Blue Motor Finance Limited Customer Fair Processing Notice

Introduction

This privacy notice explains how and why Blue Motor Finance Limited (Blue), uses personal data processed by or collected on our behalf. Blue is a data controller of the data it collects about its customers, and this notice describes how it uses your information. Blue’s contact details are:

• Blue Motor Finance Limited, Darenth House, 84 Main Road, Sundridge, Kent, TN14 6ER
• customerservices@bluemotorfinance.co.uk
• 0203 005 9332

This notice applies to Blue’s customers, people who have applied to it for finance, and individuals connected to its customers whose data it collects as part of its interactions with customers. You should read this policy so you know what personal data we collect about you, what we do with it and how you can exercise your rights in connection with it. If you are a partner, supplier, or another third party, please see the Third Party FPN.

What information does Blue collect?

Information Blue collects from you

When you apply to Blue for a loan, you provide it with information so that it may decide whether to lend to you and assist with the overall management and administration of your agreement. The information that Blue may collect about you includes:

• name
• current and historic addresses
• date of birth
• email address
• phone numbers
• bank details
• employment information (including employment status, employer details and occupation
• identity information which may include Photo ID
• gender
• household information (including marital status, occupancy status and number of dependants)
• financial information (including income, expenditure, spending habits and transaction history)
• vehicle details including vehicle registration mark (VRM)
• marketing preferences
• information obtained and learnt about you through communication (including emails and call recordings
• IP address, operating system and browsing behaviour
• health, family circumstances, accessibility needs, gender, and social and lifestyle arrangements

Blue describes how it treats this information below.

Information collected from third parties

Blue will collect information about you from third parties, such as Credit Reference Agencies (CRAs) when it conducts credit checks on you (see relevant section below for more information).

What legal basis does Blue have for using your information?

As the data controller, Blue is legally responsible for ensuring that it has a legal basis for processing your information. The UK GDPR sets out several legal bases for processing personal data, and Blue describes below some of the purposes Blue will use your information and the lawful basis it relies on to do so.

What about especially sensitive information (special category data)?

In the course of applying for a loan or while the loan is operating and you interact with Blue, you may provide to Blue and/or Blue may need to process information which is especially sensitive. Some of this information is called “Special Category Data” such as information in relation to health, lifestyle, accessibility, family circumstances and in some cases, information relating to criminal matters or offences.

Blue may collect the following types of special category data about you:

• Racial or ethnic origin
• Religious, political, or philosophical beliefs
• Health data
• Sexual orientation
• Records of criminal convictions and offences
• Records or allegations of criminal offences

Where this is the case, Blue will normally process this information on the legal basis that it is in the wider public interest, such as for regulatory or legal reasons (for example in relation to identifying and supporting any vulnerability or making any accessibility adjustments) or for preventing or detecting unlawful acts such as fraud.

Reasons for Blue using your special category data.

Substantial public interest including:

• Using criminal records data to help prevent, detect, and prosecute unlawful acts and fraudulent behaviour.

Responding to regulatory requirements, including:

• Correctly demonstrating we have assessed your financial and personal circumstances
• Passing information to the regulator so they can investigate whether we have acted in the right way.

Legal claims, including:

• Using any special categories of personal information as needed to establish, exercise or defend legal claims.

How will Blue use your information?

Blue may process your information in various ways, using automated and manual systems.

Blue uses automated decision making as part of its process to determine whether it will lend to you and on what terms. Blue will compare your profile against its qualification criteria using automated means, as well as data obtained from credit reference agencies to assess how your likely to act while paying back your loan If you do not meet its criteria, it may refuse to lend to you on the sole basis of its automated decision making systems.

As one of your rights, you are able to object to any solely automated decision that has been made about you and ask that a person at Blue reviews that decision. To do this, and to know more about your rights, see the section below titled “What rights do you have with regard to your information?.”

With whom will Blue share your information?

Credit Reference Agencies

If you apply for a loan, Blue will carry out credit and identity checks on you with CRAs, to:

• confirm the accuracy of details you have provided when you apply for a loan;
• provide you with relevant quotes and offers;
• make credit and affordability assessments to decide whether to accept your loan application and set appropriate credit limits.; and
• detect and prevent financial crime and fraud

Blue will carry out additional checks on you from time to time to understand your financial position and manage your loan account.

To carry out credit checks on you, Blue will provide your information that you have provided to us, to a CRA and the CRA will return to Blue information about you. The information that Blue receives from CRAs includes data which originates from Royal Mail (UK postal addresses), local authorises (electoral roll), the insolvency service, Companies House as well as other people with whom you are financially linked (such as your spouse or partner), including but not limited to:

• credit score
• sanctions
• • if you are either a politically exposed person or have special interest persons status
• current and previous addresses
• credit history, including:
  • current credit commitments
  • historic credit commitments ending in the last six years
  • credit payment history including whether you repay on time
• electoral roll details
• details of credit searches undertaken by other organisations
• information from fraud databases
• information publicly available

If Blue searches your record at a CRA, the CRA will add to your record the details of its search and the details of your loan application. Blue may also share your information with CRAs on an ongoing basis, including details of settled accounts or debts not fully repaid on time. This information will be available to other organisations that search your CRA record. Other organisations may use this information and other information about you to make credit decisions about you and the people with whom you are linked financially (such as a spouse or partner).

If you propose a joint agreement or Blue enters an agreement with you involving joint parties, this information will be recorded with CRAs. This will create an association between your record and your joint party’s record, which Blue or other organisations may consider in future decisions. This association will remain in place until you file a disassociation with the CRA.

For more information on CRAs, including their relationship with Fraud Prevention Agencies, please refer to the Credit Reference Agency Information Notices (CRAIN) below.

• TransUnion CRAIN https://www.transunion.co.uk/crain
• Experian CRAIN https://experian.co.uk/crain
• Equifax CRAIN https://www.equifax.co.uk/crain

Fraud Prevention Agencies

Blue may share your information with Fraud Prevention Agencies to detect and prevent fraud. If Blue or FPA’s determine that you pose a fraud or money laundering risk, Blue may refuse to provide the services or stop any existing services with you. FPAs will share their records with other organisations, in which other organisations may use this information to make decisions about you and other persons connected to you, including in relation to employment, credit, or insurance, and may result in others refusing services if fraud is detected.

For more information on FPAs, please refer to the Fair Processing Notices below.

CIFAS: https://www.cifas.org.uk/fpn

Legal, Governmental, and Regulatory Bodies

Blue may share your information with legal, governmental, and regulatory bodies to meet its legal and regulatory obligations. These may include the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, the Police or any other legal, governmental, or regulatory body.

Service Providers

Blue may share your information with professional advisers (including legal advisers), outsourcing providers (such as IT service providers), financial institutions (such as banks), or with any other type of organisation or person that it uses to help it conduct its business. Blue only uses third parties where they have entered into appropriate data processing agreements in place. This means that they cannot do anything with your personal information unless Blue have instructed them to do it. They will not share your personal information with any organisation apart from Blue or further sub-processors who must have also entered into a similar data processing agreement, or where the law authorises them to do so.

Examples of third party service providers that Blue use are as follows:

• Debt Collection and Recovery Agents
• Back up and server hosting provider IT software and Maintenance providers
• DVLA
• Motor Dealer or credit brokers that introduce you to us
• Insurance providers
• Income and expenditure providers to verify your income and other financial information
• Market Research and data analysis providers to help develop and improve our product
• Postage and printing providers
• Automotive valuation companies
• Document and verification providers

Authorised Third Parties

Blue may share your information with any person that you have authorised to engage with it on your behalf or that otherwise has a legal authorisation to do so. This includes parents/guardians, carers, or any other helpers where you are unable to handle your own affairs due to mental incapacity or other similar issues, for example power of attorney.

Blue may share your information with any organisation you have appointed to act on your behalf or authorised to receive your information, such as law firms and claims management companies.

Restructure, sale or acquisition

Blue may share your information with any person to whom it sells or transfers (or enters into negotiations to sell or transfer) its business or assets. If the transfer or sale goes ahead, the transferee or purchaser may use your information as set out in this notice.

Other lenders with an interest in your loan

If you have a loan agreement, Blue may transfer an interest in your loan to selected partners, such as other lenders, including where Blue transfers or delegates its rights and obligations under your loan agreement to another lender. If the transfer goes ahead, Blue may share your information with each transferee who has an interest in your loan where there is a lawful basis for it to do so - for example, to enable the other lender to meet its regulatory obligations or reporting requirements. In such circumstances, the transferee may use your information as set out in this notice, including data from credit reference agencies for the purpose of assessing their risk, which may include matching your data to other data which they may hold about you.

Do you have to provide your personal data?

We are unable to provide you with a product or service or to process your application without having certain personal data about you. Your personal data is required before you can enter into the relevant contract with us, and or it is required during the life of the contract and or it is required by laws that apply to us.

Marketing

Where you tell Blue you are happy to receive information from us or providing you have not opted out, we may send you communications about products and services that we perceive may be of interest to you, including third party marketing.

If, at any time, you prefer not to receive further communication, you will have the ability to unsubscribe and opt out from such communication by means of a link provided in every email that is sent to you. You can also update your marketing preferences through your online portal account or contacting the customer service team at: customerservices@bluemotorfinance.co.uk.

Where will Blue transfer your information?

Blue may transfer your information outside the United Kingdom to comply with legal or regulatory duty or where it is required by suppliers in connection with the services provided by Blue. Your personal data is only permitted to be transferred be transferred internationally by virtue of an adequacy decision in place, which means that the recipient country has similar data protection laws and measures which protect your information to UK standard. In other cases, your personal data is permitted to be transferred internationally by virtue of contracts in place between Blue and third parties which include contractual obligations in the form of standard data protection clauses which require the recipient to protect your personal data to the standard required in the UK. For more information on international data transfers, including details of safeguards, please contact Blue’s Data Protection Officer at dpo@bluemotorfinance.co.uk.

How long will Blue keep your information?

If you apply for finance and Blue decides not to lend to you or your finance application is accepted but you do not proceed, it will keep your information for 1 year from the end of your relationship with it. Blue does this for several reasons, including to provide information to regulators on its lending practices. However, Blue may extend the relationship beyond the date it refused your loan application, e.g. if there is an ongoing dispute or complaint. If Blue extends the relationship, it will end it as soon as it determines it is possible to do so, e.g. when the dispute or complaint is settled.

If you enter a loan agreement with Blue, it will keep your information for 7 years from the end of the last financial year of our business relationship with you. Blue does this for several reasons, but primarily to maintain records according to its legal and regulatory obligations. However, Blue may extend the relationship beyond the end of the contract, e.g. if there is an ongoing dispute or complaint. If it extends the relationship, it will end it as soon as it determines it is possible to do so, e.g. when the dispute or complaint is settled.

What rights do you have with regard to your information?

You may have the following rights in regard to your information:

• The right to be informed about the collection and use of your information, as set out in this notice
• The right of access to a copy of your information
• The right to rectify incorrect or incomplete information
• The right to the erasure of your information, which will not apply in some circumstances, including if Blue is under a legal obligation to retain your information
• The right to restrict processing of your information (subject to limitations)
• The right to data portability (subject to limitations and not including paper files)
• The absolute right to object to the processing of your information for direct marketing, and a limited right to object in some circumstances, including to the processing of your information on the basis of legitimate interests
• The right to withdraw consent, where Blue is relying on your consent
• Rights in relation to automated decision making and profiling.

If you wish to exercise your right of access to a copy of your information, please contact Blue at its dedicated email address dsar@bluemotorfinance.co.uk.

If you have questions regarding your rights or wish to exercise a right other than the right of access, please contact Blue’s Data Protection Officer at dpo@bluemotorfinance.co.uk.

Changes to our privacy policy

This privacy notice is kept under regular view and our latest version will be published here. In the event of any substantial changes in the way Blue Motor Finance Ltd processes your personal data you may be contacted to notify you of such changes.

How can you complain about our processing of your information?

You have a right to make a complaint if you are dissatisfied with how your personal data is processed by Blue Motor Finance. However, we would appreciate the opportunity to deal with your complaint before you approach the supervisory authority. Please contact us at dpo@bluemotorfinance.co.uk as we Blue may be able to resolve your complaint or address your concerns in the first instance.

If you are still not satisfied with the response sent by Blue, you have the right to complain to the Information Commissioner’s Office about Blue’s processing of your information. You can contact the Information Commissioner’s Office using the following details:

Web: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113