This Privacy Notice explains who we are and how we use your personal data. Personal data is any information that can be used to identify who you are as a unique individual.

Ecology Building Society is a controller of your personal data, this means that we make decisions on how we use personal data in the context of our business relationship with you. How we use this data is explained in this Privacy Notice.

Before we provide services to you, we undertake checks for the purposes of preventing fraud and money laundering and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you or we have received from third parties, will be used to prevent fraud and money laundering and to verify your identity.

Further details on how your information will be used by us and these fraud prevention agencies and your data protection rights can be found at www.cifas.org.uk/fpn.

When we use terms such as we, us and our in this notice, we mean Ecology Building Society.

We are registered with the UK’s Information Commissioner’s Office (ICO) under registration number Z5798250.

Our Data Protection Officer can be contacted if you have queries about this privacy notice or wish to exercise any of the rights mentioned in it.

Ecology Building Society
7 Belton Road
Silsden
Keighley
West Yorkshire
BD20 0EE

Tel: 01535 650770
Email: [email protected]

We collect personal data when you:

• Apply for our products or services online, on the phone, or through the post
• Update your information online, on the phone, or through the post (for example, when you change your address)
• Speak to us on the phone
• Visit our website, or any digital service we offer now or in the future
• Send us letters, emails or other documents

The types of personal information we collect from you are:

• Identifying details such as your full name, previous names and addresses, title, date of birth, age, signature, unique personal identifier and account number
• Contact details such as your home address, email address and phone number
• Financial data such as your bank account number, payment details, payee details, earnings, income, expenditure, spending habits, transaction history, tax residency, tax reference number, source of funds, and purpose of withdrawal
• Personal information about your family such as your marital status, next of kin, dependents and emergency contact details
• Profile data such as your sex, occupation, employment status, citizenship status, residential status, status as a Politically Exposed Person, details of directorship or trustee roles, property details, occupancy status and insurance information
• Identification data which includes your driving licence, passport, National Insurance number and other national identifiers
• How you interact with us which includes the products and services you hold with us, transaction, call recordings, photographs, video recordings or any other form of communication
• Technical data such as internet protocol (IP) address, location data, operating system, time zone etc

Special Category and Criminal data

We also collect:

• Health data such as physical or mental health disabilities or any medical
  condition
• Biometric data for the purpose of accessing your account or identifying fraud
• Criminal data such as details of any unspent criminal convictions, pending
  convictions, bankruptcy/receivership, county court judgements, court
  records and pending orders. This will also include any sanctions or
  suspensions from any financial services regulator.

We work with carefully selected third parties, and may receive information from:

• Brokers and intermediaries
• Business partners
• Sub-contractors
• Credit reference agencies
• Fraud prevention agencies
• Government bodies
• Your employer
• Your landlord
• Someone authorised to act on your behalf
• Public sources (such as the Electoral Role or Companies House)

When necessary, we share your personal information with:

• Service providers
• Tax, government, and regulatory authorities
• Fraud prevention and/or law enforcement agencies
• Courts and other third parties connected with legal proceedings
• Third parties where you have asked us to share your details
• Third parties where it is required by law
• Joint account holders
• Receivers of payment transactions
• Credit reference agencies

We are committed to protecting your data when it is shared with other companies and conduct assessment of their security measures. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR and ensure that appropriate safeguards are in place. Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country that the UK Government has deemed to offer data protection standards equivalent to those in the UK, but if the transfer is to a country without such designation, the fraud prevention agencies will ensure your data continues to be protected by implementing suitable safeguards.

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

Your right of access – you have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about this right here.

Your right to rectification – you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about this right here.

Your right to erasure – you have the right to ask us to delete your personal information. Read more about this right here.

Your right to restriction of processing – you have the right to ask us to limit how we can use your personal information. Read more about this right here.

Your right to object to processing – you have the right to object to the processing of your personal data. Read more about this right here.

Your right to data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about this right here.

Your right to withdraw consent – when we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

If you choose not to provide the personal data we request:

• we may be unable to enter into a contract with you
• we may be unable to fulfil orders, supply goods, or provide services
• we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
• as a result, our services may be delayed, restricted, or declined.

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (CRAs). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• assess your creditworthiness and whether you can afford to take the product
• verify the accuracy of the data you have provided to us
• prevent criminal activity, fraud and money laundering
• manage your account(s)
• trace and recover debts
• ensure any offers provided to you are appropriate to your circumstances

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files with the CRAs for a disassociation to break that link.

Further information about the processing that CRAs perform can be found in their Credit Reference Agency Information Notice (CRAIN)

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority.

FCA Firm Reference Number: 742313

• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority.

FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notic:
  www.creditsafe.com/gb/en/legal/transparency-notice-customer-supplier

• TransUnion Bureau Privacy Notice:
  www.transunion.co.uk/legal/privacy-centre/pc-bureau

We need to keep your personal data up to date. You should tell us without delay if your details change (for example, if you move address) so that we can update our records.

While we hold your data we will take reasonable steps to keep it safe and secure, and we will regularly review the rules around how long we keep it for.

A copy of our retention schedule can be found here.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

We may use your home or correspondence address, phone numbers and email address to contact you about new products and services.

We may also use other platforms (e.g. Facebook and Google) to contact you according to your online preferences such as your cookie settings.

You can request we stop our direct marketing at any time by emailing [email protected] or by writing to Ecology Building Society, Ellis House, 7 Belton Road, Silsden, Keighley, West Yorkshire BD20 0EE or by following the instructions on how to unsubscribe within each marketing email.

There may be some circumstances where we use your personal information for profiling, this where we look at your personal data to evaluate certain things about you.

For example, to help us provide a consistent service and give people the best products and advice at the right times.

We’ll always make sure the way we process your information is safe and not unfair to you.

Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports, so you won’t be identified from the data.

You have the right to object to us using your personal information for profiling activities. Please refer to the “Lawful basis and data protection rights” section for more information.

We may use automated decision making using your personal information. We use automated decision making to check that we can enter into an agreement with you, and also carry out our legal and regulatory obligations (e.g. when complying with UK money laundering regulations). This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions or you appear to have deliberately hidden your true identity. You have certain rights over your personal information when using automated decision making. If you would like more information on this, please see the “Lawful basis and data protection rights section above

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.

This Privacy Notice may be updated from time to time. This means we may send you an updated copy (depending on whether we are required to do that or not) or notify you of the changes.

If you are unhappy with how we have collected, processed or managed your personal information, you have the right to make a complaint. You can contact us on [email protected] or by calling us on 01535 650 770 or by writing to Ecology Building Society, Ellis House, 7 Belton Road, Silsden, Keighley, West Yorkshire BD20 0EE. We take all complaints seriously and are committed to promptly and fairly investigating and resolving your concerns.

If you are not satisfied with the way Ecology Building Society had handled your complaint, you can raise a complaint directly with the Information Commissioner’s Office (ICO) see www.ico.org.uk for details