Membership Terms and Conditions

Data Protection Policy

​

1. Introduction

2. Definitions

3. GDPR Principles

4. Lawful Bases for Processing

5. Accountability and Governance

6. Individual Rights

7. Data Security

8. Personal Data Breaches

9. Data Retention

10. Data Accuracy and Limitation

11. Data Disclosures

12. Complaints

 

 

1. Introduction

 

CLEVR Money collects, holds and processes personal data about customers, employees and other key stakeholders. It therefore has a number of legal obligations under the General Data Protection Regulation (GDPR) and the provisions of the Data Protection Act 2018 (DPA 2018).

 

Within this policy we will set out how CLEVR Money will comply with data protection law, protect personal data and process data in a transparent manner. The policy ensures that employees, board members, suppliers and all third parties working on behalf of CLEVR Money, understand their responsibilities. The policy applies to all personal data, regardless of whether it is held in a paper or electronic format.

 

2. Definitions

​

CLEVR Money is defined as a data controller as it ‘determines the purpose and means of processing of personal data’ and as such it pays an annual fee to the Information Commissioner’s Office as required by the Data Protection (Charges and Information) Regulations 2018.

The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified. This definition provides for a wide range of personal identifiers to constitute personal data, including name, DOB, postal address, email address, images, bank details or online identifiers.

The GDPR refers to sensitive personal data as ‘special categories of personal data’ and the GDPR says it is more sensitive, and so needs more protection. For example, information about an individual’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics, health, sex life or sexual orientation, are all ‘special categories of personal data’.

 

3. GDPR Principles

​

Article 5(1) of the GDPR contains principles relating to the processing of personal data and CLEVR Money is committed to complying in full with these principles. Article 5(1) states personal data shall be:

1. a) processed lawfully, fairly and in a transparent manner

2. b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes

3. c) adequate, relevant and limited to what is necessary

4. d) accurate and, where necessary, kept up to date

5. e) kept in a form which permits identification of data subjects for no longer than is necessary

6. f) processed in a manner that ensures appropriate security of the personal data

 

Article 5(2) also requires that:

“the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”

​

4. Lawful Bases for Processing

​

CLEVR Money will only process personal data if one of the following Article (6)(1)  lawful bases apply:

​

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party

​

CLEVR Money will only collect and process ‘special categories of personal data’ if one of the additional conditions set out in Article 9(2) has been satisfied.

 

5. Accountability and Governance

 

Data Protection Lead

​

CLEVR Money Data Protection Lead is the first point of contact for any data protection queries and their contact details are as follows:

Data Protection Lead (Chief Operating Officer)

CLEVR Money, 13 Birley Street, Blackpool, FY1 1EG

or email governance@clevr.money

 

Data Protection Officer (DPO)

​

Under the GDPR it is mandatory for companies who carry out certain types of processing activities to designate a DPO. The DPO’s minimum tasks are defined in Article 39:

​

• inform and advise the organisation and its employees about their obligations to comply with the GDPR and other data protection laws

• monitor compliance with the GDPR and other data protection laws, including managing internal data protection activities, advise on data protection impact assessments, train staff and conduct internal audits

• first point of contact for the Information Commissioners Office

 

The contact details for CLEVR Money designated DPO are as follows:

​

Data Protection Officer

Blackpool Council, PO Box 4, Blackpool, FY1 1NA

or email dataprotectionofficer@blackpool.gov.uk

 

Register of Processing Activities (RoPA)

​

CLEVR Money is required to maintain records of activities related to higher risk processing of personal data and CLEVR Money therefore commits to maintaining an up to date RoPA. All employees are required to notify the Data Protection Lead of any new processing activities or changes to existing processing activities to assist with the maintenance of this register. The RoPA will be made available to the supervisory authority on request.

 

Workforce Training

​

CLEVR Money is committed to providing appropriate data protection training to its workforce as part of their induction process and will issue regular refresh training throughout the course of their employment or in the event of any changes in data protection law. CLEVR Money will retain a record of this training programme and this will be made available to the supervisory authority on request.

 

Data Protection Impact Assessments (DPIA’s)

​

Data Protection Impact Assessments (DPIAs) are a tool which enable organisations to identify the most effective way to comply with their data protection obligations and meet individuals’ expectations of privacy. CLEVR Money commits to completing DPIA’s for certain listed types of processing, or any other processing that is likely to result in a high risk to individuals’ interests. Employees must consult the Data Protection Lead to see if they need to complete a DPIA before they embark on any new processing activities or make changes to existing processing activities. For further information employees should consult CLEVR Money’s ‘Data Protection Impact Assessment (DPIA) Procedure’.

 

6. Individual Rights

 

Right to be informed

​

Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR. We call this ‘privacy information’ and CLEVR Money publishes its customer privacy notice at Privacy Notice.

 

Right of Access

​

Individuals have the right to access their personal data (commonly known as ‘subject access’) and supplementary information about the processing of their data. The right of access allows individuals to be aware of and verify the lawfulness of the processing of their personal data. The information that can be requested includes:

 

• confirmation that their personal data is being processed

• access to a copy of the data

• the purposes of the data processing

• the categories of personal data concerned

• who the data has been, or will be, shared with

• how long the data will be stored for

• the source of the data, if not the individual

• whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual

 

‘Subject access’ requests should be directed to the Data Protection Lead. A response will be issued without delay and at the latest within one month of receipt of the request. Please note CLEVR Money will take reasonable steps to verify the identification of the applicant. For further information employees should consult CLEVR Money’s ‘Subject Access Procedure’.

 

Individual Rights

​

GDPR also empowers individuals with the right to rectification, erasure, right to restrict processing, data portability, right to object and rights in relation to automated decision making or profiling. CLEVR Money will carefully consider any requests under these rights and requests can be submitted to the Data Protection Lead who will consult with the DPO.

 

7. Data Security

​

Principle f) states data should be processed in a manner that ensures appropriate security of personal data. This means CLEVR Money must have appropriate security to prevent the personal data it holds being accidentally or deliberately compromised. Particular attention will be paid to the need for the security of any ‘special categories of data’.

 

All employees who process electronic data will comply with CLEVR Money’s ‘Information and ICT Security Acceptable Use Policy’.

​

 When holding or processing electronic data employees must ensure:

​

• passwords meet appropriate security standards, be changed at regular intervals and must not be divulged to any other persons

• ensure corporate portable devices, such as laptops, USB’S and hard drives that contain personal data are stored in a locked cupboard or draw when not in use

• where personal data is shared with a third party, employees should carry out due diligence and ensure the data is sent in a secure manner or appropriate measures are taken to mitigate the risk of individuals being identified

• when sending personal data to a third party, staff must carefully check the recipient and their contact details

• where personal devices are used to access corporate email accounts, staff should ensure appropriate passwords are applied to the device

• employees should not open links when emails are received from unknown recipients or the emails appear suspicious

• personal data must be stored in a secure and safe manner, with careful consideration made to who can access the data

• when working with personal data, employees should ensure the screens of their computers are always locked when left unattended

• employees should not save copies of personal data to their own devices, they should always access and update the central copy of any data

• employees must adopt a clear desk culture

 

Manual data will be stored where it is not accessible to anyone who does not have a legitimate reason to view or process that data. Employees should carefully consider whether they need to take any manual data offsite before doing so and record instances where any ‘special categories of data’ is taken offsite.

​

8. Personal Data Breaches

​

A personal data breach is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service”.

 

A personal data breach most commonly means that someone other than the data controller gets unauthorised access to personal data, but it can also include where personal data is accidentally altered or deleted. Common examples of data breaches include the loss or theft of equipment, the loss of hard copies of personal data and data being sent to the wrong recipient by either post or email.

 

The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority, where feasible, CLEVR Money must do this within 72 hours of becoming aware of the breach. It is therefore essential that all employees follow the CLEVR Money’s ‘Personal Data Breach Procedure’ and make the Data Protection Lead aware of any incidents without undue delay. If the Data Protection Lead is unavailable it should be brought to the attention of the relevant manager.

 

The Data Protection Lead and DPO will to investigate all incidents to establish whether or not a personal data breach has occurred. If a personal data breach is confirmed, the DPO will carefully consider whether it is required to notify the Information Commissioner and the data subjects affected.

 

9. Data Retention

​

Principle e) states data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Data will only be retained for the specified period outlined in the records management schedule that CLEVR Money has adopted and will be destroyed in a secure manner thereafter. A copy of the records management schedule is available in CLEVR Money’s ‘Records Management Policy’.

​

10. Data Accuracy and Limitation

​

CLEVR Money is required to take reasonable steps to ensure data is kept accurate and up to date. It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible. Employees must ensure:

 

• data will be held in as few places as necessary and employees should avoid creating any unnecessary additional data sets

• employees should take every opportunity to ensure data is updated

• CLEVR Money will make it easy for data subjects to update the information it holds about them

• data should be updated as soon as any inaccuracies are discovered

 

CLEVR Money will only collect personal data for specified, explicit and legitimate reasons which are outlined in the privacy notice. If we wish to use personal data for reasons other than those given when we obtained it, we will inform the individuals concerned before we do so, and seek consent where necessary (unless an exemption applies).

​

11. Data Disclosures

​

In certain circumstances, the GDPR and Data Protection Act 2018 set out exemptions from some of the rights and obligations e.g. crime & taxation. Any requests for personal data under the exemptions must be made to the Data Protection Lead and will be carefully considered on a case by case basis by the DPO. Please note CLEVR Money will take reasonable steps to verify the identification of the applicant and will ensure an appropriate audit trail of the disclosure.

 

12. Complaints

​

If an individual is unhappy with the way in which CLEVR Money is handling their personal data or information, or is unhappy with the company’s response to a ‘Subject Access Request’, they can submit a complaint to the DPO. The DPO will carefully consider each complaint on a case by case basis and submit a response without undue delay.

 

If the complainant is not content with the outcome of their complaint, they may apply directly to the Information Commissioner’s Office. However, the ICO encourage you where possible to exhausts the organisation’s complaints procedure. Details on how to submit a complaint to the ICO are available at https://ico.org.uk/make-a-complaint/.

​

Open Banking

​

This section of our Privacy Policy relates to Open Banking and should be read in conjunction with the other clauses in our Privacy Policy.  In the event of conflict with any other clauses, this clause shall prevail.

 

What is Open Banking?

​

Open Banking is the secure way of providing access to your bank or building society account to providers who are registered for this purpose.

Registered providers and participating banks and building societies are listed under the Open Banking Directory.

​

Open Banking was set up by the UK Government to encourage more competition and innovation in the financial services sector.

​

As a forward thinking lender, we support the use of Open Banking as it allows us to process loan applications efficiently, securely and in our consumer’s best interests.

​

By permitting access to your bank or building society account information we are able to make a better lending decision as we shall be able to verify your income, outgoings and other matters in order to assess what loan terms would be suitable for you based upon what you can reasonably afford to repay.

​

Further information about Open Banking is available from www.openbanking.org.uk

 

​

Planky

​

How will my personal data be shared and used for the purposes of Open Banking?

​

By proceeding with your loan application via our website you expressly consent to us sharing your personal, contact and loan application details (“the Shared Personal Data”) with our registered Open Banking partner, Friendly Score UK Ltd Limited (trading as Planky) who are also a FCA-regulated Account Information Service Provider (AISP), Credit Reference Agency, and analytical software company, offering Open Banking data aggregation services and bank account analytics.

​

During your loan application we shall safely and securely direct you to Plankys secure website for the purposes of granting Planky access to your bank or building society account information (“Transaction Information”).

​

Planky will use the information from the banks, financial institutions and other relevant parties that you have consented to share data with us, as part of the open banking solution. An application programming interface tool which comprises a set of definitions, communications protocols and tools, are used for the purposes of analysing, aggregating and consuming this data.

​

The information is used to provide data analytics services based on your information.

​

Your data may be combined with information you give to Planky and information they collect about you. Planky may use this information and the combined information for the purposes set out above (depending on the types of information we receive). This information will be reported back to us in the form of a completed search in order that we may continue to process your loan application (“the Permitted Purpose”). CLEVR Money may use this data to make automated lending decisions.

 

As soon as your Transaction Information is received it shall be aggregated with any other transaction information that you have provided Planky with consent to access and automatically analysed using machine learning detection and prediction models to provide us with a comprehensive view of your financial behaviour, including predicted and historic spend analysis, key merchants, balances, recurring expenditure, credit behaviour, stopped payments, and risk indicators including recent loan commitments, liquidity, stopped payments, returned direct debits, unarranged overdraft usage, and gambling.

 

Further information about Planky including their registered provider and regulatory status is available from https://www.planky.com

​

Is Open Banking secure with Planky?

​

Planky are Authorised and Regulated by the Financial Conduct Authority (FRN: 781963). They are also authorised to provide AISP Services (FRN: 821100).

 

We are responsible for the secure transmission of any Shared Personal Data to Planky, for safely directing you to the website and for the safe receipt and usage of your Transaction Information.

 

You will not be required to share your banking password or log in details with either us or Planky.  Once you have given your explicit consent to share your bank account information on the website you will be directed to your own bank or building society’s login page where you will enter in your own login details directly.

 

Save as set out above or elsewhere in this Privacy Policy, we are not responsible for your direct data transmissions with Planky or with your own bank or building society.

 

 

How will my Shared Personal Data and Transaction Information be used?

​

Planky shall, subject to their own terms and conditions and privacy policy, and, if your bank or building society is registered to provide access, obtain, aggregate and analyse your Transaction Information and submit this back to us for the Permitted Purpose. By way of example, the Transaction Information that we shall receive is likely to include information relating to your income, outgoings and credit worthiness.

 

Planky shall be entitled to re-access your Transaction Information for up to 90 days from the date of your original search result in order to refresh the search results, obtain a snapshot of your data or gather additional data.

 

Planky shall hold the Shared Personal Data and the Transaction Information they receive and retain according to their own terms and conditions and privacy policy, available on their website, which you will be required to read and consent to once directed their via our website.

 

As Planky are also a credit reference agency they may also share and keep a record of your Shared Personal Data and Transaction Information.

​

Will you use my Transaction Information data for any other purpose?  

​

The Transaction Information we receive about you will only be used for the Permitted Purpose.  We do not sell or share Transaction Information with any third party.

 

Save as set out above the information contained in the rest of this Privacy Policy deals with how we collate, use, transfer, store, delete and other terms applicable to your personal data including Shared Personal Data and Transaction Information.

 

Do I have to provide you with my consent to proceed?

​

We will only request consent to view your Transaction Data where it is necessary for verifying your income and expenditure and determining your eligibility for a loan with us, or to assist with assessing affordability for an existing loan. You are under no obligation to provide us with consent via Open Banking, but failure to provide the requested information will lead to your loan being refused.

 

Where your bank or building society have already permitted access to your Transaction Information you shall need to contact them directly in order to withdraw your consent under their particular Open Banking terms and conditions.

​

Are any of my other rights under this Privacy Policy affected?

​

Your individual data protection and privacy rights including the right to access, correct, delete, object, restrict, withdraw consent, request transfer and/or make a complaint, continue to apply to relevant personal data we control or process and are dealt with elsewhere in this Privacy Policy.

​

Under Open Banking as your personal data is shared by your bank or building society and accessed by Planky, you may also be able to exercise your individual data protection and privacy rights against either of them pursuant to their own terms and conditions and privacy policies.