Our Privacy Policy

Privacy Policy

This Privacy Policy indicates how your personal information is used by First Response Finance and sets out your rights under General Data Protection Regulation (GDPR).

Who we are

Your personal information will be held by First Response Finance Limited. If you have any questions, or would like to find out more about how we use your personal information, please contact our Operational Risk team.

Phone number

0115 946 6368

Email address

dataprotection@frfl.co.uk

How your data's protected

For First Response Finance to use your personal information, we must have a lawful basis for doing so, including the sharing of your information outside of First Response Finance Limited. The legal basis for which we may use your data must fall into one or more of these reasons:

To enter into a contract with you
When it is our legal duty
Where there is a legitimate interest
When you consent to it

How we may use your personal information

Below is a list of the ways in which we will use your personal information, the lawful basis we rely on to process it, and where we process based on legitimate interests.

To provide you with our products and services

To allow us to process your application, we will use your personal information to assess your suitability for finance.

Lawful basis: fulfilling a contract, legal duty, and legitimate interests.

Our legitimate interests: promoting responsible lending and helping to prevent over indebtedness. To prevent, detect, investigate and report financial crime.

Managing our agreement and relationship with you

We will process your information to ensure that you're able to fulfil your obligations under your credit agreement and to communicate with you to provide and manage your needs.

Lawful basis: fulfilling a contract, legal duty, and legitimate interests.

Our legitimate interests: make and manage your payments required under your agreement and to recover money and assets that are owed to us.

Our legal obligations

We may process your information for the prevention, detection, and investigation of fraud and money laundering; to comply with laws and regulations that we have to adhere to for auditing purposes. If we're obliged to disclose information by reason of any law, regulation, or court order.

Lawful basis: legal duty.

Our legitimate interests: to defend any legal claims made against our company.

Staff training and awareness

To provide training to our employees to enhance or review the service we provide, or have provided, to you.

Lawful basis: legitimate interests.

Our legitimate interests: developing and improving our employees' knowledge and expertise to ensure you're provided with the most efficient service.

To send you marketing material

To provide you with information on other products and services we can offer you.

Lawful basis: legitimate interests.

Our legitimate interests: to send information on similar products to individuals who have not previously objected to receiving marketing material.

What personal information will we collect and process?

The types (or categories) of personal information we'll collect about you and process are:

personal identifiers - information which can identify you, such as your name and date of birth;
contact details - information on where you live and how we may contact you to discuss your agreement;
financial details - your financial position, history, and bank account information;
employment - your current employment status and employment history;
documentary data - documents provided by you, i.e., passport, driving licence, payslip(s), and/or bank statement(s);
public records and open data - information about you on public records such as the Electoral Register and information which is openly available on the internet;
location data - information we receive from your device (mobile phone, computer etc.) when you visit our website or log in to your online account;
special category data - certain personal information you provide to us is more sensitive and needs more protection. We will only collect and process this type of data with your consent. Examples of this type of data includes information you provide in relation to a vulnerability which we need to be aware of to provide support and correctly manage our relationship with you.

Why we need your personal information

We need to collect your personal information in order to enter into a finance contract with you.

If you choose not to provide us with your personal information, it will mean that we'll be unable to offer you our products and services.

Where we collect your personal information from

We may collect personal information directly from you when you apply for our products and services, or when you contact us to discuss your finance agreement.

Your personal information may also be provided to us by a third party, such as a vehicle dealership when you visit them to purchase a vehicle.

Further organisations where we may collect your data from include:

Credit reference agencies
Fraud prevention agencies
Public information sources such as Companies House
Agents working on our behalf

Who we share your personal information with

Below is a list of organisations in which First Response Finance Limited may share your personal information with:

agents (tracing, debt collection, vehicle repossession, and car auction) who assist us in ensuring you fulfil your obligations under your finance agreement;
government and law enforcement agencies;
regulators and other authorities, i.e., DVLA;
independent vehicle inspection companies;
feedback service providers;
communication management companies;
payment system providers, including the Direct Debit Scheme and BACS;
legal and professional advisors including auditors;
courts to comply with legal requirements;
vehicle dealerships;
technology business partners.

We also share your personal information with the following agencies:

Credit reference agencies

When you apply for a product or service, we'll carry out credit and identity checks on you with one or more credit reference agencies.

To do this, we will supply your personal information to credit reference agencies and they will give us information about you. This will include information from your credit application and facts about your financial situation and financial history. Credit reference agencies will supply to us both public (including the electoral register) and shared credit, financial situation information, financial history information, and fraud prevention information.

We will use this information to:

assess your creditworthiness and whether you can afford to take the product;
verify the accuracy of the data you have provided to us;
prevent criminal activity, fraud and money laundering;
manage your account(s);
trace and recover debts;
ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with credit reference agencies while you have a relationship with us. We will also inform credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, credit reference agencies will record the outstanding debt. This information may be supplied to other organisations by credit reference agencies.

When credit reference agencies receive a search from us, they will place a search footprint on your credit file that may be seen by other lenders.

If you're making a joint application, we will link your records together, so you should discuss this with them and share with them this information before lodging the application. Credit reference agencies will also link your records together and these links will remain on yours and their files until such time as you or your partner successfully files for a disassociation with the credit reference agencies to break that link.

The identities of the credit reference agencies, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods, and your data protection rights with the credit reference agencies are explained in more detail within the Credit Reference Agency Information Notice (CRAIN).

This notice is accessible from the following credit reference agencies:

Fraud prevention agencies

General

Before we provide services, goods, or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers (including IP address), and vehicle details.

We, and fraud prevention agencies, may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, and if you're considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Data transfers

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to 'international frameworks' intended to enable secure data sharing.

Your rights

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data, the request that your personal data is erased or corrected, and to request access to your personal data.

Transfer of data outside of the European Economic Area

Your personal data will not be transferred outside of the European Union.

If in the event First Response Finance Limited are required to transfer data outside of the European Union, we will:

only do so with either your consent, or where we have a legal basis for processing;
put in place a contract with the organisation to ensure the data is protected to the same standards as if it were still within the European Union.

How long we retain your personal information for

We'll keep your personal information for as long as you're a customer of First Response Finance Limited.

Once you're no longer a customer, we may retain your personal information for up to seven years. The reason for this is:

adherence to regulations applicable to us;
to respond to questions or complaints from when you were a customer.

Your rights as an individual

How to access your personal information

You have the right to access the personal information we hold on you. To exercise this right, please contact our Operational Risk team.

Address

Operational Risk
First Response Finance Limited
Chetwynd Business Park
5 Regan Way, Chilwell
Nottingham
NG9 6RZ

Phone number

0115 946 6368

What if your personal data is incorrect?

You have the right to have your data corrected if it's inaccurate or incomplete. Contact us if you would like us to do this, and we will take reasonable steps to check its accuracy and correct it.

Deleting your personal data

You have the right to ask us to erase your personal data. Contact us if you would like us to consider your request. If we're unable to comply with your request for erasure, we will explain to you why.

How to restrict the processing of your personal information

You have the right to request that we cease processing the personal information we hold about you if it is not accurate, it has been used unlawfully and you don’t want us to delete it, or your information is no longer relevant but you wish for us to keep it for use in legal claims. Contact us if you would like to exercise this right.

Data portability

You have the right to ask us to provide you with a copy of the personal information you provided to us or to request that we transfer this data to another organisation in a format that can be easily re-used. Contact us if you would like to exercise this right.

This right will be implemented on the 25^th May 2018.

If you want us to stop using your personal information...

You have the right to object to our use of your personal information. There may be legal reasons as to why we may need to keep your data, however, contact us if you think we should not be using it.

How we use your information to make automated decisions

When we collect your personal information, either directly from you or from other authorised sources, we may use systems to make automated decisions.

The types of automated decisions we make are:

pricing – we sometimes make decisions on the cost of the product and services you have applied for based on the information we have collected;
approving credit – once you submit an application for finance, we may make automated decisions to establish whether we can offer you our products and services, and to proceed with your application. This decision is based on our credit assessment models which assess how likely you are to act while paying back any funds borrowed. This assessment will check on how you have paid similar accounts in the past.

Our credit assessment model uses three sources to ensure a fair and well informed outcome is achieved:

The details you submit on your application form
Information held and supplied from credit reference agencies
Any data that we may already hold that relates to you

We share specific information regarding you with the credit reference agencies and they in return give us specific information about you.

Your rights on automated decisions

There are a number of rights you have in relation to automated decisions, these are:

you can ask us not to make our decision based on automated means alone;
you can object to an automated decision and request that a person reviews your application.

If you would like to exercise your rights, please contact us.

Links to other websites

Where we provide links to websites of other organisations, this Privacy Notice does not cover how that organisation processes personal information. We encourage you to read the Privacy Notices on the other websites you visit.

What to do if you want to make a complaint

If you're unhappy with how we have processed your personal information, please visit our Complaints page.

You also have the right to make a complaint to the Information Commissioners Office, who regulates the processing of personal data. You can do this by calling them on 0303 123 1113, or via the ICO website.