Privacy Policy – draft

LOANITT PRIVACY POLICY

1. Introduction and Scope

At Loanitt, we know that your privacy is important to you. This privacy notice (“Notice”) describes the types of information we collect and use, who that information relates to, how and why we use such information, who we share it with and your legal rights.

Loanitt complies with the requirements of the UK GDPR (United Kingdom General Data Protection Regulation) – all references to GDPR in this Policy are to the UK GDPR) and the UK Data Protection Act 2018.

When we talk about “information” in this Notice, we mean any information relating to you (your “personal data”).

Unless indicated otherwise, this Notice applies to all our website, domains, apps, and to arranging or offering to arrange the provision of credit from providers of credit through our online platform and the retrieval of transactional and financial information from your payment account provider (with your consent) to assist with your credit application (the “Services”).

2. Who we are

Loanitt UK Limited trading as Loanitt (“we”, “us” or “our”) is authorised by the Financial Conduct Authority to act as a credit broker. Loanitt is a company registered and incorporated in Northern Ireland under company number NI678340. Our registered address is Arthur House, 41 Arthur Street, Belfast, County Antrim, Northern Ireland, BT1 4GB.

We act as the service provider between you and the lenders with which we can place business and we provide advice, support, assistance and placement facilities in relation to credit products.

3. Who is responsible for your information?

Loanitt is responsible for collecting information about you and looking after your personal data (your “data controller”). We are aware of our responsibilities to handle your personal data with care, to keep it secure and comply with applicable privacy and data protection laws.

4. Who this Notice Applies to

We collect and process information which relates to a variety of categories of individuals. These include individuals who may not have a direct relationship with Loanitt. We have described below the main types of individuals whose information we collect, use and otherwise process:

Customers and related individuals: We collect and use information relating to our prospective, current and former customers. We also collect and use information relating to individuals connected with customers, such as their employees, partners, directors, company secretaries, shareholders or beneficial owners.
Vendors and related individuals: We collect and use information relating to our prospective, current and former vendors, such as garages, who use the Services on behalf of customers seeking car finance. We also collect and use information relating to individuals connected with vendors, such as their employees, partners, directors, company secretaries, shareholders or beneficial owners.
Business and marketing contacts: In the course of providing and marketing our Services, we also collect and use information relating to visitors to our website, domains and apps, visitors to our office, event invitees or attendees, and other business and marketing contacts.

5. Information that we collect includes:

The provision of the above pieces of information by you are necessary and proportional for us to be able to provide the requested Services to you. If the requested information is not provided, we may not be able to provide the requested Services.

Personal Details	Employment Details	Income Details	Bank Details	Other
Title and Full Name	Occupation	Monthly Net Salary	Bank Name	National Insurance number
Mobile Number	Employer Name	Other Monthly Income	Bank Address	Customer Expected credit history
Email Address	Employer Address	Mortgage Rent Payments	Time with Bank (in years)	Affordable credit repayments
Date and Country of Birth	Employer Phone Number	Other monthly Repayments	IBAN	IP address
Mothers Maiden Name	Time at current employer		Account Number
Gender			Sort Code
Marital Status			Transactional information
Number of dependants
Residential Status
Address details

Where and when we need your consent - There will be circumstances where we will only process your data if we have your consent to do so. For example, if you provide us with data that is classed as a special category of data such as health information, criminal records of convictions and offences, or allegations of criminal offences. We will only process this with your permission (unless we feel the processing is necessary to protect your vital interests or if the law allows us to do so). You have a right at any time to ask us to stop the processing of that specific data.

6. How we use your information

In the course of providing the Services, we collect or receive information in different ways and relating to various groups of individuals (described in section 4 above). We use this information for a number of purposes described further below.

Providing the Services: If you use our services or request information, we will collect your personal data for use by Loanitt UK Limited and use information relating to you to provide the Services you have requested. When required, we make your information available to third parties with whom we have a relationship i.e., lender. We will only provide those third parties with information that is necessary for them to perform the services. Lenders may perform a check on your credit history by seeking a credit report from Credit Reference Agencies. You can refer to the privacy statements on their websites for more information about their privacy practices.
We use your contact information to provide you with the products and services you have requested and to respond to complaints and enquiries. We will also use your contact information to contact you or interact with you in connection with the product you currently hold with us or service that we currently provide. If you are a vendor who uses our Services to assist customers in arranging finance, we will collect and use information relating to you and individuals connected to your company (such as your employees, partners, directors, company secretaries, shareholders or beneficial owners) to enable you to use the Services. While much of this information will relate specifically to the provision of our Services, we will also use information as part of our administrative, financial and operational processes. We will occasionally use your personal details and financial information (but not your bank account details) as listed in the above table to match products to your demographic which provide us with insights as to future financial services you or others may require. Financial details, financial circumstances, employment and income details, expenditure, family details and composition, credit history details, account numbers, banking details are collected to determine the most suitable credit product for you. In carrying out this processing we rely on the following legal bases: contractual necessity, compliance with our legal obligations and legitimate interests (described below).
Improving the Services together with third parties: We will analyse your data together with lenders for purpose of improving the efficiency of the Services such as by developing customer pre-screening. Specifically, we will analyse the following; occupation, monthly net salary, other monthly income, customer expected credit history, mortgage/rent payments, time with bank (in years), affordable credit repayments, date and country of birth, employer phone number, other monthly repayments, time at current employer, marital status, transactional information, number of dependants, residential status. In carrying out this processing we rely on the following legal basis: legitimate interests.
AML compliance: We may collect and use your personal details, photo ID, national insurance number or IBAN (for identification purposes) and proof-of-address information in the context of compliance with anti-money laundering (“AML”) laws and our other regulatory obligations. Shareholders of vendors with more than 25% interest in a company and individual applicants may be required to provide information to determine if they are a Politically Exposed Persons (“PEP”). AML information may be sent to credit providers and to the Credit Reference Agencies. In carrying out this processing we rely on the legal basis of compliance with our legal obligations.
Websites and apps: If you visit our website or use our app, we will collect certain information relating to you. Generally, unless you submit information to us, such as via an online application form, we only collect technical and device-related information from your use of our website and app. We do so to secure our website and app, understand how you use them, and analyse how we can improve them. See the Cookie Policy on our website for more details. In carrying out this processing we rely on the following legal basis: legitimate interests. Also, with your consent, we may send you updates, invites and marketing materials. We may also do this if you are a customer or a former customer and have provided your consent. You will always have the right to unsubscribe from such communications. If we do so, we will also collect information on your interaction with such communications. In carrying out this processing we rely on the following legal basis: legitimate interests.
Events: Where you register for or attend an event organised by or in conjunction with Loanitt, we will collect your contact details and the details of the event you attended. If you “opt in” to receiving marketing communications from us, we may send you emails and communications about the event and other events and information we think you might be interested in. If you attend an event, we might capture your image in photographs and videos. It will be made clear at an event if photography or video recording is taking place If you object to this, please inform one of our staff at the event (for instance, you can tell the photographer at the time they are taking the photo). In general, we use your information in the context of the event, and for future marketing and events, unless you have objected to such use. In carrying out this processing we rely on the following legal basis: legitimate interests.
CRM and business contacts: If you are a current or former customer or have agreed that we may stay in touch with you in relation to updates and events, we will include your personal details listed in the table above in our CRM database. We do so to keep in touch with you such as to send you communications, surveys and marketing about our events and Services; to identify what other events or Services we think you might be interested in; and understand how you use our Services. In carrying out this processing we rely on the following legal basis: legitimate interests.
Call recordings: Calls to and from Loanitt may be recorded for training, security and compliance purposes. In carrying out this processing we rely on the following legal basis: legitimate interests (quality and verification purposes).

7. Information you give us about other people

If you provide information to us about any person other than yourself, you should ensure that you have a legal basis for doing so and that you have complied with your transparency obligations under data protection law.

We will only request information we require to provide the Service.

8. Our legal basis

In order to collect, use, share, and otherwise process your information for the purposes described in this Notice, we rely on a number of legal bases, some of which are mentioned above, including where:

necessary to perform a contract we have with you (i.e. the Services and our Terms & Conditions) (“contractual necessity”);
necessary for us to comply with a legal obligation;
necessary for the purposes of Loanitt’s or a third party’s legitimate interests, such as those of customers and others. This is provided that those interests are not overridden by your interests or fundamental rights and freedoms; and
you have consented to the processing (in which case you may revoke your consent at any time).

9. Legitimate Interests

Where we collect, use, disclose and otherwise process your information based on legitimate interests, we may rely on the following interests:

Provision of Credit Broker services: We use your information to pursue our customers and other impacted individuals’ legitimate interests in arranging or offering to arrange the provision of credit from providers of credit through our online platform.
Keeping our Services Safe and Secure: We use your information in certain instances as necessary to pursue our and your legitimate interests of keeping some of our Services, such as our domains, websites, apps, offices and events, safe and secure. For example, we collect IP addresses and process log files to ensure our website and apps are not subject to fraudulent access.
Marketing our Services: We use your information as necessary to pursue our legitimate interests in marketing our Services. For example, where permitted by digital marketing law we may contact you by email to let you know of future events you might be interested in.
Providing, improving and developing the Services: We use your information as necessary to pursue our legitimate interests in tailoring and improving our Services. For example, if you are a customer, we may send you a survey or questionnaire to understand your experience in obtaining services from Loanitt. It is also in our legitimate interests to use your information to help provide us with insights as to future financial services you or others may require.

10. Sharing Your Information

In the course of providing the Services, we share information with various third parties, including financial institutions, data storage providers and service providers such as Microsoft.

We do this based upon the legal bases and exceptions mentioned in section 8 of this Notice.

Keeping our Services Safe and Secure: We use your information in certain instances as necessary to pursue our and your legitimate interests of keeping some of our Services, such as our domains, websites, apps, offices and events, safe and secure. For example, we collect IP addresses and process log files to ensure our website and apps are not subject to fraudulent access.
Legal and safety reasons: We may retain, preserve, or share your information if we have a good-faith belief that it is reasonably necessary to (a) respond, based on applicable law, to a legal request (e.g., a subpoena, search warrant, court order, or other request from government or law enforcement such as the Information Commissioner’s Office, the HMRC, the FCA and the Financial Ombudsman Service, Law Enforcement Agencies such as the Police Services & The National Crime Agency); (b) detect, investigate, prevent, and address fraud and other illegal activity, security, or technical issues; (c) protect our rights, property, or safety; (d) enforce our Terms and Conditions or any other contracts we have with you; (e) prevent physical injury or other harm to any person or entity, including you and members of the public.
Service providers: We may share your personal information to help us provide our services and communicate with you. Categories of service providers include IT software and hosting providers and records-storage companies. Where such third parties are processors, these third parties are contractually required to use it only to provide their service to us and are contractually barred from using it for their own purposes.
Marketing third party services: Your personal data may be passed to a third party for consideration for alternative financial products. You can control whether this happens by opting into this as part of the marketing preference options detailed on your application form provided to you at registration. These third parties may carry out additional credit reference searches against you. Where you have given us permission (which you can withdraw at any time) to process your information, we may share your data with third parties who may contact you in relation to a product you have requested finance on i.e., a dealership. We will only provide those third parties with information that is necessary for them to perform their services.
Trusted Partners: We may work with third parties who have access to, or who can provide, certain products and services that we cannot, or do not, provide directly to you. Before we provide any information to these trusted partners, we will inform you that your information will be provided to them. These trusted partners will then contact you directly in relation to the products and services that they can provide to you and how they will use your personal information.
Business re-organisation: In instances where our business is subject to a re-organisation, such as a merger or acquisition of some or all of its assets, we may, in accordance with our legitimate interests, need to share information in the course of the transaction. In such circumstances, your information may be disclosed, where permitted by applicable law, in connection with a corporate restructuring, sale, or assignment of assets, merger, or other changes of control or financial status of Loanitt.

11. Data Transfers

In certain cases, we may need to transfer your information to recipients located outside the UK, such as where it is necessary to provide our Services. We may also share your personal data with our trusted service providers and partners, some of which may be located outside the UK.

Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections as EEA data protection laws, including the UK. The UK Government has approved the same countries as providing essentially equivalent protections as UK data protection laws. Both the UK and EU data protection laws allow Loanitt to freely transfer Personal Data to such countries.

In accordance with applicable data protection law, we ensure that whenever we transfer your personal data outside of the UK it is protected. This is achieved by ensuring that either:

the country outside of the UK to which your personal data is transferred has been deemed to provide an adequate level of protection for personal data by the Secretary of State; or
the recipients of your personal data in the relevant country outside of the UK enter into standard contractual clauses which have been approved by the Secretary of State or offer other appropriate safeguards.

For further information, please contact us on dataprotection@loanitt.co.uk.

12. Automated Decision Making and Profiling

Automated Decision Making refers to a decision which is taken solely on the basis of automated processing of your personal data. This means processing using, for example, software code or an algorithm, which does not require human intervention.

Profiling means using automated processes without human intervention (such as computer programmes) to analyse your personal data in order to evaluate your behaviour or to predict things about you which are relevant in a financial services context, such as your likely credit risk profile. As Profiling uses automated processing, it is sometimes connected with automated decision making. Not all profiling results in automated decision making, but it can do.

We may analyse your information using automated decision making to help us to offer you products and service information we believe may be of interest to you and to make assessments where you apply for a financial product (e.g., finance) including affordability and creditworthiness.

In an underwriting context, profiling is routinely carried out on your information provided in your credit application to assess your individual risk to make a prediction about the likelihood of success in obtaining credit and to determine which financial institutions are most suitable to send your application to. We may make decisions in relation to your application for credit based solely on an automated analysis of your information. The types of information we process by automated means about you are listed above in section 5. We may also use automated processing to assist in compliance with our legal obligations in connection with the prevention of money laundering and terrorist financing along with the prevention of fraud. Where we make solely automated decisions that affect you in a legal or a significant way, you have the right to provide your viewpoint and have such decisions reviewed by a member of our team. See Section 14 for more information about your rights.

13. Retention

We will maintain appropriate technical and organisation measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your information. We will provide a level of security that is proportionate to the risks that are presented by the processing activity, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

We will retain your personal data for as long as is necessary for the purposes set out in this Policy for as long as your account is active or as needed to provide you services or to perform our contract with you. We will retain and use your personal data to the extent necessary to comply with our legal obligations, to resolve disputes and to enforce our agreements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

14. Your Rights

You have a number of rights in relation to your information that we process. To exercise these rights, please contact us at dataprotection@Loanitt.co.uk.

While some of these rights apply generally, certain rights apply only in specific circumstances. We describe these rights below.

Access: You have the right to request access to your information that we control.You can ask us to:
- confirm whether we are processing your personal data;
- give you a copy of that data;
- provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out any Automated Decision Making or Profiling, to the extent that information has not already been provided to you in this Policy.
- In certain circumstances you have the right not to be subject to solely automated decisions and where we make such automated decisions, a right to have a person review the decision.

Data Portability: You have the right to request that some of your personal information that you initially provided to us is returned to you or another controller in a commonly used machine readable format.
Rectify, Restrict and Delete: You have the right to ask us to restrict the processing of your information or to rectify or delete your information. Please note that despite a deletion request, we may continue to process your information if we have a legal basis to do so.
Object: If we process your information based on our legitimate interests explained above, or in the public interest, you can object in certain circumstances. In such cases, where legally required to do so, will cease processing your information unless we have compelling legitimate grounds to continue processing or where it is needed for legal reasons. Where we use your data for direct marketing, you can always object using the unsubscribe link in such communications or by contacting us at dataprotection@Loanitt.co.uk.
Revoke Consent: Where you have previously provided your consent, you have the right to withdraw your consent to our processing of your information at any time. For example, you can withdraw your consent to email marketing by using the unsubscribe link in such communications or contacting us at dataprotection@Loanitt.co.uk. In certain cases, we may continue to process your information after you have withdrawn consent if we have a legal basis to do so or if your withdrawal of consent was limited to certain processing activities.
Complain: If you are not satisfied with how we store your data or we fail to satisfy a Data request, you have the right to submit a complaint to the Information Commissioner’s Office (ICO). See contact details below as follows: The ICO can be contacted by telephone at 0303 123 1113 or by email at casework@ico.org.uk

15. Third party services

Our websites, domains and apps may contain links to other websites and services, which are managed and controlled by third parties. Please note that this Notice does not apply in those cases, and we are not responsible for the privacy practices of such third parties.

16. Amending the Notice

From time to time, we may amend this Notice/Privacy Policy from time to time. This might happen, for example, where we make changes to the Services. When such a change is made, we will post a revised version online. The Notice was last updated at the date indicated further below. Changes will be effective from the point at which they are posted. You have a responsibility to review this privacy policy periodically, so you are aware of any changes. By using our services, you agree to this privacy policy.

17. Contact us

If you want to exercise your rights (described above), or if you have any questions about this Notice, please contact us as follows:

Loanitt UK Limited
Arthur House, 41 Arthur Street, Belfast, County Antrim, Northern Ireland, BT1 4GB
Email: dataprotection@Loanitt.co.uk

Last updated: August 2024