How we safeguard and protect your data privacy

We also participate in the IAB Europe Transparency & Consent Framework and comply with its Specifications and Policies. Our identification number within the framework is 877.

This is to make sure that we don’t use personal data in a way that could cause harm to you. We require both suppliers and clients to use appropriate security measures to safeguard your information.

We do this through measures such as:

• tightly defining the format of any data sent to Experian, ensuring that only variables required for the processing are supplied by our data partners. Our internal processes will reject any data not supplied in the agreed format
• when data is transferred externally to clients, only the minimum amount of data is transferred for the task. This data is anonymised where personal data is not required for processing

We take a number of steps to ensure that your data is kept safe and secure, by applying strict safeguards when transferring your data overseas to third parties or Experian Group companies:

• Wherever possible, replacing your personal data such as your name, postal address and email address with a unique reference code that can only be identified by Experian.
• Using multiple layers of data encryption where appropriate.
• Storing your data in purpose-built data centres with multiple forms of physical security.
• Ensuring a high standard of legal protection when it comes to transferring your information overseas, equivalent to that in European Economic Area countries who have rigorous data protection laws. This might mean sending your information to countries approved by the European Commission as having high quality data protection laws, such as Switzerland, Canada and the Isle of Man, or a member organisation that's similarly approved. Or it might mean putting in place a contract with the recipient of your personal information that provides a suitable level of protection.

Sometimes we may need to keep your data to comply with our legal obligations, resolve any disputes, or enforce our rights. These reasons can differ based on the type of information and the service we're offering, so the amount of time we keep your personal data may vary.

In all cases, our need to store and use your personal information will be reassessed on a regular basis. Any information we no longer require is safely disposed of.

For more detail on the retention periods that apply to each category of personal data we might hold about you, click each of the sections below.

Postal Direct Marketing

Contact data obtained from data partners to enable Direct Marketing from our marketing database.

Our postal marketing database is rebuilt monthly to ensure that data held is up-to-date and as accurate as possible. The raw input contact data (names and postal addresses) from our data partners, which is provided to us monthly, is retained for 2 months for back-up purposes to allow for one full refresh of the product to be completed prior to deletion of the input data.

The monthly "built" marketing database file is retained and archived for 12 months to allow for the investigation of Data Subject queries. Contact data held within this live database may have been collected by the supplier 0-24 months previously.

Email Prospect Marketing

Email data obtained from data partners to enable us to create relevant marketing audiences for deployment via email.

Our email marketing database is rebuilt monthly to ensure that data held is up-to-date and as accurate as possible. The raw input contact data (names, postal address and email addresses) from our data partners, which is provided to us monthly, is retained for 2 months for back-up purposes to allow for one full refresh of the product to be completed prior to deletion of the input data. We only retain the live version of the built product.

Note: Experian do not provide lists of contact email addresses directly to third party organisations. The sending of the email, to communicate offers from relevant brands or organisations, is sent to a data subject directly by the organisation to whom they gave their consent to be contacted with email marketing offers.

Insights

Identities, models, segmentations for insight purposes.

Our attributes, propensities and segmentations are linked to the names and postal addresses of UK adults on our marketing database.

As above, the input data (names and postal addresses) is retained for 2 months for back up purposes, to allow for one full refresh of the product to be completed prior to deletion of the input data. The "built" marketing database file is retained and archived for 12 months to allow for the investigation of Data Subject queries.

Marketing Data Quality and Suppressions data

Any personal data supplied by 3rd parties for suppression purposes is supplied monthly and previous data is then deleted.

Our own 'built' marketing suppression files are retained for 2 months after each monthly build (the 'live' and previous version) before deletion.

Records added to our NMR (Non-Marketing Request) file, required to suppress data subjects from Experian processing their data for direct marketing purposes if requested, are kept indefinitely. This is to ensure that at any point in the future, Experian data relating to that data subject is not processed for directing marketing purposes (including any profiling that supports direct marketing).

Credit Marketing Suppressions

The raw input data is retained for 2 months for back up purposes, to allow for one full refresh of the product to be completed prior to deletion. Historical "built" suppression files are retained for a period of up to 6 years, aligned with the time period required for it to be held within Experian's Bureau Data, and for analysis purposes only by our clients to understand their retrospective risk profile to ensure responsible marketing of credit products.

Identification of Individuals

Identification data like names and addresses are kept while there's a continuing need to do so. This need is assessed on a regular basis, and data that's no longer needed for this purpose will be deleted. However, much of this data requires on-going retention as it helps to correctly identify unique individuals when we see them from our data suppliers or our clients, regardless of the presentation of names and addresses, and therefore enables us to keep your data accurate and up to date.

Identification data also supports 'linkage' to connect our marketing data to digital sources (unless a data subject objects to direct marketing in which case the record is deleted). This helps our clients in making sure the offers and services marketed to you are relevant and consistent across all marketing channels, providing you with a better overall experience.

Home shopping and direct retailer data pool

We run a home shopping and direct retailer data pool on behalf of the member organisations to help the group share general insight and trends that their customers share, so that they can provide you with a better experience. Our members share with us customer names and addresses and transactional data - spend value, date of the most recent purchase and the types of product built – to enable this service.

The raw input data sent to us by our members is retained for 12 months after receipt into Experian, after which it is automatically removed.

On a quarterly basis, we remove any records contributed from members who have not provided data into data pool in the last 12 months. As this process is conducted on a quarterly basis, data may reside in the database for up to 15 months

Experian do not change or delete information sent by the members of the data pool once it is within the pooled database. Historical transactional data is held, if supplied by the member, as this could provide insight on purchasing behaviour patterns. There is no limit on the recency of when the transaction within the member file has taken place if the member deems this transaction history is relevant to purchase activity of the individual (and is in line with their own data retention policy) as this could still be relevant in providing valuable insight if that history is continuous.

Digital advertising

Digital advertising and insights data obtained from publishers and advertisers.

Our digital advertising database containing first party digital IDs (typically cookie IDs) and IP address log is kept for a period of 180 days before being automatically deleted. Our daily full database process ensures records older than this time limit are removed.

Our Compliance team and our Product and Solutions Review Boards consider the impact of any use of personal data in our products and services before it takes place. This is so any potential negative impacts to you, can be identified and eliminated.

And we regularly run audits of all our marketing activities, giving us independent assurance that data protection and privacy principles are adhered to and that consumers are being treated fairly.

Finally, everyone at Experian must participate in regular data protection training.

We use full refreshes of data, checking the quality and accuracy of that data to ensure it is accurate and up to date, to make sure our clients aren't sending marketing communications to people who have opted out, have moved address, or to deceased individuals.

We constantly assess the analytical techniques we use to build our models and segmentations to ensure that the results are as accurate as possible.

Our digital advertising database is fully rebuilt on a daily basis and this ensures that any choice you may have around opting out is applied in a timely fashion.

We will continue to evolve the Portal in line with consumer, industry and regulator feedback to ensure on-going and enhanced future transparency.

Individuals can find out about how we handle personal data across our entire business by visiting our Data Privacy page. Through our extensive television, print and radio advertising campaigns Experian are trying to raise awareness of how we use data to create positive outcomes for individuals.