Legal and privacy policy

Legal basis for processing personal data

When we process your personal data we do this for the following reasons:

• to progress the loan enquiry;
• to enter into the loan contract;
• to record and place on the relevant public registers our interests in respect of any of your property that our loan is secured against;
• to fulfil a contract we have with you;
• when it is our legal duty to do so;
• where we have legitimate interest in doing so (and this doesn’t outweigh your own relevant interests); or
• when you have given us consent.

Access to your personal information

Data Protection law gives you the right to request the personal information that we hold about you. You have the right to be informed whether or not we are processing personal data that relates to you, and if so to be informed of what we are processing, what we use the data for, who we disclose the data to and how long we will keep it for.

Restriction

You have a right to request that we restrict our use of your personal data. The Company will be required to restrict the processing of personal data in certain circumstances, for example where an individual contests the accuracy of the personal data.

Data portability

You may ask us to provide you with a copy of the personal data you have provided to us in a commonly used electronic format.

Your data - retention periods / how long we keep your data.

We will keep your personal data for as long as you are a customer of Mercantile Trust. Once you have paid back the loan, we will keep your data for up to 12 years to enable us to deal with any questions or complaints, to demonstrate compliance with regulation or for legal reasons.

Marketing

If you choose to receive marketing material from us, we may contact you by letter, phone, SMS or electronic mail to offer other products which we feel may be of interest to you. If you do not wish to be contacted by us, please write to the Data Protection Officer at the address above, or e-mail your name and address to contact@mercantiletrust.co.uk. You may also update your marketing preferences on our website: www.mercantiletrust.co.uk/Marketing-Preferences

Credit search

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take financial services from us we may also make periodic searches at CRAs to manage your account with us.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• Assess your creditworthiness and whether you can afford to take the product;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Manage your account(s);
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them the information in this notice, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your spouse or financial associate successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.equifax.co.uk/crain, www.experian.co.uk/legal/crain & www.transunion.co.uk/crain

Fair processing notices for the purposes of fraud prevention and detection

General

Before we provide services, or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

We may use personal data that you have provided, that we have collected from you and that we may have received from third parties to prevent fraud and money laundering and to verify your identity.

Details of the personal information that will be processed may include name, date of birth, address, contact details, financial information, employment details and device identifiers including IP address.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Concerns relating to data protection

You have the right to complain to the Information Commissioner’s Office (ICO). The ICO is an independent body responsible for making sure that organisations comply with Data Protection law. The ICO also deals with concerns raised by members of the public about the way in which organisations look after personal information. If you need to raise a concern, you can do so by using the following link:

www.ico.org.uk/concerns