We will use your personal data to identify you, manage your experience and relationship with us as an Intermediary, link you to your mortgage club/network, to communicate with you and deal with your enquiries and applications. We will also use your personal data for crime and fraud prevention purposes, meet legal and regulatory requirements, protect you and your clients, provide security and colleague training.
When you register as an Intermediary, you will be taking the steps necessary to enter into a contract with us.
We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
More information about how we use this data is below:
Identity checks
In order to process your application, we are required by law to identify you and assess your suitability as an Intermediary. We do this by using automated systems provided by one or more credit reference agencies.
To do this, we will share your data with the credit reference agencies and they will give us data about you. This will include public data, for example, from the electoral register and other data, for example, from your credit applications about your financial situation, financial history, shared credit and specific fraud prevention data.
We will use this data to:
- identify you
- assess your suitability as an Intermediary
- prevent criminal activity, fraud and money laundering
- manage your relationships as an Intermediary
- trace and recover debts
We will continue to exchange data about you with credit reference agencies while you have a relationship with us.
The credit reference agency checks we carry out are a condition of the contract you take out when registering as an Intermediary.
Any documents requested or provided to help prove your identity may be checked with the issuing authority and/or anyone who has certified a copy.
The information we obtain from credit reference agencies is owned by them and limited to what is needed for our own purposes. We will tell you if your application is rejected because of information we have received from credit reference agencies but will not be able to provide any details. You will need to contact the credit reference agencies directly to request a full credit report if you require details of what they hold about you.
More details about which credit reference agencies we use, their role as fraud prevention agencies, what personal data they hold (including how they use and share it), their retention periods and your data protection rights with the credit reference agencies, are explained in more detail in the Credit Reference Agency Data Notice (CRAIN).
The CRAIN is accessible from each of the three credit reference agencies – Any of these three links will take you to the same CRAIN document: TransUnion, Equifax, Experian.
Fraud prevention
We will use and share your data with fraud prevention agencies to carry out checks for the prevention of fraud, money laundering and to verify your identity. We and fraud prevention agencies may also allow law enforcement agencies to access and use your data to detect, investigate and prevent crime. The fraud prevention checks we carry out are a condition of the contract you take out when registering as an Intermediary.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to register you as an Intermediary, or we may stop providing existing services and registration to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies. Fraud prevention agencies can hold your data for different periods of time. If you are considered to pose a fraud or money laundering risk your data can be held for up to six years.
Data held by credit reference and fraud prevention agencies can be accessed by other financial organisations, law enforcement and government agencies and may result in others refusing to provide services, finance or employment to you.
Crime prevention and public safety
We have a legitimate interest to prevent crime and contribute to public safety. Within our premises we have CCTV in operation. Footage may be reviewed by ourselves, or passed to police or law enforcement agencies upon request, following any incidents relating to the security and/or safety of individuals and to assist with any ongoing crime investigations.
Communicating with you
We will use any of the contact details we hold for you to communicate with you about the products and services you hold with us, contact you as requested and to send you information we are required to provide you with by law.
Marketing
We may use your information to provide details about our products, services, news and offers that we believe may be of interest to you and your clients. The communications sent to you will be based on a range of factors including what products you introduce to us, where you live, data received from third parties, for example, customer lifestyle information from external data agencies and other information gained about your behaviours and dealings with us.
We will only get in touch with these types of communication if you have given your consent to be contacted for marketing purposes, and only contact you by the methods you have agreed to, for example, post, telephone, email or text.
You can change your marketing consents at any time by logging into Skipton Intermediaries eMortgages and going to ‘My Account’, calling the Intermediary support line on 0345 601 6683.
Research, performance and customer relationship management
We have a legitimate interest to provide you and your clients with the best products, services and experience. To do this, we need to understand what your, your client’s and other customers’ needs and circumstances are, what you like about Skipton and any improvements you think could be made.
We use external agencies including research companies to help us gain such insights, carry out research, and obtain feedback about products, services and experiences. We will pass your contact details to the agencies so they can contact you. They will share the data they obtain from you with us, this can be at an individual level, at group level or anonymised. This supports a wide range of business decision making such as product development.
In addition, we use data for profiling and segmentation to create a broad understanding of our Intermediaries. This helps shape our communications, products and other activity. We also carry out behaviour and trend analysis, including the use of financial, behavioural and other models. In this way we can understand not only what is important to our Intermediaries now, but also predict future behaviours and needs. This includes looking at information we hold about you, or that we may have received from other sources, such as credit reference agencies.
Quality assurance and communication monitoring
We may sometimes access your data as part of our internal quality assurance processes, to ensure that you have received the best and correct outcome for your situation. These monitoring activities also allow us to carry out ongoing training with our colleagues.
We will record and monitor some of your contact with us, this includes telephone calls, email and, where you use Skipton Link, the verbal content of the meeting - we do not record or monitor visual content. This is to help us in our continuous attempts to improve customer service and to offer additional protection and security. We also retain information for evidential purposes and to meet legal and regulatory requirements. Telephone calls, Skipton Link and other electronic communications may also be monitored for reasons of staff training.
Sale of purchase of all or part of our business
If we sell or transfer all or part of our business, we may share or transfer Intermediary records and data as part of the proposed/actual sale or transfer. Before we do this we will ensure there is adequate protection in place by imposing contractual obligations on the buyer/seller to ensure the security and confidentiality of your data.
Improvement of our systems, security and integrity
We continually look to improve our systems, delivering change and new functionality. To ensure that these improvements are robust and suitable for use, we use customer data within our testing environments, this could include information relating to you as the Intermediary. We ensure that these activities are carried out in a secure and controlled environment.
Transfers outside the UK or EEA
If we need to transfer data outside the UK or European Economic Area (EEA) and the country it’s transferred to is not on an approved list for having adequate security controls in place, we will limit when we do this and the amount of personal data we send.
We have a subsidiary company called Jade Software Corporation Limited based in New Zealand, which provides us with systems and technical support. New Zealand is on a list of countries approved by The Information Commissioner’s Office as having adequate security controls in place.
We will ensure that there is adequate protection in place before sending anything to other countries outside the UK or EEA, including to the USA. When we use third party systems, application support and cloud based providers we will impose contractual obligations on the recipients and put additional supplementary controls in place to ensure the security and ensure controls are in place to protect the security and confidentiality of your data.
Whenever fraud prevention agencies transfer your personal data outside of the UK or European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.
Cookies
We may store data about you using cookies, (files which are sent by us to your computer or other device you use to access our website) which we can access when you visit our site in future. We do this to provide the online services you request, understand your needs, improve our website services and provide a better experience for you.
For full information relating to our use of cookies and similar technologies please read our Cookie Policy.
How long we keep your data
We have a Records Management and Retention Policy in place to determine how long personal data needs to be kept, which is based on our legal, regulatory and business requirements. How long we keep your personal data is based on your relationship with us, membership status and the types of accounts, products and services you have with us. When determining retention periods we consider the following:
- legal and regulatory guidance, case law and unexpected outcomes
- maximum or minimum retention periods identified by the law or our regulators
- ours and others' contractual rights and obligations
- your expectations
- current or future operational requirements
- the cost of maintaining, storing, archiving and retrieving the data
- forensic requirements, for example, the potential need to access data no longer actively used in order to manage or respond to complaints and disputes
- our policies and standards
- the risks involved in retention, deletion and removal
- the capability or restraints of our systems and technology.
In accordance with the payment card industry data security standard (PCI-DSS), we do not store cardholder data on our systems.
If we do not receive any applications from you for more than a year we will record you as inactive on our panel.
