name and date of birth
• Your residential address (including postcode)
• Your relationship to the person on behalf of whom you are acting
• Your status as a third party i.e. whether:
  • you have the borrower’s authority to discuss their details, including details of the application or the loan account; and/or
  • you have the borrower’s authority to act on their behalf in managing the application or the loan account; or
  • you are not authorised by the borrower to do either of the above things, but can make payments on their behalf
• Evidence of any formal authority to act on behalf of the borrower eg: power of attorney, grant of probate or similar
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, and any written correspondence

Where do we get your information from?

We may obtain your information from one or more of the following sources:

• You
• The borrower

How we will use the information we collect about you?

The information gathered is used for the following reasons:

• To administer the loan and manage the account
• Anti-fraud measures
• To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
• To record and respond to complaints

Legal basis for processing personal data

When we process your personal data, we do so on the following legal bases:

• Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators
• Legitimate interest – because we must do so to enable the administration and management of both the loan account and our ongoing relationship with the borrower.

If you are uncomfortable with us processing your data, you should not agree to act in any third party capacity, including making payments, for the borrower.

Who will we share your information with?

We may pass some of your information to the following third parties:

• The borrower – if you act on behalf of a borrower, we will share information with them regarding any dealings you have with us in respect of the loan.
• Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Who will Norwich Trust share your data with?

Norwich Trust Limited use third party data processers who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisations apart from us. They will hold it securely and retain it for the period we instruct.

In some circumstances we are legally obliged to share information, for example under a court order. We might also share information with regulatory bodies. In any scenario, we will satisfy ourselves we have a lawful basis on which to share the information.

Below we set out details of any third parties we may share your information with, what information we will share with them and the reasons why we may do so.

Information sharing with fraud prevention agencies

To help prevent fraud, Norwich Trust Limited will share personal information about you with fraud prevention agencies. This is used to prevent money laundering and fraud, and to verify your identity. If fraudulent activity is detected, Norwich Trust Limited will submit details to Fraud Prevention Agencies and you could be refused certain services, finance or employment.

We may also share information with other appropriate organisations or third parties if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is identified.

The information we share may vary, depending on individual circumstances, and may include any information about you which has been provided to us by you, or that we have received from third parties.

The organisations we may share information with are:

• Cifas
• Iovation Limited
• Action Fraud Limited
• HMRC
• The Police
• The National Crime Agency
• The Department for Work and Pensions

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Information sharing with credit reference agencies

If a loan is granted Norwich Trust Limited will share information about the account with the CRAs.

We share information with CRAs in accordance with the principles of reciprocity. The purpose of sharing this information is to prevent over-commitment, bad debt, fraud and money laundering and to support debt recovery and debtor tracing, and to aid responsible lending.

From time to time, Norwich Trust Limited might also share loan performance data (whether you have paid) with the credit reference agencies, for the purposes of data analysis / development of new products / scorecards.

We will share the following information with the CRAs:

• Loan start date
• Loan amount
• Loan term
• Monthly payment
• Current balance
• Current status (whether payments are up to date/level of arrears and any arrangement or default which has been recorded)
• Payment history (whether previous payments have been made on time/whether any arrears have occurred)
• The date a default was registered (if applicable)
• The balance of the account at the point a default was registered (if applicable)
• The date the account was settled (if applicable)

The CRAs which Norwich Trust Limited will share account information with are:

Equifax Limited

Experian Limited

TransUnion International UK Limited

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

Information sharing with your intermediary / broker (if applicable)

If you have been introduced to us via a third party, for example a credit broker or price comparison website, we may disclose information concerning the progress of your application to them. We will confirm whether you have been successful in obtaining a loan and the size of the loan taken out.

The broker will not be informed about the performance of the loan but we will tell them if the loan is repaid within any cooling off period.

The brokers Norwich Trust Limited works with can be found in the list below. We will only share details with the broker/intermediary who introduced you to us.

• Accepty Technology Limited
• Access Money (Group) Limited
• Aro Finance Limited
• Aspire Money Limited
• Badger Loans Limited
• Believe Money Group Limited
• Bright Star Financial Limited
• Car Loan Warehouse Limited (trading as Pegasus Finance)
• Central Loans Limited (trading as The Loans Engine)
• Central Trust Limited
• Choose Wisely Limited
• Citymoor Financial Limited
• Cobain Digital Limited
• Connect IFA Limited
• Creative Funding Solutions Limited
• Diligent Mortgage Services Limited
• Dragon Mortgages Limited
• Easi Route Limited
• Exclusive Connections Limited (trading as Brilliant Solutions)
• Experian Limited
• Finance Advice Group Limited
• Finspace Group Limited
• Fluent Money Limited
• F&I Online Limited (trading as Carplus)
• Genuine Finance Limited
• Joel Malach (trading as 1^st Loan)
• Key Loans & Mortgages Limited
• Leadtree Global Limited
• Legalwebb UK Limited (trading as B2Bfinance.com)
• Lending Expert Limited
• Loan Machine Limited (Trading as Lead Affinity)
• Loan.co.uk Limited
• Media Blanket Limited
• Monarch Financial Services Limited
• Monevo Limited
• My Secured Loan Limited (trading as Loanable)
• Norton Finance & Mortgages Limited
• Optimise Finance Limited
• Ramsay Lomax Limited
• Reynolds & Stein Company Limited
• Simple Financial Planning Limited (trading as Beagle Finance)
• Simply Lending Solutions Limited (trading as Simply Adverse)
• Springhill Finance Limited
• Stop Go Networks Limited
• The Loan Partnership Limited
• The Mortgage People (Cardiff) Limited
• Tiger Lion Financial Limited (trading as Loantube)
• Twibli Limited (trading as Multa)
• UK Credit Limited
• Wembley Mortgage Centre
• Willows Finance Limited

Information sharing with tracing agents

If we have been unsuccessfully able to contact you where the account is in arrears, or we have received returned mail and have been unable to contact you, we may share your details with tracing agents in order to verify your address.

We may also share your details with tracing agents where the account is in arrears and an attachment of earning orders is being considered due to non-payment, to verify your employment details.

We will share the following information about you with our tracing agents:

• Your name
• Your last known address and any known previous addresses
• Your date of birth
• Your telephone number(s)
• Your last known employment

The tracing agents Norwich Trust Limited may share your details with are:

Hunter Tracing Services.

Information sharing with the courts

If the loan falls into arrears and we have been unsuccessful in our attempts to contact you, or are not able to negotiate a payment arrangement with you, it may be necessary for us to commence legal proceedings against you to recover any sums owed.

This may include issuing legal proceedings and obtaining a County Court Judgment (CCJ), making an application for an attachment of earnings or making an application for a charging order.

To do this, we will share the following information about you with the courts:

• Your name
• Your address
• The amount you owe
• Details of the loan at the time it was arranged
• Copies of your signed credit agreement/any guarantee and indemnity
• Copies of letters sent you about arrears eg: default notice and termination notice
• Details of the status of your account and payment history including a statement of account
• Details of your employer
• Details of any property which you own including land registry documents

The court may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them in connection with any legal proceedings.

The courts we may share your information with are:

The County Court Money Claim Centre

The County Courts in England and Wales

The Sheriff Courts in Scotland

Information sharing with solicitors

Where it has been necessary to commence legal action against you to recover the sums owed, we may, in some circumstances, need to instruct solicitors to act on our behalf, where Norwich Trust Limited is not able to conduct the legal action directly, or in the case of a defended claim, or claims of a complex nature.

To do this, we will share the following information about you with our solicitors:

• Your name
• Your address
• The amount you owe
• Details of the loan at the time it was arranged
• Copies of your signed credit agreements/any guarantee and indemnity
• Copies of letters sent you about arrears eg: default notice and termination notice
• Details of the status of your account and payment history including statements of account
• Copies of any correspondence between you and Norwich Trust Limited which is relevant to the legal action in question. This may include letters, e-mails, text messages and recordings of telephone calls
• Details of your employer
• Details of any property which you own including land registry documents

The court may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with our solicitors in connection with any legal proceedings.

The solicitors we may share your information with are:

HCR Legal LLP (if you live in England or Wales)

Yuill & Kyle Limited (if you live in Scotland)

Information sharing with the Financial Ombudsman Service (FOS)

If you make a complaint about Norwich Trust Limited and are not satisfied with our response, you are usually entitled to refer your complaint to the FOS.

In order to investigate your complaint, the FOS will ask us to provide them with some of the information we hold about you. The information will vary depending on your complaint, but could include any of the personal information we hold about you.

As long as you have provided your consent to the FOS to investigate your complaint, we will provide them with the information that they ask for, unless we believe there is an overriding reason not to.

Information sharing with SMS providers, e-mail providers and mailing houses

From time to time we may need to contact you, for example to update you on the progress of a loan application, to remind you that a payment is due or to let you know about missed payments. Sometimes we use external processors to send these communications.

To do this, we will share the following information about you with our communications providers:

• Your name
• Your address
• Your mobile phone number
• Your e-mail address
• Information about the status of an application
• Information about the status of the loan such as the balance, payment due dates, payment amounts, the date and amount of any late payment(s) and the amount of arrears

The third parties we may pass your information to for this purpose are:

Commify UK Limited (trading as TextAnywhere) – if we send you text messages

Spotler Limited (trading as MailPlus) – if we send you automated e-mails

Precision Marketing Group Limited – if we send you automated letters

Information sharing with auditors

We are obliged to provide information to external companies to audit our finance/accounts processes which may involve the disclosure of personal information.

Our funders may also periodically ask an independent external company to review some of our loan accounts, which may involve the disclosure of personal information.

These companies do not act as data processors.

We may share the following information about you with our auditors:

• Your name, address and date of birth
• Your contact information (telephone numbers and e-mail address)
• Any information provided to us by you or by third parties during the loan application
• Any information provided to us by you or by third parties after the loan was paid out
• Any correspondence between you and Norwich Trust Limited during your relationship with us, including letters, e-mails, text messages and telephone call recordings
• Loan performance information including current balance, payment history and current status/arrears balance
• Bank details

The third party auditors we may pass your information to for these purposes are:

Lovewell Blake Accountancy Services Limited – for audits of our finance and accounting processes

1. Mistry & Associates Limited (TMA)– for audits of our account management systems, responsible lending, treating customers fairly, compliance with our internal policies and procedures, and regulatory compliance

Third party service providers

We use a third party service provider to conduct some of our quality assurance measures.

The third party company whose service we use is:

Deepsight BV (trading as Voyc)

Norwich Trust Limited grants Voyc a royalty-free, non-exclusive, non-transferable, and non-sub licensable right to use data (including metadata) from the transcriptions and analyses solely for internal use and improvement of Voyc’s services. Voyc is obligated to handle this data in accordance with applicable data protection laws and the terms agreed upon with Norwich Trust Limited.

Norwich Trust Limited ensures that Voyc implements appropriate technical and organisational measures to protect personal data, particularly sensitive personal data, from unauthorised access, disclosure, alteration, or destruction.

Data subjects have the following rights concerning their personal data processed by Voyc:

• right to be informed about the processing activities
• right to access their personal data;
• right to rectification of inaccurate personal data;
• right to erasure of personal data;
• right to restrict processing;
• right to data portability; and
• right to object to processing.

To exercise these rights or for any queries regarding the processing of personal data by Voyc, please contact us.

Third party systems providers

We use third party companies to host some of our systems in respect of the administration of loan accounts and to facilitate payments.

These companies do not act as data processors but we do use the systems and platforms they provide to host information to enable us to administer loan accounts and to process payments. Although these companies have access to the information held on those systems due to their role as system hosts, they are not permitted to use the information for their own purposes.

The third party companies whose systems we use are:

Anchor Computer Systems Limited (trading as Aryza) – the system we use to manage and administer loan accounts

National Westminster Bank Plc (Natwest Bankline) - the system we use to administer payments that we make and that people make to us

National Westminster Bank Plc (Natwest Autopay) – the system we use to administer direct debit payments

National Westminster Bank Plc (Natwest Payment Services) – the system we use to administer bounced direct debit payments

Elavon Financial Services DAC (trading as Opayo) – the system we use to enable payments via our customer portal

Lloyds Bank Plc (trading as Lloyds Cardnet)  – a the system we use to process card payments

Acquired Limited – a system we use to process card payments

Third party electronic communications providers

We use third party companies to host some of our electronic communication channels.

These companies do not act as data processors but we do use the platforms they provide to enable us to provide and maintain some of our communications.

The third party companies whose systems we use are:

Mimecast Services Limited– the system we use to protect e-mail traffic and to monitor any e-mails sent to us, including file attachments, for viruses or malicious software

Sharing your data outside of the European Economic Area (EEA)

Your data may be transferred to a destination outside the European Economic Area (EEA). It may also be processed by companies operating outside the EEA who work for us or introduce business to us. If your personal information is transferred outside the European Economic Area (EEA) for processing or storage purposes we will ensure that safeguards are in place to protect it to at least the standard applied within the EEA.

Credit searches and Credit Reporting

In order to process any application for a loan, Norwich Trust Limited will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information about your financial situation and financial history including details of your current outstanding debts and repayment profiles. CRAs will also supply us with information to confirm your identity (by way of electronic identity verification) and both public information (including the Electoral Register) and shared credit, financial situation and financial history information, and fraud prevention information.
When we conduct a credit search against you, you may be treated as financially linked and your application will be assessed with reference to any “associated” credit records (joint accounts/loans/credit).

We will use this information to:

• Assess your creditworthiness
• Verify the accuracy of the data you have provided to us
• Prevent criminal activity, fraud and money laundering
• Manage the loan account
• Trace and recover debts
• Ensure any offers provided to you are appropriate to your circumstances.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs by clicking any of the links below.

• TransUnion
• Equifax
• Experian

Credit searches and credit reporting

When you first apply

When you enquire, our initial credit search, which is used to generate your loan quote, is a ‘soft’ search (often referred to as an enquiry search) and does not leave a footprint on your credit file. The CRAs will record details of the search whether or not the application proceeds, however the search should not impact upon your credit rating and cannot be seen by other people making searches in the future.

When the loan is granted

If you decide to proceed with the loan and funds are released, a ‘hard search’ (often referred to as an application search) will be carried out against you. This hard search will be recorded by the CRAs and may be seen by other people searching in the future. This is a requirement of the CRAs and common practice across the finance industry.

After the loan is granted

During the life of the loan, Norwich Trust Limited will submit details of your account status including the balance and whether repayments are made as well as any arrangements or defaults which have been recorded on your account to the CRAs. We will also inform the CRAs about your settled accounts. This information may be supplied to other organisations by CRAs.

The information recorded by the CRAs will typically remain on your credit file for a period of six years.

If you obtain a loan with us we may, during the life of the loan, make periodic searches at Credit Reference Agencies and Fraud Prevention Agencies so that we can manage your account with us. These additional searches are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

After the loan is settled

After the loan is settled we will not usually conduct any further credit searches unless it is necessary for us to do so, for example in order for us to investigate a complaint you have raised. Any additional searches it is necessary for us to carry out are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

Anti-fraud measures

General

Before we grant a loan, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.
The personal data you have provided, we have collected from you, or we have received from third parties will be will be used to prevent fraud and money laundering, and to verify your identity.
The personal information which will be processed to perform these checks is:

• Your name
• Your address
• Your date of birth
• Your contact details (telephone numbers and e-mail address)
• Financial information
• Employment details
• Device identifiers including IP address

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Automated decisions

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if:

• our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers; or is inconsistent with your previous submissions; or
• you appear to have deliberately hidden your true identity.

You have rights in relation to automated decision making. For more information, please refer to the Your data protection rights section of this policy
We use services provided by a third-party organisation, iovation Inc, for the purposes of fraud prevention and account authentication purposes. iovation are based in the US. Their third-party services help us decide whether to accept transactions from electronic devices by analysing device attributes and checking whether they have been associated with fraudulent or abusive transactions in the past. The service also helps verify your identity by registering and remembering devices associated with your account. We also report to iovation if we conclude that a device has been used in connection with a fraudulent or abusive transaction with us. iovation may track your activity over a network of different sites that subscribe to their services. Please see www.iovation.com and their privacy policy for more information about this service.

Consequences of processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services, goods or financing you have requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us.

Data transfers

Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

Your data protection rights

Under data protection law, you have certain rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

We may process and store information about you electronically and/or in manual records. You have the right to ask us for copies of your personal information, often referred to as a Data Subject Access Request (DSAR). This right always applies.

If you would like to make a Data Subject Access Request, please contact us.

There is no charge for submitting a DSAR, however in order to ensure the security of your personal information, we will ask you to provide certain personal details to verify you are who you say you are, before we action your request and release your personal information.
Upon receipt of a DSAR, Norwich Trust Limited has a maximum of 1 month to respond.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Norwich Trust Limited will correct any information we hold about you if you are able to evidence that the information we hold is inaccurate or incomplete.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Norwich Trust Limited will delete your personal information, at your request, unless we have a legal obligation or legitimate interest to hold or process your data. For instance; the ongoing administration/management of a live loan, reporting to credit reference agencies the conduct of the loan account, recording and retaining information relating to complaints, retaining information for the purposes of Anti Money Laundering, retaining information for the purposes of responding to law enforcement agencies / government agencies.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

You can ask us to temporarily limit the use of your data when you have made a challenge to the accuracy of your data, or an objection to the use of your data.

You can also ask us to limit the use of your data rather than delete it if you believe your data has been processed unlawfully but you do not want it deleted, or we no longer need your data but you want us to keep it in order to create, exercise or defend legal claims.

Your right to object to processing

You have the right to object to Norwich Trust Limited processing your information based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling). You also have the right to object to direct marketing (including profiling) and processing for purposes of scientific/historical research and statistics.

Norwich Trust Limited may not agree to stop processing your information where we can evidence that we have legitimate reasons to continue using your information.

Your rights in relation to automated decision making including profiling

Norwich Trust Limited does not operate a fully automated decision making process in respect to the granting of a loan, however it does reject applications based upon an automated basic eligibility checks.

If an application has been declined based on our automated eligibility checks, you can ask us to manually review the decision.

If you would like to exercise any of your data protection rights, please contact us.

You can find more information about your individual rights on the Information Commissioner’s Office website.

If you are unhappy about how your personal data has been used, please refer to our complaints policy.
You also have a right to complain to the Information Commissioner’s Office which regulates the processing of personal data: https://ico.org.uk/concerns/

How long will Norwich Trust keep your personal data?

If you make an application for a loan but the application does not proceed

Where we have not completed credit searches

We will keep your information for a maximum of 6 months from the date of the application, unless we have an overriding obligation to retain your details for longer.

Where we have completed credit searches

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer

If you make an application for a loan and a loan is granted

Proof of identification and proof of address

We will keep this information for 5 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All other personal information

We will keep this information for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Complaints data

We will keep information relating to any complaint(s) you have made for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All telephone call recordings

We will keep call recordings for a maximum period of fifteen years from the date of the call.

Emails

We will keep e-mails for a maximum period of ten years from the date of the email.

About the end of retention periods

It may not be practical for us to destroy personal data immediately following the end of a stated retention period.  Where this is not practical we will destroy the relevant personal data within 1 month of the stated end of the retention period.

About destruction of personal data

Technical issues may make it impossible to destroy personal data completely, especially personal data that is held electronically.

We regard personal data as having been destroyed if:

• it has been deleted; or
• it has been “anonymised” (that is, the data subject is not identifiable); or
• if not deleted or anonymised, it has been “put beyond use”.

We regard personal data as having been “put beyond use” if:

• we are not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
• we will not give any other organisation access to the personal data;
• we will surround the personal data with appropriate technical and organisational security; and
• we are committed to permanent deletion of the information if, or when, this becomes possible

About personal data held for more than one purpose

Although one section of this privacy policy may say that we will destroy personal data held for a particular purpose, we may continue to process that item of personal data if it is also held for some other purpose and the date for destruction of personal data held for that other purpose has not yet been reached.

Contact us

For general enquiries
Post: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.
Telephone: 01603 801911
Email: Welcome@norwichtrust.co.uk

Data Protection
Post: Data Protection Officer, Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.
Telephone: 01603 801911
Email: dataprotectionofficer@norwichtrust.co.uk

Complaints

You should find your dealings with us to be professional, efficient but also friendly. We recognise however that from time to time you may have cause for complaint.
If you have a complaint about any aspect of the service you have received, our staff will be happy to investigate.
Please bring your concerns to our attention as soon as possible – the sooner we know the sooner we can respond.
We have a formal complaints procedure to ensure your complaint is handled quickly, fairly and efficiently.
You can lodge your complaint by calling 01603 801911 or emailing complaints@norwichtrust.co.uk.
If you prefer to write to us, you can send your letter to: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich, Norfolk, NR1 3PA

If we can, we will resolve your concerns over the telephone. If we can resolve your complaint within three working days of receipt, we will consider the complaint closed. You will be sent written confirmation of this.

If we are unable to resolve your complaint within three working days, perhaps due to the complexity of the issues you have raised, we will follow the process as detailed below:

• We will send you a written acknowledgement of your complaint outlining the matter(s) you have raised promptly, usually within five working days.
• We will carry out a full investigation into the matter(s) you have raised.
• Once the investigation is concluded, a full written response will be provided to you within eight weeks of receiving your complaint. It will detail our investigation into the matter(s) you have raised and the outcome of our findings. We will ensure the correspondence is in plain English.
• If we fail to provide a final response within eight weeks of receiving your complaint, we will write to you again, detailing when we anticipate we will respond. At this point, you may be entitled to refer your complaint directly to the Financial Ombudsman Service.
• If you are not fully satisfied with our final response, you are usually entitled to refer your complaint to the Financial Ombudsman.
• We will provide you with details of the Financial Ombudsman Service and answer any questions you might have about referring your complaint to them, when we write to you. Some useful information is also provided below.
• If you wish to refer your complaint to the Financial Ombudsman Service, you will need to do so within six months of the date of our final response.

The Financial Ombudsman Service may be contacted directly:
The Financial Ombudsman Service, Exchange Tower, London, E14 9SR
Tel: 0800 0234567

Website: www.financial-ombudsman.org.uk

Links to other websites

Where we provide links to websites of other organisations, this privacy policy does not cover how that organisation processes personal information. We encourage you to read the privacy policy on