• To open and manage your accounts and relationship with us.
• To confirm your age.
• To meet our legal and regulatory obligations.
• To process your application for any job you apply for with us.

• Enable you to register for an online account (‘e-enable’)
• Contact you about your account.
• Inform you of any meetings such as the Annual General Meeting (AGM) and facilitate voting.
• Send you marketing information (where you have consented).
• Enable you to register your interests for new product or service updates that we may offer.
• Enable you to register to receive updates about our community activities or other events we are involved in.
• Process any job applications you have with us.
• Run and administer competitions/prize draws which you have entered and to notify the winner.

• To open and manage your accounts and relationship with us.
• To provide products and services of our partners.
• To provide you with support and for debt recovery purposes.
• To enhance your experience and our products and services.
• To share relevant marketing about our products and services.
• To meet our legal and regulatory obligations.
• To process your application for any job you apply for with us.
• Inform you of any meetings such as the Annual General Meeting (AGM) and facilitate voting.

• When you apply for our products or services online or on the phone.
• When update your information online, in branch or over the phone (such as when you change your address).
• When you speak to us on the phone (we may record some calls for training and quality purposes).
• When using our websites, online web chat services and any digital or mobile app we may offer now or in the future.
• When you send us in letters, emails or other documents.
• When we use information that you’ve made public, such as social media content or when you interact with our social media profiles.

• a joint applicant on an account you hold or are applying for
• a trustee on an account
• acting under a Power of Attorney or similar authority
• a mortgage broker or mortgage intermediary who is acting on your behalf.

• Current and former employers.
• Referees.
• Royal Mail (UK postal addresses).
• Local Authorities (electoral roll).
• The Insolvency Service.
• Companies’ House.
• Housing associations and landlords
• Court and tribunal Service
• Credit reference agencies.
• Government bodies and agencies.
• HM Revenue and Customs and other tax authorities.
• Regulators.
• Law enforcement agencies.
• Fraud prevention agencies.
• Insurers.
• Financial advisers.
• Land agents.
• Card associations.
• Retailers.
• Comparison websites.
• Market research providers.
• Tracing and debt recovery agents.
• Organisations providing data services to support us in managing our relationship with you and operating our business.

We will collect, use, share and keep personal data needed for us to deal with your enquiries, process your applications, provide any illustrations you require, and manage the ongoing administration of your accounts, products and services. This includes keeping your account records up to date and contacting you when needed.

You have the right to object to us processing your personal data for our legitimate interests.

We use CCTV for the safety and security of our customers and employees throughout our offices. This may capture personal data such as your image, likeness and voice.

Using CCTV in our offices is necessary for our legitimate business interests. It helps us provide a safe and secure environment for people who visit us or carry out business in our premises. It also supports us in detecting and deterring any criminal activity.

Footage may be reviewed by ourselves, or passed to police or law enforcement agencies upon request following any incidents relating to the security and/or safety of individuals and to assist with any ongoing crime investigations.

You have the right to object to us processing your personal data for our legitimate interests.

We will use your personal data to communicate with you. This includes via the telephone, email, live chat and social media.

You have the right to object to us processing your personal data for our legitimate interests.

We use personal data to manage and run competitions/prize draws for customers and the wider public.

When we collect personal data for this reason, we use it to administer the competition/draw and notify the winner. If we wish to use the data for any other purpose this information will be provided at the time.

You have the right to object to us processing your personal data for our legitimate interests.

We collect and use your personal data to:

• Assess the likelihood that your circumstances have changed.
• Work with you through challenging times, by understanding and supporting your needs.
• Recover any outstanding money owed to us (this could include trying to locate you).
• Help us decide on any further action we may need to take in order to recover money owed (e.g. whether we need to consider legal action or using a debt recovery agent).

We’ll process your personal data in this way when it’s necessary to meet the promises we’ve made in the terms and conditions of your product or service, and also when you ask us to carry out activities that need your authorisation (e.g. when you’ve requested for someone to act on your behalf or if you choose to give us information about your health or any criminal convictions).

When necessary, we’ll share your personal data with individuals and organisations that you’ve asked to act on your behalf (e.g. Citizens Advice and Debt Advice Charities) as well as credit reference agencies, solicitors, tracing and debt collection agents, home visit agents and debt purchasers.

To carry out these activities, we may need to use profiling (where we use your information to categorise groups of members and customers together based on their behaviours and interactions). This helps us make sure that we’re being fair and consistent in the way we treat our members and customers and also to support those who may be experiencing financial difficulty.

We may also use your personal data for our legitimate business interests. Rest assured, we’ll always ensure that the way we process your information is safe and not unfair to you.

You have the right to object to us processing your personal data for our legitimate interests.

We collect and use your personal data to help us make our business better, improve products and services and enhance how we engage with members.

We use your personal data in this way when it is in our legitimate business interests. Your information and views help us understand the changing needs of our members and customers.

We look at you and how you engage with us (e.g. how long you’ve been a member or whether you open our emails), your transactions and how you use our products and services (e.g. the types of accounts you have and how you use our online banking and any digital or mobile app we may offer).

Sometimes, we’ll collect personal data you from organisations carrying out market research on our behalf to make sure you had a positive experience with us or to ask your opinion on our products and services, or trends in our industry.

Then, we structure and analyse this information to consider how you might use our products and services in the future. We may also use your information to categorise groups of members who interact and engage with us in similar ways.

You have the right to object to us processing your personal data for our legitimate interests.

We will use your personal data to enable you to register to receive updates about our community activities or other events we are involved in.

Sometimes, we’ll need to share your personal data with a credit reference agency (CRA). We do this to:

• Assess your creditworthiness and consider whether we believe you can afford to take out a product with us.
• Confirm your income and outgoings.
• Check the information you’ve provided to us is accurate.
• Prevent criminal activity and financial crime including fraud and money laundering.
• Manage your ongoing relationship with us.
• Trace and recover debts.
• Make sure any offers we propose are appropriate (when we have the right to do so).

When we ask a credit reference agency to do a search on our behalf, this may leave a search footprint on your credit file that may be seen by other lenders. This happens whether or not you, or us choose to proceed with the application.

If you’re making a joint application, your credit records will be linked together. This creates what’s known as a ‘financial association’ at credit reference agencies. So, you should always discuss and agree this with other applicants before disclosing their information to check that they’re happy to proceed. Information about any financial associations will be shared with other lenders if either of you make a credit application in the future – whether it’s in just your name or together with someone else.

There are three key credit reference agencies that we use. Take a look at their Credit Reference Agency Information Notices (CRAINs) to find out more about them, the data they hold (and for how long), the way they use and share your information, how they prevent fraud and your data protection rights.

You can find out more about CRAs below:

• Equifax - equifax.co.uk/crain
• TransUnion - transunion.co.uk/crain
• Experian - experian.co.uk/crain

We understand that you may wish to hear from us from time to time about our products or services that we think you’ll find interesting or to keep up to date with the latest developments and news.

If you have consented to receiving such communications, we may use the contact details you’ve supplied us to send you marketing information. You can, of course, change your mind at any time and can change your marketing preferences.

We’ll never pass on your details to anyone else for their marketing purposes.

We’re required to collect and use your personal data in a number of circumstances to meet our legal and regulatory obligations.

These include using your personal data to carry out a range of activities that ensure we comply with the requirements set out by our regulators (e.g. Financial Conduct Authority – FCA) and in relevant legislation (e.g. Data Protection Legislation and Anti-Money Laundering Regulations). We also disclose information to HMRC and other government bodies when we are required or permitted to do so.

We use and share your personal data with fraud prevention agencies to help prevent financial crime. If required for fraud or criminal investigation reasons, we (and the fraud prevention agencies) may also allow law enforcement agencies to access and use your personal data.

We have a legal obligation and legitimate interest to check people’s identity, and identify and prevent financial crime including fraud and money laundering. Sharing your personal data in this way, when necessary, allows us to protect your financial security as well as that of our other members and customers. It also makes sure that we’re complying with the law.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details below.

You have the right to object to us processing your personal data for our legitimate interests.

We will collect, use, share and keep personal data to provide you with a Decision in Principle and to assess, review and process your application.

This process involves reviewing your application with the use of financial models and automated systems provided by Credit Reference Agencies and against our lending criteria.

This will help us to understand your mortgage application and to assess the affordability of the products and services you apply for.

There may be some circumstances where we use your personal data for profiling.

Profiling is used to make automated decisions. This is where we combine your personal data with information about others so that we can:

• Understand trends, traits and behaviours.
• Make predictions about how you might use our products and services in the future.
• Analyse data to improve our service and generate alerts (e.g. where we suspect that you may be the victim of financial crime).

Profiling your personal data alongside other members and customers also helps us to ensure that we’re providing a consistent service and giving people the best products and advice at the right times.

We’ll always make sure the way we process your information is safe and not unfair to you. Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports. This way, you will not be identifiable from the data.

You have the right to object to us processing your personal data for our legitimate interests.

We use your personal data to provide, introduce or distribute products and services from our partners.

Our partners will also collect and use your information to manage the products and services that you have with them. As this then makes them the ‘data controller’, they’ll provide more details on how they process your information at the time when it’s collected by them or shared by us.

When selecting our partners, we take appropriate steps to make sure that they have adequate protection in place and that they follow data protection legislation.

You have the right to object to us processing your personal data for our legitimate interests.

We want you to get the most out of e want you to get the most out of your relationship with us so we use social media and websites to let you know about the products and services we offer that might be of interest to you and to communicate with you if you contact us through this method.

We may also use social media services to enhance our services, presence and your customer experience. Your comments, opinions and messages may be used so that we can better understand our customers and improve our products, services and overall customer offering.

We may do this by matching the personal details we hold about you, such as your email address, with the details social media companies or websites hold about you. This is done in a controlled, anonymous way so your identity is never revealed. By doing this, social media and websites can share tailored marketing messages with you about our products and services.

We will never agree to social media companies or websites sharing or selling your information to third parties

You have the right to object to us processing your personal data for our legitimate interests.

If you submit a request, we will stop sending you marketing messages tailored to you. However, you might still receive some general marketing messages from us, but these won’t be targeted to you.

If you want to control the adverts you see on social media platforms, you can manage your marketing preferences (including receiving targeted marketing ad) through their settings and privacy pages. You may still see adverts, but these won’t be tailored to you.

We use personal data as in order to carry out Data Analysis, Trends and Statistical Reporting. We will only do this using personal data where necessary and if we are unable to use anonymous data.

You have the right to object to us processing your personal data for our legitimate interests.

In order to improve our services and systems, we may use your personal data for testing our systems so that we can make them even better.

Using your personal data for testing is necessary for our legitimate business interests as it allows us to maintain and improve the security, integrity and performance of our systems.

We have stringent processes in place to keep your personal data safe and we won’t use it in a way that’s unfair to you. When we are unable to use 'masked' or anonymous data (i.e. that which doesn’t identify you), we will aim to:

• Always do this in a secure and controlled environment.
• Only use the minimum amount of data necessary for the testing required.
• Only use carefully selected specialist service providers, where necessary.
• Only hold your information in this way for as long as needed to carry out testing.

You have the right to object to us processing your personal data for our legitimate interests.

We have a regulatory requirement to confirm the identity of anyone opening an account with us or when they apply for a job or role with us. This upholds our legal obligation to complete necessary due diligence checks to make sure we know our customers and potential employees, helps prevent and detect fraud, prevents identity theft and protects our business.

You have the right to object to us processing your personal data for our legitimate interests.

• To contact them to inform them of mortgage or additional borrowing application applications and ask them to confirm that they have no claim on the property.

• To assist with enquiries and the assessment of claims.

• To respond to court and tribunal requests
• To manage and resolve complaints, disputes and/or legal claims.

• To verify your identity and to help trace your whereabouts if we have been unable to contact you.
• To review and assess your suitability, and application for products and services

• To carry out processing activities on our behalf under contract and after we have assessed their suitability.

• To assist with debt collection activities and to locate you if we have been unable to contact you via our usual communication channels.

• To provide marketing services on our behalf.
• To provide you targeted adverts based on your previous web browsing history.

• To confirm your employment and employment status and income received.

• To provide you with financial advice and assistance.

• To carry out checks for the purposes of preventing fraud and money laundering
• To verify your identity.
• To assess your suitability for products and services.
• For fraud prevention and tracing activity.

• To process any application or account information in which that body has a legitimate interest such as an unauthorised letting or property alteration or any identified false or inaccurate information.

• To confirm your tax status and provide information for tax reporting purposes
• To assist with enquiries, investigations, complaints and assessments
• To assist with financial crime and fraud prevention.

• To provide you with insurance services.

• To respond to enquiries, requests and further applications.
• To allow ongoing administration of your joint account, products and services
• To processing transactions.

• To assist with any ongoing investigations relating to the security and/or safety of individuals.
• For financial crime and fraud prevention purposes.

• To provide market research services on our behalf.
• To gain better understand our customers and members including their experiences, circumstances, needs and responses to our current and potential products, services and wider initiatives.
• To gain a range of insights, for example market trends; consumer behaviour; competitors; technological change
• To support a wide range of business decision making such as product development.
• For data for profiling and customer segmentation to create a broad understanding of our customers, to help shape our communications, products and the overall customer experience from what our branches look like, to how we handle phone calls and other customer contacts.

• To deal with their enquiries, requests and further applications
• To manage the ongoing administration of your accounts, products and services
• To process transactions

• To review and assess your suitability and application for products and services
• To manage payments (including the use of payment services involving the transfer of electronic payments into or out of your account).
• To respond to requests for the postponement of a charge on your property.
• To financial crime and fraud prevention purposes.
• To assist with enquiries and investigations.

• To obtain a reference for any product or service you apply for (where applicable).

• To comply with our regulatory requirements and to resolve complaints.

• To communicate with you and answer your queries submitted via social media.
• To show you targeted advertising.

• To provide professional services
• To review and assess your suitability and application for products and services
• To manage your ongoing relationships
• To administer and manage disputes and/or legal claims.

• To provide our regulatory and governing bodies with data about our business
• To assist with enquiries, investigations, complaints and assessments.

• To comply with our regulatory, legal and compliance requirements.
• To provide products and services.

If you contact us with a general enquiry, via email, phone, post or in personal (e.g. in Branch), we will retain your personal data for up to 6 months from the date the information was obtained in order to allow time for you to open an account, product or service and for us to respond to further queries from you.

If you have provided consent to receiving marketing from us, we will retain your personal data for up to 3 years from date the information was received.

If you make a general enquiry in relation to a mortgage account, but do not apply for a product, we will keep your personal data for up to 6 months from the date the information was obtained to deal with your queries.

If you have provided consent to receiving marketing from us, we will retain your personal data for up to 3 years from date the information was received unless you withdraw your consent.