Privacy Notice – Experian Statutory Credit Report

Contact information

When you apply for Experian services we will ask you to provide some contact information. Contact information may include some or all of the following: full name, previous names, residential address, previous residential addresses, date of birth, landline phone number, mobile phone number and email address.

We will only retain your contact information for two years after your application in order to answer any queries you may have. However, information about address links or aliases which you tell us about during registration may be kept indefinitely to help us improve the quality of our data (see below).

Device

We also collect certain data automatically from your visit to our website or use of our services. This may include (but is not limited to) some or all of the following: How you connect to the internet (including IP address), how you engage with our site, screen resolution, browser data stored on your device (such as cookies – see also our cookie notice, information about the device software you are using such as internet browser and location data (city, region of the IP address you used when accessing our services). We will only retain your Device information for 26 months after the end of the provision of Services.

Credit information

We may need to access data we already hold about you on our credit bureau. This may include (but is not limited to) some or all of the following: details of credit accounts held and repayment performance as well as public information such as inclusion on the electoral roll, bankruptcies and county court judgements. We will only retain the Credit information we derive from the credit bureau for two years from the query in question in order to enable us to answer your queries.

To create and provide access to your statutory credit report

We will use your information to retrieve your credit report and to provide it to you, either by post or online, through the use of an offline (postal) pass key. To confirm your identity and authenticate the information you provide

As part of providing services to you we will confirm your identity and authenticate the information you provide for security purposes.

Establishing your identity is important as the services may provide you with your personal credit information (such as your credit score or credit report) and we must be sure you are who you say you are. Identity checking may also involve checking the registration information you give us against information we already hold about you as a credit reference agency and potentially publicly available information about you such as from social media.

If we are unable to confirm your identity from the registration information you provide, we will let you know by using the contact details you have provided and you may then have the option to make a written application and provide further proof of your identity.

To provide and improve customer support

We will use your information to be able to provide and improve the customer support we provide to you (e.g. when you have questions or when you forget your log-in information).

To send you service communications

We may use your information to contact you to tell you about changes to or issues affecting the delivery of your statutory report.

Marketing

We will use your information for marketing purposes such as if we think one of our products, services or offers, or those of our third party partners, may interest you, we or they may contact you about them by email, SMS, on the phone, through app notifications or through the post.

We may contact you to invite you to subscribe to one of our services or products, or to use certain free features on our website.

You can opt out of marketing communications at any time by following the instructions in the email or SMS or by contacting us at customerservices@uk.experian.com You can turn off app notifications at any time using the tools provided in your mobile operating system.

Fraud investigation, detection and prevention

We may use your information for fraud investigation, detection and prevention measures and in order to provide suitable security for your account and your information that we hold (such as to enable us to prevent others logging in to your account without your permission from unknown devices).

Investigation, detection and prevention of crime

We may use your information for the investigation, detection and prevention of crime (other than fraud).

Internal training purposes

We will use your information to ensure that our team has the knowledge and expertise they need to ensure we provide the best possible experience to our customers when interacting with us.

Reporting and analytical purposes

We will use your information for reporting and analytical purposes (e.g. how many of our customers are in the north or south of the country) to enable us to improve our products and services and to provide appropriate levels of support to our customers.

Tracking activity

We will use your information to track your activity on our apps and on our websites to help us better understand your interests and how you interact with us. We may also use this information to help us detect if someone else is trying to access your account or use the services you take from us. We will also use this information to better engage with you and to ensure that you get the best service we can provide and improve our products in the future.

To maintain our records and other administrative functions

Like any business, we need to ensure that we maintain comprehensive and up to date records of the ways we process your personal information and other operational activities and therefore we will process the information you provide for record-keeping, updates and general administrative purposes.

Complaint and dispute resolution

Whilst we will try to make sure that you are happy with the service we provide and do not feel the need to complain, if you do complain to us, we will use the information we have about you to help us manage your complaint.

To comply with the law

Like any other business, we are required to comply with many laws and regulations. We will, where necessary, use your personal data to the extent required to enable us to comply with these requirements.

To improve data accuracy and completeness

Personal information you provide to us may be used to improve the credit bureau information we already hold about you in our role as a credit reference agency. E.g. if you provide a different address to the one we hold already we may store the new address in the credit bureau information to aid quicker identification of you and ensure that lenders can see a full picture of you when making lending decisions, it also aids identification and verification in the credit application process.

Email tracking

Experian may use performance tracking technology within our emails to improve our future interactions with you. This means we are able to capture information including (but not limited to) the time and date you open our e-mails and the type of device used to open the email.

We use this information primarily to understand whether our e-mails are opened and what links are clicked on by our customers. We then use this information to improve the emails that we send to you and the services that we provide.

Further information is included in our cookie notice for statutory credit report.

Further uses of your personal information not described in this Privacy Notice

If we use your personal information for any purposes that are not set out in this Privacy Notice we promise to let you know exactly what we will use it for before we go ahead and use it and obtain your consent where appropriate.

Necessary for performance of a contract or to comply with law

The information described above is used for the purposes described above - mostly used to fulfil your request for a statutory credit report. Giving this information to us is therefore your choice. If you choose not to give all or some of it to us, this may affect our ability to provide the services you want, to you. In particular, we may rely on this condition for processing in the following scenarios:-

• To create and provide access to your statutory credit report
• To confirm your identity and authenticate the information you provide.
• To provide and improve customer support.
• To send you service communications.

Consent

Where we collect other information from you such as when we use cookies to collect information about the device you use to access our website, or sometimes third parties collect this on our behalf. You will be asked to consent to this before using our website. If you choose not to give your consent, or you later remove your consent, this may affect our ability to provide the services you want, to you. We may also rely on consent in the following scenarios:-

• Marketing - From time to time, we would like to let you know about products, services and offers from Experian and our partners.

Necessary in our legitimate interests or those of a third party

In the United Kingdom, we can also use personal information where the benefits of doing it are not outweighed by the interests or fundamental rights or freedoms of individuals. The law calls this the “Legitimate Interests” condition for processing. Where we rely on it, the benefits being pursued by us are:-

• Helping to prevent and detect crime such as fraud and money laundering
  Fraud and money laundering cost the British economy many billions of pounds every year. That cost is ultimately passed on to the public in the form of higher prices. By helping to avoid fraud such as identity theft, we help to stop this from happening.
• Complying with/supporting compliance with legal and regulatory requirements
  We must comply with various legal and regulatory requirements. Additionally, the services we provide help other organisations to comply with their own legal and regulatory obligations. For example, Experian is regulated by the Financial Conduct Authority.
• Internal training purposes
  To enable us to train our staff to better provide services to our customers.
• Running a marketing services and data business
  

  Like any commercial organisation, we run a business and process information where necessary to do so. We also provide services to third parties which help them to run their businesses more effectively and efficiently.

  We have put in place various safeguards to ensure that individuals’ whose personal information we handle are not unduly harmed by the activities we use their personal data for. These include making information available to individuals so that they understand how their personal data will be used by Experian, explaining their rights to obtain the information we hold and to have their information corrected or restricted and providing information about how individuals can complaint if they are dissatisfied.
• Reporting and analytical purposes
  To provide management information and information to improve our services.
• To maintain our records and other administrative purpose
  To enable Experian to provide the most accurate data for our customers and clients.
• Complaint and dispute resolution
  We will need to use customer data when looking into queries and complaints.
• To improve data accuracy and completeness
  When you register for our services you may supply us with additional information about yourself which we will use to improve our data accuracy and completeness.
• Email tracking
  In order to improve our communications to our customers.

1. Group companies
   As a member of the Experian group of companies, we can benefit from the large IT infrastructure and expertise that exists within our business. This means that the personal data you provide to us may be accessed by members of our group of companies for support and administrative purposes.
2. Suppliers
   We use a number of service providers to support our business and these service providers may have access to our systems and data in order to provide services to us and/or to you on our behalf.
3. Fraud prevention agencies
   

   We will check your details with the records we hold and share with fraud prevention agencies. If false or inaccurate information is provided and fraud is identified, we will record this and details will be passed to the other fraud prevention agencies. Law enforcement agencies may access and use this information.

   We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

   • Checking details on applications for credit and credit related or other facilities.
   • Managing credit and credit related accounts or facilities.
   • Checking details on proposals and claims for all types of insurance.
   • Checking details of job applicants and employees.
   Please contact us at Experian Ltd, PO Box 8000, Nottingham, NG80 7WF if you want to receive details of the fraud prevention agencies. We and other organisations may access and use the information recorded by fraud prevention agencies from other countries.
4. Public bodies, law enforcement and regulators
   The police, other law enforcement agencies, regulators, as well as public bodies such as local and central authorities can sometimes request personal information. This may be for the purposes of preventing or detecting crime, apprehending or prosecuting offenders, assessing or collecting tax, investigating complaints or assessing how well a particular industry sector is working.
5. Individuals
   You can obtain a copy of the information we hold about you. See section Your rights to how we use your personal information for further information on how you can do this.

If you’ve given us consent to process your personal information, you have the right to withdraw that consent at any time by contacting us at customerservices@uk.experian.com. You can also make changes to that preference in your Experian account.

You can also ask for access to the personal information we hold about you and request that we correct any mistakes, restrict or stop processing or delete it. It’s worth noting that in some cases if you do ask us to correct, delete or stop processing it, we won’t always be required to do so. If that is the case, we will explain why. To request a copy of the personal information we hold about you, please follow this link.

In certain circumstances (e.g. where you provide your information to us (a) with consent to process it or (b) where the processing is necessary for the performance of our contract with you) you can require that we provide the information we hold about you either to you or a third party in a commonly used format. This only applies if we are processing it using automation only. If you would like more information about this, let us know by contacting our data protection officer at uk.dpo@experian.com.

We will try to ensure that we deliver the best levels of customer service but if you think we are falling short of that commitment, please let us know by contacting our data protection officer at uk.dpo@experian.com.

If you're still unhappy with any aspect of how we handle your personal information you also have the right to contact the Information Commissioner’s Office (ICO), the supervisory authority that regulates handling of personal information in the UK. You can contact them by:

1. Going to their website at https://ico.org.uk.
2. Phone on 0303 123 1113.
3. Post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, K9 5AF.

You may also see our full complaints handling procedure and how to make a complaint. If we cannot resolve things under that procedure, then you may have the right to refer your complaint, free of charge, to the Financial Ombudsman Service. The contact details for the Financial Ombudsman Service are: Telephone: 0300 123 9 123, or from outside the UK +44 20 7964 1000 E: complaint.info@financial-ombudsman.org.uk W: www.financial-ombudsman.org.uk Financial Ombudsman Service Exchange Tower London E14 9SR

You also have the option to register your complaint using the European Commission Online Dispute Resolution (ODR) platform. This is a web-based platform that is designed to help consumers who have bought goods or services online to deal with issues arising from their purchase.

Experian have a comprehensive Global Security Policy based on internationally recognised standards of security (known as ISO27001 standard) and holds ISO27001 certification in the key areas of Global Security Admin team who are responsible for administering logical access to systems and in the Data Centre.

Experian has a dedicated Cyber Security Investigations team who safeguard Experian’s key assets such as its systems and storage facilities. This team, identify and effectively manage any security developments that may threaten Experian's people, process, or technology through intervention and the thorough investigation of security incidents. Experian holds Cyber Essentials Certification and performs risk assessments against our critical and external facing applications annually.

Experian is annually audited by an External QSA (Qualified Security Assessor) from Trustwave and have successfully maintained compliance since 2010.