Azure Money is a trading name of T.M. Sutton Limited. We are registered in England and Wales under company number 283556 and we have our registered office at 6 Bevis Marks, London, EC3A 7BA. Data Protection registration number Z2335650. We are responsible under data protection laws for our processing of your personal information which we also refer to as personal data in this Policy. Your personal information means any data which, either by itself or with other data held by us or available to us, can be used to identify you. Further details of the personal information we process about you is set out below in this Policy.
We understand that your privacy is extremely important to you. As a result, we have put in place a number of measures to ensure that any personal data we obtain from you visiting this website is processed and maintained in accordance with accepted principles of good information handling and also in accordance with the data protection laws. This Policy provides you with details of the type of personal information we may hold about you, how we obtain and use any personal information and how we protect your privacy.
Obtaining your personal information
- You are free to browse the website https://www.azuremoney.com (the “Website”) without providing any personal information to us (although, please see section 1.4.2 where we mention an exception relating to information gathered by some cookies used on the Website which may constitute your personal information).
- We may as a result of your interaction with the Website, store and process your personal information. It is collected by us from the following sources:
(a) from you;
(b) from third parties, such as credit reference agencies (CallCredit, Experian, Equifax, who may search the Electoral Register), or fraud prevention agencies when you apply for credit or any other product or service or which you or they give to us at any other time; and
(c) from the way you use and manage your account(s), from your transactions and from the payments made to your account.
- If you e-mail a question to email@example.com or register your interest in our product(s) or services(s), then it will be necessary for us to collect and process your personal information about you in order to e-mail a reply or otherwise respond to you.
- The categories of your personal information that we may collect are as
- Directly from you via our online application form Personal information such as:
- Proof of your identity
- E-mail address
- Home address (and your address history if you have lived at your current address for less than 3 years) and residential status (i.e. whether you are a homeowner or renting)
- Telephone numbers
- Date of birth
- The name and contact details of your employer
- Income details, including your pay dates and method of payment (i.e. whether you are paid directly into a bank account or in cash), amount of pay and any other income
- Expenditure details
- Bank account details, including debit card details
- Marital status and whether you have dependents
Any other information you choose to provide to us through your use of our Website – such as when you send a message to us through the Website and choose to include personal information about yourself in that message.
We are unable to process your application or (if your application is successful) provide you with the product or service you are applying for unless we collect the personal information we have listed above, except as follows. In cases where provision of certain information is optional, we will make this clear as part of the application process, including if you are seeking your consent to process it (as relevant). For example, if we do not need home and mobile telephone numbers we will make it clear that providing both together is optional.
- From what you do on our Website
- We will provide your personal information to credit reference agencies to decide whether to provide you with credit. Please see section 4 below for a full explanation about how your personal data is used.
- Directly from you via our online application form Personal information such as:
Use of collected information and the legal basis for this
- The information we collect about you may be used in the following ways:
- To assess your credit history and verify your credit standing including by doing checks at credit reference agencies. Our legal basis for this is our legitimate interests of complying with the regulatory regime that applies to us and our legitimate interests of deciding whether to provide you credit or not.
- To enable us to consider and process your application for credit or other products or services. Our legal basis for processing your personal information for this purpose is that it is necessary for our legitimate interests of carrying out our business of providing credit and other products and services. This is also necessary in preparation for entering into an agreement with you.
- To obtain your employment status and salary details. Our legal basis for processing your personal information for this purpose is that it is necessary for our legitimate interests or assessing your suitability for provision of our services and complying with the regulatory regime that applies to us.
- To detect, prevent and investigate actual and potential fraud and related activities including by carrying out checks at fraud prevention agencies and to verify your identity. Our legal basis for this is complying with our legal obligations.
- To collect unpaid payments and other sums that may be owed by you to us. Our legal basis for processing your personal information for this purpose is that it is necessary for our legitimate interests of carrying out our business of providing credit and other products and services. This is also necessary to perform the agreement we have with you.
- To develop, manage and market products and services to meet your needs, to contact you for products and services that may be of interest, to determine your eligibility for different products and services that you may be interested in. Our legal basis for processing your personal information for this purpose is your consent.
- To help us to administer and service your agreement with us. Our legal basis for processing your personal information for this purpose is that it is necessary to perform our agreement with you and also for our legitimate interest in order to provide you with the necessary service following your entry into the agreement.
- To contact you in connection with your enquiry, such as if you have not applied yet but want more information, or if you have started to apply but do not proceed to complete an application with us. Our legal basis for processing your personal information for these purposes is that it is necessary for our legitimate interests of servicing requests for information from people who might become customers and of finding out why you decided not to proceed so that we can in the future better our product and service offerings to customers in general. In the unlikely event that we include marketing information in these calls we will only do so where we have your consent.We may also do this in cases where we need to complete further applications with you over the telephone because additional information is required. Our legal basis for processing your personal information for these purposes is that it is necessary in preparation for entering into an agreement with you.
- To extract certain information for the purpose of generating statistics for our own internal purposes (including credit and/or behaviour scoring, market and product analysis). It is important to note this processing of personal information relating to generating and making internal use of statistics is not the same thing as credit scoring pre-contract to make a decision about whether to provide credit to you (for that – see section 4.3). Where we do this statistic related processing in order to improve our own internal processes (e.g. our decision-making processes or processes relating to products and to develop future credit risk strategies), our legal basis for processing your personal information for these purposes is that it is necessary for purposes of legitimate interests pursued by us (which are development and improvement of our products and services).Please also see section 4.3 about automated processing and automated decisions, including our legal basis for doing so and your rights in relation to this.
- To notify you about changes to our service on this Website. Our legal basis for processing your personal information for this purpose is that it is necessary for our legitimate interests of updating you if we are experiencing problems with our Website and if we need to tell you that because e.g. it might mean we extend your deadline for providing some information or documentation to us through the website for use in your application, or if it might prevent you from making payments on time.
- To ensure that the content from our site is presented in the most effective manner for you and your computer. Our legal basis for processing your personal information for this purpose is that it is necessary for purposes of legitimate interests pursued by us (which are ensuring that the Website is presented as effectively as possible for you).
- To allow you to participate in interactive features of our service, when you choose to do so – for example to allow you to access your accounts via the Website so that you can check your account balance, make payments etc. Our legal basis for processing your personal information for this purpose is consent (see below for more details about how to withdraw consent).
- To comply with legal and regulatory requirements to which we are subject, to establish and defend legal rights, to prevent, detect and investigate crime and to deal with requests to exercise your rights under data protection law (as relevant). The legal basis for this is compliance with our legal obligations.
- We will process your personal information as necessary to comply with the regulatory regime which applies to us – the legal basis for this is our legitimate interests.
- When we process what are called ‘special categories of personal data’ and this includes for instance information about health we may need your explicit consent for that. This would be the legal basis for that processing.
In some circumstances, such as if you are a vulnerable customer (which means a customer who, due to their personal circumstances, is especially susceptible to detriment, which can result in unmanageable debt problems, choosing the wrong product or paying a higher price), we may not need your explicit consent if we can use this information based on it being necessary for reasons of substantial public interest on the basis of laws that are applicable to us which are proportionate to the aim pursued and which protect your rights.
- The information we collect about you may be used in the following ways:
Sharing your information with third parties
- Sometimes (and with your approval where required), we will share your information with carefully selected third parties outside our group. We may do this for the following reasons:
- To our agents, staff and approved third parties to carry out services for us (such as providers of legal and professional services (including auditors), debt collection agencies and third parties who send communications on our behalf). Our legal basis for processing your personal information for this purpose is that, in the majority of cases, it is necessary for our legitimate interests (these are described above throughout section 2.1 above) and to perform our agreement with you (or in order to take steps at your request prior to entering into an agreement with you).
- To facilitate the processing and collection of direct debits or other payments due from you under your agreement, we may also share your personal data with third party payment processing service providers. This is processing that is necessary for performance of the agreement we have with you.
- To provide you with information about special promotions and offers as referred to in the “Keeping You Informed” section below. Our legal basis for processing your personal information for this purpose is your consent.
- To protect us, our group of affiliated companies or others. We may share your information with third parties (such as law enforcement agencies) when we believe it is necessary to comply with the law. Our legal basis for processing your personal information for this purpose is that it is necessary for compliance with our legal obligations and in other cases it may be for our legitimate interests of responding to requests from law enforcement agencies.To protect our or another person’s rights, property, or safety. This includes exchanging information with third parties (such as other lenders, law enforcement agencies and regulatory authorities) to protect against fraud and reduce risks. Our legal basis for this is legitimate interests (ours and those of third parties).
- If there is (or is to be) any change in ownership of our business or assets then we may wish to share your information so that the new (prospective) owners may continue to operate our business effectively and continue to provide services to our customers. This may include new shareholders or any organisation that might take an assignment or transfer of any agreements we have entered into with our customers. Our legal basis for processing your personal information for this purpose is that it is necessary for purposes of legitimate interests pursued by us and/or new (prospective) owners (which are, for new/prospective owners, shareholders and other organisations acquiring our business, to conduct due diligence in order to make a decision around acquiring our business (or a stake in our business). The purchaser of our business assets may then rely on its own lawful reasons for processing when it has your personal information – you should refer to its privacy notice.
- We may share your personal information with other people if you give us consent for that and this would be our legal basis for that sharing.
In addition, see the information in section 4 since we may share your personal information with credit reference and fraud prevention agencies.
Credit reference and fraud protection agencies
- CREDIT REFERENCE AGENCIES
How do credit reference agencies use your personal information?
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail here. CRAIN (Credit Reference Agencies Information Notice) is also accessible from each of the three CRAs – any of these three links will also take you to the same CRAIN document: Callcredit www.callcredit.co.uk/crain; Equifax www.equifax.co.uk/crain; Experian www.experian.co.uk/crain
How and why do we share your personal information with credit reference agencies?
In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). We may also make periodic searches at CRAs to manage your account with us.To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.We will use this information to:
- Assess your creditworthiness and whether you can afford to take the product;
- Verify the accuracy of the data you have provided to us;
- Prevent criminal activity, fraud and money laundering;
- Manage your account(s);
- Trace and recover debts; and
- Ensure any offers provided to you are appropriate to your circumstances.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
For a full application, when CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders. If we search the CRAs to provide you with a quotation for credit, we will not leave a search footprint on your credit file that can be seen by other lenders. You will be able to see a record of it on your credit file.
- FRAUD PREVENTION AGENCIES
Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.The personal data you have provided, we have collected from you, or we have received from third parties may include your:
- date of birth
- residential address and address history
- contact details such as email address and telephone numbers
- financial information
- employment details
- identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address
When we and fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
We, and fraud prevention agencies, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services or financing to you. If you have any questions about this, please contact us on the details above.
Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.
Your personal data is protected by legal rights, which include your rights to:
- object to our processing of your personal data;
- request that your personal data is erased or corrected;
- request access to your personal data.
For more information or to exercise your data protection rights please, please contact us using the contact details above. If you are unhappy about how your personal data has been used please refer to our complaints policy at https://www.azuremoney.com/complaints. You also have a right to complain to the Information Commissioner’s Office , which regulates the processing of personal data https://ico.org.uk/.
Automated decision making including profiling
- We may also carry out solely automated decision making on your personal information, and this means without human intervention, to evaluate certain personal aspects about you.In particular, we may use the information you have provided in your application, information we have received from the Credit Reference Agency or other data provider, information from your previous dealings with us, and/or a credit score as part of the assessment for credit worthiness and affordability to support in us being able to make an automated decision (relating to whether to offer you credit) without the need for us to contact you, or require any further documents or information. We will do this using automated processes. Our business relies on the ability to be able to provide customers with lending decisions as promptly as possible so we utilise automated decisions to help us to keep a cost efficient and quick delivery of our services and credit to our customers. The consequences of this automated decision making might be that we decide not to lend to you and that your application is not automatically approved (in which case we may need to contact you before we make the final decision about whether or not to offer you credit). This particular type of automated decision making does usually produce legal effects concerning you or similarly significantly affect you (i.e. it usually impacts our lending decision).Our legal basis for carrying out this particular type of automated decision making is that it is necessary for us to take steps at your request prior to entering into an agreement with you – i.e. make a decision about whether to offer you credit. You have the right under data protection laws not to be subject to a decision based solely on automated processing including profiling which produces legal effects on you or similarly significantly affects you. Please see section 9.1 for more details.
- We may do some other automated decision making, including profiling, about which of our other products or services might be suitable for you and whether to communicate with you about those (subject to whether we have your consent to send you marketing communications). The consequence of this type of activity might be that we do, or do not, send certain communications to you, depending on the outcome of this automated decision making (and this ties in with our responsible lending commitments too). This type of automated decision making does not usually produce legal effects concerning you or similarly significantly affects you.
Our legal basis for carrying out this type of automated decision making is that it is necessary for our legitimate interests. We describe what our legitimate interests are in this privacy notice.
- CREDIT REFERENCE AGENCIES
Lawful processing for the fraud checks we carry out and the credit reference checks that we carry out
- When we and fraud prevention agencies process your personal information for the fraud checks described in this section and for identity checks, we do so for compliance with our legal obligations.When we carry out credit reference checks this is for our legitimate interests of complying with the regulatory regime to which we are subject.
Transferring your personal information outside the UK/EEA.
- Some companies within our group of affiliated companies, and sometimes other third parties with whom we share personal information are or may be located outside the UK and the EEA (as it is made up from time to time). In addition, some of our service providers may be located outside the UK and the EEA or use data processing locations outside the UK and the EEA.When we share your personal information with these and certain other third parties, your personal information will be transferred outside of the UK (and in some cases outside of the EEA). Where adequate protections for your personal information do not exist under applicable laws, steps will be necessary to ensure that appropriate safeguards apply to maintain the same levels of protection as are needed under UK data protection laws.Safeguards include contractual obligations imposed on the recipients of your personal data. Those obligations require the recipient to protect your personal data to the standard required under UK data protection laws. Safeguards also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information. For more information about these appropriate safeguards, and others as may be relevant from time to time, including to obtain a copy of them or to find out where they have been made available, you can contact us using the details below.
Methods of contact
Unless you have advised us to the contrary, we may contact you by telephone, SMS, post, e-mail or fax to send you information communications about your application and the product or service that you obtain from us under the contract between us if that application is successful. These are service communications not marketing. (Please see the ‘Keeping You Informed’ section below regarding how you may be contacted for direct marketing purposes).
What criteria do we use to determine how long we keep your personal information?
- How long we keep your personal information for depends on the basis on which it was provided and what we use it for, generally however:
- We will keep the information that is necessary to enable us to provide you with the service that you have requested from us for as long as it takes us to provide that service.
- If you have given us a marketing consent, then withdrawn it and in that way asked that we do not use your details for marketing purposes, we may still need to keep them in relation to that purpose to ensure our systems reflect your preferences (so that we do not contact you for marketing again).
- We will keep records of any transactions you enter into so that we can respond to any complaints or disputes that arise and deal with any claims in relation to such transactions (including protecting or enforcing our legal rights). Otherwise we will keep the information where appropriate for our legitimate business needs for as long as necessary to do so, such as for the purposes of regulatory reporting, auditing, anti-money laundering/fraud investigations and credit file reporting.
- If you apply for a product or service and are unsuccessful, we will keep your personal information for as long as we reasonably need to in case of questions or queries from you in relation to the application.
- We will keep other personal information about you if it is necessary for us to do so to comply with the law or our regulatory obligations, or where appropriate for legitimate business needs (including the purposes described at section7.1.3 above).
- How long we keep your personal information for depends on the basis on which it was provided and what we use it for, generally however:
Keeping you informed
- From time to time we would like to contact you by SMS, post, email or telephone, with offers relating to products of ours which we think you might be interested in.
- When you submit your application, you will be asked whether you want to provide your consent to receive marketing communications from us about our products and services. If you do want these then you can tick an opt-in box to provide your consent. This means that your consent will be the lawful reason for all such marketing communications.
- If you do not indicate in the way described at section 8.2 that you want to receive from marketing communications from us, please note that this will not prevent us from being able to provide you with the products or services you are applying for – this is separate to the issue of marketing communications. You will not receive any marketing from us and we will not share it with anyone else for it to send marketing to you.If you provide us with your consent, you have the right to withdraw it at any time by contacting us using the information above. We will process your request to withdraw consent for marketing communications as promptly as possible, however this may take up to 5 working days, during which time you may still receive marketing communications from us. In addition, certain rights under privacy law can be relevant where processing of your contact details is based on consent such as erasure and portability – please see below.
Your rights in relation to your personal information
The rights explained in this section apply to you in relation to the company which is data controller of your information. The data controller is the entity which determines the purposes and means of the processing of your personal information. We are a data controller of your personal information and therefore you are entitled to make requests
to us to exercise your rights in relation to your personal information controlled by us. However, we can only comply with your requests to the extent that we are a data controller of your personal information – if your request relates to any other companies (including affiliated companies within our group), you must make a separate request to them to exercise your rights.
- Access: You have the right of access to your personal information that we hold about you as a data controller (although certain exceptions may apply). In certain instances you may be required to pay a reasonable fee based on our administrative costs if requesting further copies. You will need to make a separate request and pay a separate fee for each company within our group of affiliated companies whose records you wish to access. This right will enable you to obtain confirmation that your personal data is being processed, to obtain access to it, and to obtain other supplementary information about how it is processed. In this way you can be aware of and you can verify the lawfulness of your processing of your personal data;
- Rectification: You have the right to request that we rectify any inaccurate personal information about you (we also require you to information us if your personal data is inaccurate or out of data – see section 10.1 below). This includes the right to have any incomplete personal data completed (taking into account the purposes of the processing), including by means of providing a supplementary statement;
- Erasure (‘right to be forgotten’): In certain circumstances, you have the right to request that we erase your personal data. This right is not absolute – it applies only in particular circumstances and where it does not apply any request for erasure will be rejected. Circumstances when it might apply include where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed, if the processing is based on consent which you then withdraw, when there is no overriding legitimate interest for continuing the processing, if the personal data is unlawfully processed, or if the personal data has to be erased to comply with a legal obligation. Requests for erasure will be refused where that is lawful and permitted under data protection law for instance where the personal data has to be retained to comply with legal obligations or to exercise or defend legal claims;
- Restriction: In certain circumstances you have the right to request that we restrict our processing of your personal information, for instance where you contest it as being inaccurate (until the accuracy is verified); where you consider that the processing is unlawful and where this the case; and where you request that our use of it is restricted; or where we no longer need the personal data;
- Data portability: You have the right to request that we provide you with a copy, in a machine-readable and portable format, of the personal information that you have provided to us, and to request that we transmit it directly to another data controller. This right is only relevant where we are processing personal data based on a consent or a contract and by automated means; this right is different from the right of access (see above) and the types of data you can obtain under the two separate rights may be different; you are not able to obtain through the data portability right all of the personal data that you can obtain through the right of access;
- Right to object: in certain circumstances you may have the right to object to our processing of your personal information. This right allows individuals in certain circumstances to object to processing based on legitimate interests, direct marketing (including profiling) and processing for purposes of statistics. However, in such a case we may be able to demonstrate that the processing is required on compelling legitimate grounds or for the establishment, exercise or defence of legal claims;
- Rights in relation to some automated decision making about you including profiling (as relevant) if this has a legal or other significant effects on you as an individual. This right allows individuals in certain circumstances to access certain safeguards against the risk that a potentially damaging decision is taken without human intervention.
- Please note that where we process your information for direct marketing purposes, you always have the right to object to that processing. Furthermore, where we are processing your personal information based on your consent, you have the right to withdraw your consent to the processing at any time. If you do this and if there is no alternative lawful reason which justifies our processing of your personal information for a particular purpose, this may affect what we can do for you. For instance, it may mean that we cannot take into account the data concerning your health in connection with arrears of payments or that you cannot receive any marketing from us about third party products and services and those of our group of companies (as relevant).You have the right to complain to the Information Commissioner’s Office at any time (see below for more details).
Update your details/preferences
- If any data or information we hold about you is inaccurate or out of date then please let us know and this will be corrected where appropriate. Please see section 9.1 above for more details about the right to rectification.
- To exercise your rights as described in section 9, please contact us as set out at section 17.1.
Security and confidentiality
- We take the steps required by UK data protection law to protect your personal information. However, please be aware that there are inherent security risks of providing information and dealing online over the internet and we cannot therefore guarantee the security of any data disclosed online, particularly during transmission from you to us. We ask that you do not provide us with any sensitive personal information online (please see the ‘Special Categories of Personal Information’ Section below) unless we specifically ask for this.
- To help protect your personal information, we take steps where possible to anonymise your personal information where it is not necessary for the information to be identifiable for the purposes of the processing – for example we anonymise your personal information before using it to test our IT systems.
Links to other sites
Our Website may from time to time include links to other sites. We make every effort to provide links to high quality, reputable sites but we’re not responsible for their privacy practices or, site content, or the services they offer. Please always check the privacy policies of any linked sites.
Special categories of personal information
Information about you which is considered special categories of (or ‘sensitive’) personal information under the data protection legislation, includes information about your medical or health conditions, racial or ethnic origin, genetic data, biometric data (for the purpose of uniquely identifying you), political opinions or trade union membership, religious or philosophical beliefs, sex life and sexual orientation. (In addition there is a separate category called criminal convictions and offences data which may be relevant if fraud or other crimes are suspected). (Please note that financial information is not considered by data protection legislation to constitute a special category of information). If we need to process special categories of personal information about you, you will be notified of such processing and asked to specifically give explicit consent to the use of such information as appropriate and where explicit consent is needed. Otherwise we ask that you do not provide us with such information where we do not request it, for example in emails to us, on telephone calls or in free text boxes on our Website.
If you call any of the telephone numbers quoted on our Website, in our literature or in correspondence, we may record your call. These recordings are used for training, regulatory and quality control purposes to ensure that we continuously monitor and improve our customer service standards.
If you have any complaints about our processing of your personal information, we encourage you to contact us initially so we can seek to discuss the complaint with you.
You have the right to lodge a complaint about our processing of your personal information with the Information Commissioner’s Office (https://ico.org.uk) who is the supervisory authority who regulates our processing of your personal information in compliance with data protection laws.