Your right to privacy is very important to us. We take the security of your information seriously and have strict policies and processes in place to ensure it remains safe. This policy describes the way we collect information, how we use it and how we protect it. You can download a copy of our privacy policy here.
We’re The Nottingham, a group of companies that includes Nottingham Building Society and Beehive Money. The Nottingham is the controller for the personal information we use, unless otherwise stated. Wherever you see “we,” “us” or “our” it means The Nottingham.
This Privacy Notice tells you what to expect us to do with your personal information when you use our products or services. It also outlines the steps we take to ensure that your personal data is protected and describes the rights you have in relation to the data we use.
If you have any questions about this Notice, please don’t hesitate to contact our Data Protection Officer:
We obtain your information from a range of sources; some of it will come directly from you or someone else you’ve asked us to obtain information from. We might also get some of it from third parties and from publicly accessible sources. This might include:
If you do not provide information that we tell you is mandatory (that is, which you must provide), it may mean that we cannot provide you with the product or service you want or meet all our obligations to you. We sometimes ask for personal information that is useful, but not required by law or a contract. We will make this clear when we ask for it. You don’t have to give us these extra details, and it won't affect the products or services you have with us.
The security of your information is very important to us. We maintain physical, electronic, and procedural safeguards in relation to the collection, storage, and disclosure of personal data to prevent unauthorised access, accidental loss, disclosure, or destruction.
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on the reason we use your information:
You can withdraw your consent for us to use your personal information at any time (when our reason for using your personal information is that we have your consent). If you withdraw your consent, we may not be able to provide certain products or services to you. If this is so, we will tell you.
For more information about how to exercise your data protection rights, please contact us at datasubjectrights@thenottingham.com or on 0303 123 1113.
We work to high standards when it comes to using your personal information. If you have any queries or concerns, please contact us at:
If you remain dissatisfied, you can make a complaint to the Information Commissioner’s Office which regulates the use of personal data, by visiting ico.org.uk/make-a-complaint
We keep your information in line with our data retention and disposal policies. This enables us to meet our legal and regulatory obligations or use it where we need to for our legitimate purposes such as managing your account and dealing with any disputes or concerns that may arise.
If you would like more information on this, please feel free to contact us by using the contact details provided in this Notice.
We may share your information where it’s lawful to do so. This includes with:
When selecting our business partners, we take appropriate steps to make sure that they have adequate protection in place and that they follow data protection legislation.
There are times when we engage third parties which involves them using data on our behalf. We refer to these third parties as processors. When this happens, we ensure that this is done in a way that meets legal requirements and that there is a written contract in place so that both parties understand their responsibilities and liabilities.
Credit Reference Checks
If you apply for new products or services, we may carry out credit and identity checks on you with one or more of our trusted partner credit reference agencies (CRAs) and digital identity and screening providers. When you use our banking services, we may also make periodic searches to manage your account with us. To do this, we will supply your personal information to the trusted partners, and they will give us details about you. They will supply us with both public (including the electoral register) and shared credit information, financial situation, history, and fraud prevention information. We may use this information to:
Whilst you have a relationship with us, we will continue to exchange information about you with our trusted partners. We will also inform the CRAs about your repayment history. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs. When CRAs receive a search request from us they will place a marker on your credit file that may be seen by other lenders.
If you’re making a joint application or tell us that you have a spouse or financial associate, we’ll link your records together. You should discuss this with them and share this information with them before submitting the application.
The identities of the CRAs, digital identity and screening providers, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail on their websites.
Credit reference agencies
CRAs have created a joint document called the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs – going to any of these three links will take you to the same CRAIN document:
Identity Verification and Screening Providers
Our identity verification and screening partners are listed here. More information may be obtained from their websites:
Consequences of using information in this way
If we, or a fraud prevention agency, have reason to believe there’s a fraud or money laundering risk, we may refuse to provide the services and credit you’ve requested. We may also stop providing existing products and services to you. A record of any fraud or money laundering risk will be kept by the fraud prevention agencies. This may also be used to enhance fraud detection models and may also result in others refusing to provide services to you. The information we hold about you could make it easier or harder for you to get credit in the future.
Fraud prevention agencies
We’ll carry out checks with fraud prevention agencies for the purposes of preventing fraud and money laundering, and to confirm your identity before we provide products and services to you.
We, and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.
To find out more about our Fraud Prevention Agencies and how they manage your information, visit each agency directly:
Where we provide links to websites of other organisations, this Privacy Notice does not cover how that organisation processes personal information. We encourage you to read the Privacy Notices on the other websites you visit.
Automated processing means a decision-making process that is automated and excludes any human influence on the outcome. Examples include:
Credit and affordability assessments
We will consider a number of factors, including information about your income, your outgoings and how well you have kept up on payments in the past. This will be used to work out the amount we could lend you and you could comfortably afford to pay back.
Protecting you and your account against criminal or fraudulent activity
We will assess your transactions to identify any that are unusual. This may stop us from making a payment that is likely to be fraudulent.
Protecting us against criminal or fraudulent activity
We will assess a number of factors such as whether you have provided false information in the past, where you might be at the time and other information about your credit history to decide whether you are a fraud or financial-crime risk (for example, whether offering services to you may break or not be in line with our legal obligations). If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services you have requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing, or employment to you. If you have any questions about this, please contact us.
If we are carrying out solely automated decision-making that has legal or similarly significant effects on you, we can only carry out this type of decision-making where the decision is:
You have rights in relation to automated decision making (including profiling where this is part of an automated decision-making process) where the result will have legal or other significant effects on you. You have a right:
Profiling is any form of automated processing of personal data to evaluate certain personal aspects relating to a person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements. Reasons we might do this include:
We use marketing to let you know about products, services, and offers that you may want. This section tells you how we decide what marketing to show or send you. It also explains how we work out what you may be interested in.
We may use your personal information to make decisions about what products, services and offers we think you may be interested in. This is what we mean when we talk about ‘marketing.’
When we can use your personal information for marketing
We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest.’ That is when we have a business or commercial reason to use your personal information and it does not conflict unfairly with your own interests.
How we decide what marketing may interest you
The personal information we have for you is made up of what you tell us, and data we collect when you use our services, or from outside organisations we work with. We study this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. This is called profiling for marketing purposes.
You can contact us at any time and ask us to stop using your personal information this way.
How we send you marketing
We may show or send you marketing material online (on our own and other websites including social media), in our own and other apps, or by email, mobile phone, post or through smart devices and other digital channels.
You can also tell us not to collect data while you are using our websites or mobile apps. If you do, you may still see some marketing, but it may not be tailored to you. See our Cookies Policy for details about how we use this data to improve our websites and mobile apps.
Your marketing choices
You can tell us to stop sending you marketing at any time. Whatever you choose, we’ll still send you statements and other important information relating to your existing products and services.
We do not sell the personal information we have about you to outside organisations.
We may ask you to confirm or update your choices, if you take out any new products or services with us in future. We’ll also ask you to do this if there are changes in the law, regulation, or the structure of our business.
If you change your mind, you can contact us to update your choices at any time. Please see the ‘Your data privacy rights and how to exercise them’ section for more information.
This section sets out the legal reasons we rely on, for each of the ways we may use your personal information. The law says we must have one or more of these reasons:
When we have a business or commercial reason of our own to use your personal information, this is called a ‘legitimate interest’. We will tell you what that is, if we are going to rely on it as the reason for using your personal information. Even then, it must not unfairly go against your interests.
You have the right to object to use of your personal information in this way. You can do this by telling us anything that we may need to consider, to understand if our use of your personal information is fair. Please see the 'Your data protection rights and how to exercise them' section for more information.
The law and other regulations treat some types of information as special, for example, data concerning health. This personal information is called ‘special category data’. We will not collect or use these types of personal information without your consent unless the law allows us to do so. If we do, it will only be when it is necessary:
Here is a list of all the ways that we may use your personal information, and which of the reasons we rely on to do so. This is also where we tell you what our legitimate interests are where it is the reason for using your personal information. We may rely on different reasons for using the same personal information.
Your personal information may be transferred to or stored in locations outside of the UK. We will only transfer your data when:
When transferring information, we make sure that suitable protection is always maintained by ensuring appropriate safeguards are in place. This could be by:
You can get a copy of the appropriate safeguards by contacting our Data Protection Officer at: dpo.dpo@thenottingham.com or via our postal address. Please mark the envelope ‘Data Protection Officer.’
We keep this Notice under regular review and may change it from time to time. When we make changes, the date at the bottom of this Notice will be updated accordingly. Any modification or amendment to this Notice will be applied as of that revision date. We encourage you to check this from time to time for any updates or changes.
In some cases we may provide additional notice (like adding a banner/statement to our homepage, sending you a notification by e-mail or through signposting in our branches).
Last updated December 2023.
