Norwich Trust Limited (NorT) – Privacy Policy

This Privacy Policy sets out what information Norwich Trust Limited will collect about you and how Norwich Trust Limited uses and protects any information that you give us (via this website or during any other transactions with us). Norwich Trust Limited may change its Privacy Policy wording from time to time by updating this page.
This policy was last updated 09.04.2024
By submitting your application to Norwich Trust Limited, you confirm you have read this Privacy Policy and the Norwich Trust Limited Terms of use and Cookie Policy.

Some concepts that are important to this privacy policy

The law restricts what can be done with personal information that relates to an identifiable living person. Commonly, such information is referred to as “personal data”, the person it relates to as the “data subject” and what is done with that information as “processing”. Providing that information to another person and storing that information are both examples of processing. A person who gets to say what personal data is collected and/or how personal data is processed is commonly referred to as a “controller” in respect of that personal data. A person who carries out processing under the direction of someone else is commonly referred to as a “processor” in respect of that personal data.

The main pieces of law that apply to us regarding the processing of personal data is the Data Protection Act 2018 (or the “DPA”) and the UK General Data Protection Regulation (or the “UK GDPR”).

All of the law that applies to us in respect of personal data is referred to in this privacy policy as the “data protection legislation”.

The company this privacy policy relates to

References in this privacy policy to “we”, “us”, “our”, “ours”, “company” and “NorT” are all to Norwich Trust Limited.

NorT will only process personal data in accordance with the applicable legislation.

References in this privacy policy to NorT, however referred to, include predecessors and successors to its rights and obligations in respect of:

loans;
applications for loans; and/or
its business or any part of its business.

About Norwich Trust Limited (NorT)

Norwich Trust Limited is a company registered in England and Wales under company number 12706211

Registered office: 25-27 Surrey Street, Norwich NR1 3NX

VAT number: 765353512

Authorised and regulated by the Financial Conduct Authority Reference (FCA) No. 979682

Registered with the UK Information Commissioner’s Office. Registration number: ZB346729.

About this privacy policy

We set out here how we process personal information that relates to would-be, current and past borrowers from NorT. We also explain how we process personal information that relates to other people who act on behalf of would-be, current and past borrowers.

Such a document is referred to often as a data protection policy or a privacy policy. We refer to it as our “privacy policy”.

If we process personal data in respect of you, then how and why we process it, and the people we may provide it to, largely depend on the nature of the relationship we have, or have had, with you at the relevant time.

In this privacy policy where we describe the personal data we may process, we explain the personal data that is involved and:

how we have obtained it;
the purpose of us processing it;
the lawful grounds on which we are relying when conducting that processing;
the other people to whom we may provide it;
our reason for providing it to those other people; and
how long we may retain it.

This privacy policy also sets out your principal rights in respect of personal data that we process where you are the data subject.

Who this privacy policy is relevant to

This privacy policy is relevant to you if:

you are a current, past or prospective borrower from us (“borrower”); or
You are a person (a “third party”) acting on behalf of a borrower, with their authority, such as a family member, carer, support worker or someone who has power of attorney (or similar authority) over a borrower’s financial affairs; or
You are a third party who has a relationship with a borrower and make payments on their behalf.

Such persons are referred to in this privacy policy by the terms “you”, “your” and “yours” except in those sections directed specifically at third parties.

Changes to this privacy policy

The most likely reasons that we may need to change this privacy policy are:

developments in our business, as innovations occur and/or we identify better ways of doing things that may be of benefit to us and/or to customers and/or other people that we deal with;
changes in the law and/or the interpretation that the Courts place on it;
certain decisions and directions of the Financial Ombudsman Service (FOS); and
changes in the requirements or guidance of regulators that relate to our business and/or your personal data.

For these, and other reasons, we may need to change this privacy policy from time to time.

We will not notify you of changes to this privacy policy, so we recommend that you check it from time to time. You can see here when this privacy policy was most recently updated.

Your questions about this privacy policy

If you have any questions regarding this privacy policy please contact our Data Protection Officer

Why we need to process your personal data

We cannot engage with you unless we process your personal data, but if you do not want us to process your personal data in accordance with this privacy policy you should not provide your personal data to us.

When you give us your personal data your rights in respect of it can be restricted, so, if you do not agree with the terms of this privacy policy:

do not apply for a loan from us; and
do not agree to act on behalf of a borrower, or make payments on their behalf.

Security of your data

NorT is committed to ensuring that your personal information is held securely.
We have put in place various controls and procedures to protect and keep secure the information we collect online or hold separately.
If you contact NorT, you will be asked a number of security questions before we will discuss your personal details or loan account with us.

Telephone calls

NorT records telephone calls for monitoring, staff training and compliance purposes.

Cookies

Please refer to our cookies page.

Data protection law

The data protection legislation:

says that a controller can only process personal data if it has a lawful reason for doing so;
sets out six lawful grounds for processing;
says that a controller must tell data subjects how it, and any processors acting on its behalf, will process their personal data; and
gives rights to data subjects in respect of their personal data.

Lawful grounds for processing

These are six lawful bases for processing of personal data. At least one of these must apply whenever we process your personal data.

We explain throughout this privacy policy the lawful basis on which we undertake the processing that we carry out on your personal data.

Although not all are relevant to us, the six bases are:

Consent

For this to apply, the data subject needs to have given clear consent for us to process their personal data for a specific purpose.

Contract

For this, the processing must be necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract with us.

Legal obligation

For this, the processing must be necessary to comply with the law (but not including contractual obligations).

Vital interests

For this, the processing must be necessary to protect someone’s life. We would only envisage this applying if were requested to provide information to a 999 service provider or government department.

Public task

For this, the processing must be necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We do not foresee this being relevant to us in respect of your personal information.

Legitimate interests

This can apply where the processing is necessary for our legitimate interests or the legitimate interests of someone else, unless there is a good reason to protect your personal data that overrides those legitimate interests.

How does Norwich Trust use your information?

Processing an application for a loan

What information do we collect from you/about you?

If you apply for a loan with us and a loan is not granted

Your name and date of birth
Your residential address and address history (including postcodes)
Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
Your residency status (whether or not you own your own home)
Identification documents (where we are unable to electronically verify your identity)
Details of your income (including details of benefits/secondary income)
Evidence of your income eg: payslips, accounts, pension/benefits statements
Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank accounts(s)
Information about you held by credit reference agencies and fraud prevention agencies
Contact information including telephone number(s) and email addresses
Nationality / right to reside
Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address (device location, device type etc)
Visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data
Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, and any other written correspondence

We do not request ‘sensitive’ information (i.e. sexual orientation, religion, race, political views) during the application process.
If sensitive information is provided to us, we will ask for your explicit consent prior to recording it.

Please see the Special Category Data section of this policy for more information.

If you apply for a loan with us and a loan is granted.

Your name and date of birth
Your residential address and address history (including postcodes)
Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
Your residency status (whether or not you own your own home)
Identification documents (where we are unable to electronically verify your identity)
Details of your income (including details of benefits/secondary income)
Evidence of your income eg: payslips, accounts, pension/benefits statements
Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank statement(s)
Contact information including telephone number(s) and email addresses
Nationality / right to reside
Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address (device location, device type etc)
Visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data
Information from credit reference agencies and fraud prevention agencies
Loan documents including the credit agreement
Details of the loan including the amount, term, contractual monthly payment and interest rate
Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, statutory notices and any other written correspondence

Please see the Special Category Data section of this policy for more information.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
Someone acting on your behalf (such as a broker)
A third party acting on your behalf (such as a support worker)
Your employer/accountant/pension provider (if you have one)
Your bank
Credit reference agencies
Fraud prevention agencies

How we will use the information we collect about you?

The information gathered is used for the following reasons:

To process your application
To carry out credit searches and checks with fraud prevention agencies
To carry out searches of other public registers such as the electoral register, the land registry and insolvency registers
To assess your credit profile
To keep your broker (if any) informed about the progress of your loan application
To electronically verify your identity, income & bank account
Anti-fraud measures
To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
To record and respond to complaints
To improve our products and services
To conduct statistical analysis, research and behavioural analysis
To improve this website
To manage what information, if any, is sent to you about our products and services

Legal basis for processing personal data

When we process your personal data, including conducting credit searches, we do so on the following legal bases:

Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators.
Legitimate interest - because we must do so to progress the loan enquiry, with a view to entering into the loan contract.

If you are uncomfortable with us processing your data, please do not proceed.

Who will we share your information with?

During the application process we may pass some of your information to the following third parties:

Our SMS and e-mail providers – to keep you updated about the progress of the application
Your broker (if any) - to keep them updated about the progress of the application
Credit reference agencies (CRAs) – we will submit your information to CRAs in order to obtain credit searches to assist with our lending decision

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy

Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – we will request details of any information held about you by fraud prevention agencies in order to assist with our lending decision. If we suspect that false information has been provided, or if fraud, money laundering or any other criminal offence is suspected we may provide information to fraud prevention agencies or other relevant authorities.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

If the application does not proceed and we have not completed any credit searches

We will keep your information for a maximum of 6 months from the date of the application, unless we have an overriding obligation to retain your details for longer.

If the application does not proceed and we have completed credit searches

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer.

If the application proceeds and we pay out a loan

Proof of identification and proof of address

We will keep this information for 5 years after the date on which your relationship with NorT ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All other information referred to under the heading “Information collected/held” above

We will keep this information for 6 years after the date on which your relationship with NorT ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Contacting you about your loan

What information do we collect from you/about you?

Your name and date of birth
Your residential address and address history (including postcodes)
Contact information including telephone number(s) and email addresses
Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, statutory notices and any other written correspondence

We may, during the course of our dealings with you, discuss sensitive information relating to your personal circumstances. If sensitive information is provided to us, we will ask for your explicit consent prior to recording it.

Please see the Special Category Data section of this policy for more information.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
Someone acting on your behalf (such as a broker)
A third party acting on your behalf (such as a support worker)
Tracing agents

How we will use the information we collect about you?

The information gathered is used for the following reasons:

To update you about any changes or important information relating to the loan account
To remind you that a payment is due or to let you know about missed payments
To administer and manage the loan account
Anti-fraud measures
To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
To record and respond to complaints
To conduct statistical analysis, research and behavioural analysis

Legal basis for processing personal data

When we process your personal data, we do so on the following legal bases:

Legitimate interest - because we must do so to administer the loan contract.
Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators.

Who will we share your information with?

When we need to contact you, sometimes we use external processors to send communications to you.

To do this, we will share the following information about you with our communications providers:

Your name
Your address
Your mobile phone number
Your e-mail address
Information about the status of the loan such as the balance, payment due dates, payment amounts, the date and amount of any late payment(s) and the amount of arrears

The third parties we may pass your information to for this purpose are:

Commify UK Limited (trading as TextAnywhere) – if we send you text messages
Spotler Limited (trading as Pure 360) – if we send you automated e-mails
Precision Marketing Group Limited – if we send you automated letters

NorT may also share your information with the following third parties:

Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

We will keep your information for 6 years after the date on which your relationship with NorT ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

Credit searches

When we conduct a credit search against you, you may be treated as financially linked and your application will be assessed with reference to any “associated” credit records (joint accounts/loans/credit).

From time to time NorT may also perform credit searches after the loan has paid out in order to enable the ongoing administration and management of the loan.

What information do we collect from you/about you?

In order to conduct credit searches, we will obtain the following information from you:

Your name and date of birth
Your residential address and address history (including postcodes)

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
Someone acting on your behalf (such as a broker)
A third party acting on your behalf (such as a support worker)
Tracing agents

What information will we obtain about you from the Credit reference Agencies?

Information about your financial situation and financial history, including details of your current outstanding debts and repayment profiles
Information to confirm your identity (by way of electronic identity verification)
Public information (including the Electoral Register)
Shared credit, financial situation and financial history information
Fraud prevention information.

How we will use the information we collect about you?

We will use this information to:

Assess your creditworthiness
Assess whether you can afford the loan repayments
Verify the accuracy of the data you have provided to us
Prevent criminal activity, fraud and money laundering
Manage the loan account
Trace and recover debts
Ensure any offers provided to you are appropriate to your circumstances.

Legal basis for processing personal data

When we process your personal data to conduct credit searches, we do so on the following legal bases:

Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators
Legitimate interest – because we must do so to progress the loan enquiry, with a view to entering into the loan contract and to enable the administration and management of the loan once paid out.

Who will we share your information with?

Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Credit Reference Agencies (CRAs)

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs by clicking any of the links below.

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy

How long will we keep your information?

If the loan application does not proceed

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer.

If the application proceeds and we pay out a loan

Proof of identification and proof of address

All other information referred to under the heading “Information collected/held” above

Reporting to Credit Reference Agencies (CRAs)

During the life of the loan, NorT will submit details of your account to the CRAs.

What information do we collect about you/your loan?

Throughout the life of the loan, NorT will hold details of your loan account including:

Your name
Your current residential address
Your date of birth
The amount you borrowed
The date the loan was arranged
The term of the loan
The contractual monthly repayment
The balance
The conduct of your account i.e. whether repayments are made
Any arrangements which have been recorded on your account
Any defaults which have been recorded on your account
Whether your loan has been included as part of any Debt Management Plan
The date your loan was settled

Where do we get your information from?

Our own databases
Third party debt advisors/Debt Management Companies

How we will use the information we collect about you?

NorT will provide the information listed in the section “what information do we collect about you/your loan” to the CRAs on a monthly basis until your loan is settled.

This information helps create your credit report and may be viewed by other organisations or supplied to other organisations by the CRAs if you apply for credit in the future or where a credit search is carried out for another reason, for example by an employer.

Lenders and other organisations may base lending and other decisions on information held about you by the CRAs.

Legal basis for processing personal data

When we process your personal data to report to the CRAs, we do so on the following legal basis:

Legitimate interest – because, as a responsible lender, we consider we have a duty to report information about the conduct of your loan so that other lenders and service providers can make informed decisions about whether to lend to you or provide services to you in the future, to prevent over-commitment, bad debt, fraud and money laundering and to support debt recovery and debtor tracing, and to aid responsible lending.

Who will we share your information with?

Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Credit Reference Agencies (CRAs)

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

How long will we keep your information?

The information recorded by the CRAs will typically remain on your credit file for a period of six years.

Processing payments

When you make payments to a loan with NorT, we will need to process certain items of your personal data in order to process those payments.

What information do we collect from you/about you?

The information we will collect from you in order to process payments to NorT are:

Your name
Your current residential address
The contractual monthly repayment
The amount that you owe and any arrears balance
Your bank details
Your payment card details

Where do we get your information from?

You
Any third party acting on your behalf
Our own databases

How we will use the information we collect about you?

We will use this information to:

Process any payments made to NorT in respect of a loan

Legal basis for processing personal data

When we process your information for the purposes of collecting/taking payments, we do so on the following legal basis:

Legitimate interest – because we must do so in order to administer the loan contract.

Who will we share your information with?

We use third party companies to host some of our systems in respect of the administration of loan accounts and to facilitate payments.

These companies do not act as data processors but we do use the systems and platforms they provide to host information to enable us to administer loan accounts and to process payments. Although these companies have access to the information held on those systems due to their role as system hosts, they are not permitted to use the information for their own purposes.

The third party companies whose systems we use are:

Anchor computer systems Limited (trading as Aryza)– the system we use to manage and administer loan accounts
National Westminster Bank Plc (Natwest Bankline) - the system we use to administer payments that we make and that people make to us
National Westminster Bank Plc (Natwest Autopay) - the system we use to administer direct debt payments
National Westminster Bank Plc (Natwest Payment Services) - the system we use to administer bounced direct debt payments
Elavon Financial Services DAC (Trading as Opayo) - the system we use to enable payments via our customer portal
Lloyds Bank Plc (Trading as Lloyds Cardnet) - the system we use to process card payments
Acquired Limited - a system we use to process card payments
Key IVR Limited - the system we use to process automated telephone payments

How long will we keep your information?

We will never keep your full payment card details.

Tracing and enforcement action

If we are unable to contact you for an extended period of time, or we have reason to believe that the contact information we hold for you may be inaccurate, we may take steps to trace up to date contact information for you. If we are considering an attachment of earnings order, we may also take steps to trace your employment information.

If the loan falls into arrears and we have been unsuccessful in our attempts to contact you, or are not able to negotiate a payment arrangement with you, it may be necessary for us to commence legal proceedings against you to recover any sums owed. We refer to this as enforcement action.

This may include issuing legal proceedings and obtaining a County Court Judgment (CCJ), making an application for an attachment of earnings or making an application for a charging order.

What information do we collect from you/about you?

Throughout the life of the loan, NorT will hold details of your loan account including:

Your name
Your current/last known address and any previous residential addresses
Your date of birth
Your telephone number(s)
Your e-mail address
Your last known employment
The amount you borrowed
The date the loan was arranged
The term of the loan
The contractual monthly repayment
The amount that you owe
The conduct of your account i.e. whether repayments are made
Copies of your signed credit agreement
Correspondence between you and Norwich Trust including letters, e-mails, text messages and telephone calls
Details of any property which you own

Where do we get your information from?

You
Any third party acting on your behalf
Our own databases
The land registry

How we will use the information we collect about you?

We will use this information to:

Trace and recover debts

Legal basis for processing personal data

When we process your personal date to trace your information and take enforcement action, we do so on the following legal basis:

Legitimate interest – Because we must do so in order to enforce the terms of your agreement with NorT.

Who will we share your information with?

If we take steps to trace your contact or employment information, or take enforcement action in relation to the loan, we will share your information with:

Tracing Agents – if we need to trace your contact or employment information

The tracing agents NorT may share your details with are:

Hunter Tracing Services (UK) Limited

The Courts – if we take enforcement action against you

The courts we may share your information with are:

The County Court Money Claim Centre

The County Courts in England and Wales

The Sheriff Courts in Scotland

Solicitors – if we take enforcement action against you

The solicitors we may share your information with are:

HCR Legal LLP (if you live in England or Wales)

Yuill & Kyle Limited (if you live in Scotland)

The courts may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with them or our solicitors in connection with any legal proceedings.

How long will we keep your information?

Complaint handling

From time to time you may have cause for complaint about an aspect of the service you have received from NorT, and ask us to investigate your concerns.

What information do we collect from you/about you?

Throughout the life of the loan, NorT will hold details of your loan account including:

Your name
Your current/last known address and any previous residential addresses
Your date of birth
Your telephone number(s)
Your e-mail address
Your last known employment
The amount you borrowed
The date the loan was arranged
The term of the loan
The contractual monthly repayment
The amount that you owe
The conduct of your account i.e. whether repayments are made
Details of your credit history
Copies of your signed credit agreement
Correspondence between you and Norwich Trust including letters, e-mails, text messages and telephone calls
Details of any property which you own
Details of any complaints you have made or are making

Where do we get your information from?

You
Any third party acting on your behalf
Our own databases
Tracing agents
Credit Reference Agencies (CRAs)
The land registry

How we will use the information we collect about you?

We will use this information to:

Investigate your concerns and provide a response setting out our findings
Calculate any sum of redress which may be due to you
Deal with the escalation of any complaint which cannot be resolved directly between you and NorT

Legal basis for processing personal data

When we process your information for the purposes of complaint handling, we do so on the following legal basis:

Legal obligation – in order to comply with our legal obligations under the Financial Conduct Authority’s dispute resolution regulations (DISP).

Who will we share your information with?

As part of our complaint handling process we many share the information above with:

A third party nominated to act on your behalf – for example a Claims Management Company or Solicitor who you have instructed to pursue a complaint on your behalf
The Financial Ombudsman Service (FOS) – if you are unhappy with the outcome of a complaint and have escalated the matter to FOS to review

For more information on our complaints process and the role of the Financial Ombudsman Service, please refer to the Complaints section of this policy.

How long will we keep your information?

Auditing

From time to time, our funders will ask an independent external company to review some of our loan accounts.

We are also obliged to provide information to external companies to audit our finance/accounts processes which may involve the disclosure of personal information.

What information do we collect from you/about you?

Your name, address and date of birth
Your contact information (telephone numbers and e-mail address)
Any information provided to us by you or by third parties during the loan application
Any information provided to us by you or by third parties after the loan was paid out
Any correspondence between you and NorT during your relationship with us, including letters, e-mails, text messages and telephone call recordings
Loan performance information including current balance, payment history and current status/arrears balance
Bank details

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
Someone acting on your behalf (such as a broker)
Any third party acting on your behalf
Our own databases

How we will use the information we collect about you?

The information we collect about you will be used to ensure we are complying with all relevant rules, regulations and policies, and to ensure we are lending responsibly.

The information will also be used to ensure our finance/accounts processes are accurate, adequate and comply with relevant regulation and legislation.

Legal basis for processing personal data

When we process your personal data for the purposes of auditing, we do so on the following legal basis:

Legal obligation - to comply with rules imposed on us by our regulators
Legitimate interest – to enable us to provide funding for our loans

Who will we share your information with?

The third party auditors we may pass your information to for these purposes are:

Lovewell Blake Accountancy Services Limited– for audits of our finance and accounting processes

T.Mistry & Associates Limited (TMA) – for audits of our account management systems, responsible lending, treating customers fairly, compliance with our internal policies and procedures, and regulatory compliance

These companies do not act as data processors.

How long will we keep your information?

Special Category Data

The UK GDPR singles out some types of personal data as likely to be more sensitive, and gives them extra protection:

personal data revealing racial or ethnic origin;
personal data revealing political opinions;

personal data revealing religious or philosophical beliefs;

personal data revealing trade union membership;
genetic data;
biometric data (where used for identification purposes);
data concerning health;
data concerning a person’s sex life; and
data concerning a person’s sexual orientation

What information do we collect from you/about you?

We do not request ‘sensitive’ information during the application process, however during the course of your relationship with NorT there may be situations in which you provide us with information, or we ask you for information, concerning your health if, for example, it has given rise to a change in your circumstances and is affecting your ability to manage your loan repayments.

This information is classed as Special Category Data and as such we will only record and use this information with your explicit consent.

NorT will never ask you for any other form of Special Category Data.

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
A medical professional or other third party who you have authorised to provide us with information on your behalf

How we will use the information we collect about you?

The information gathered is used for the following reasons:

To administer the loan and manage the account including offering appropriate forbearance options

Legal basis for processing personal data

When we process your personal data, we do so on the following legal basis:

Consent – In order to comply with our obligations under the UK GDPR, we will ask you for your explicit consent to record and process any information which could be considered Special Category Data

Who will we share your information with?

We will never pass any Special Category Data to any third party without your explicit consent unless we are compelled to do so by law.

How long will we keep your information?

Third parties

If you are a person acting on behalf of a borrower, or making payments to a loan on behalf of a borrower we will process certain information about you.

What information do we collect/hold about you?

Your name and date of birth
Your residential address (including postcode)
Your relationship to the person on behalf of whom you are acting
Your status as a third party i.e. whether:
- you have the borrower’s authority to discuss their details, including details of the application or the loan account; and/or
- you have the borrower’s authority to act on their behalf in managing the application or the loan account; or
- you are not authorised by the borrower to do either of the above things, but can make payments on their behalf
Evidence of any formal authority to act on behalf of the borrower eg: power of attorney, grant of probate or similar
Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, and any written correspondence

Where do we get your information from?

We may obtain your information from one or more of the following sources:

You
The borrower

How we will use the information we collect about you?

The information gathered is used for the following reasons:

To administer the loan and manage the account
Anti-fraud measures
To respond to requests from bodies such as police, national crime agency, department for work and pensions etc.
To record and respond to complaints

Legal basis for processing personal data

When we process your personal data, we do so on the following legal bases:

Legal obligation - to comply with Money Laundering Regulations, The Proceeds of Crime Act 2002 and other rules imposed on us by our regulators
Legitimate interest – because we must do so to enable the administration and management of both the loan account and our ongoing relationship with the borrower.

If you are uncomfortable with us processing your data, you should not agree to act in any third party capacity, including making payments, for the borrower.

Who will we share your information with?

We may pass some of your information to the following third parties:

The borrower – if you act on behalf of a borrower, we will share information with them regarding any dealings you have with us in respect of the loan.
Fraud prevention agencies (such as Cifas) or other relevant authorities such as the police, national crime agency and the department for work and pensions – if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is suspected

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

How long will we keep your information?

Who will Norwich Trust share your data with?

NorT use third party data processers who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisations apart from us. They will hold it securely and retain it for the period we instruct.

In some circumstances we are legally obliged to share information, for example under a court order. We might also share information with regulatory bodies. In any scenario, we will satisfy ourselves we have a lawful basis on which to share the information.

Below we set out details of any third parties we may share your information with, what information we will share with them and the reasons why we may do so.

Information sharing with fraud prevention agencies

To help prevent fraud, NorT will share personal information about you with fraud prevention agencies. This is used to prevent money laundering and fraud, and to verify your identity. If fraudulent activity is detected, NorT will submit details to Fraud Prevention Agencies and you could be refused certain services, finance or employment.

We may also share information with other appropriate organisations or third parties if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is identified.

The information we share may vary, depending on individual circumstances, and may include any information about you which has been provided to us by you, or that we have received from third parties.

The organisations we may share information with are:

Cifas
Iovation Limited
Action Fraud Limited
HMRC
The Police
The National Crime Agency
The Department for Work and Pensions

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Information sharing with credit reference agencies

If a loan is granted NorT will share information about the account with the CRAs.

We share information with CRAs in accordance with the principles of reciprocity. The purpose of sharing this information is to prevent over-commitment, bad debt, fraud and money laundering and to support debt recovery and debtor tracing, and to aid responsible lending.

From time to time, NorT might also share loan performance data (whether you have paid) with the credit reference agencies, for the purposes of data analysis / development of new products / scorecards.

We will share the following information with the CRAs:

Loan start date
Loan amount
Loan term
Monthly payment
Current balance
Current status (whether payments are up to date/level of arrears and any arrangement or default which has been recorded)
Payment history (whether previous payments have been made on time/whether any arrears have occurred)
The date a default was registered (if applicable)
The balance of the account at the point a default was registered (if applicable)
The date the account was settled (if applicable)

The CRAs which NorT will share account information with are:

Equifax Limited

Experian Limited

TransUnion International UK Limited

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

Information sharing with your intermediary / broker (if applicable)

If you have been introduced to us via a third party, for example a credit broker or price comparison website, we may disclose information concerning the progress of your application to them. We will confirm whether you have been successful in obtaining a loan and the size of the loan taken out.

The broker will not be informed about the performance of the loan but we will tell them if the loan is repaid within any cooling off period.

The brokers NorT works with can be found in the list below. We will only share details with the broker/intermediary who introduced you to us.

Accepty Technology Limited
Access Money (Group) Limited
Badger Loans Limited
Believe Money Group Limited
Bright Star Financial Limited
Car Loan Warehouse Limited (Pegasus Finance)
CC Financial Solutions (trading as Lendle)
Central Trust Limited
Choose Wisely Limited
Citymoor Financial Limited
Cobain Digital Limited
Connect IFA Limited
Creative Funding Solutions Limited
Diligent Mortgage Services Limited
Dragon Mortgages Limited
Easi Route Limited
Exclusive Connections Limited (trading as Brilliant Solutions)
Finspace Group Limited
Fluent Money Limited
Freedom Finance Limited
F&I Online Limited (Carplus)
Joel Malach (trading as 1^st Loan)
Leadtree Global Limited
Legalwebb Limited
Lending Expert Limited
Loan Machine Limited (Leadaffinity)
Loan.co.uk Limited
Media Blanket Limited
Monarch Financial Services Limited
Monevo Limited
My Secured Loan Limited (trading as Loanable)
Norton Finance & Mortgages Limited
Optimise Finance Limited
Ramsay Lomax Limited
Simple Financial Planning Limited
Simply Lending Solutions Limited
Springhill Finance Limited
Stop Go Networks Limited
T Dot UK Limited
The Loans Engine (Central Loans Limited)
The Loan Partnership Limited
The Mortgage People (Cardiff) Limited
Tiger Lion Financial Limited (Loantube)
Twibli Limited
UK Credit Limited
Wembley Mortgage Centre
Willows Finance Limited

Information sharing with tracing agents

If we have been unsuccessfully able to contact you where the account is in arrears, or we have received returned mail and have been unable to contact you, we may share your details with tracing agents in order to verify your address.

We may also share your details with tracing agents where the account is in arrears and an attachment of earning orders is being considered due to non-payment, to verify your employment details.

We will share the following information about you with our tracing agents:

Your name
Your last known address and any known previous addresses
Your date of birth
Your telephone number(s)
Your last known employment

The tracing agents NorT may share your details with are:

Hunter Tracing Services.

Information sharing with the courts

This may include issuing legal proceedings and obtaining a County Court Judgment (CCJ), making an application for an attachment of earnings or making an application for a charging order.

To do this, we will share the following information about you with the courts:

Your name
Your address
The amount you owe
Details of the loan at the time it was arranged
Copies of your signed credit agreement
Copies of letters sent you about arrears eg: default notice and termination notice
Details of the status of your account and payment history including a statement of account
Details of your employer
Details of any property which you own including land registry documents

The court may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them in connection with any legal proceedings.

The courts we may share your information with are:

The County Court Money Claim Centre

The County Courts in England and Wales

The Sheriff Courts in Scotland

Information sharing with solicitors

Where it has been necessary to commence legal action against you to recover the sums owed, we may, in some circumstances, need to instruct solicitors to act on our behalf, where NorT is not able to conduct the legal action directly, or in the case of a defended claim, or claims of a complex nature.

To do this, we will share the following information about you with our solicitors:

Your name
Your address
The amount you owe
Details of the loan at the time it was arranged
Copies of your signed credit agreements
Copies of letters sent you about arrears eg: default notice and termination notice
Details of the status of your account and payment history including statements of account
Copies of any correspondence between you and NorT which is relevant to the legal action in question. This may include letters, e-mails, text messages and recordings of telephone calls
Details of your employer
Details of any property which you own including land registry documents

The court may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with our solicitors in connection with any legal proceedings.

The solicitors we may share your information with are:

HCR Legal LLP (if you live in England or Wales)

Yuill & Kyle Limited (if you live in Scotland)

Information sharing with the Financial Ombudsman Service (FOS)

If you make a complaint about NorT and are not satisfied with our response, you are usually entitled to refer your complaint to the FOS.

In order to investigate your complaint, the FOS will ask us to provide them with some of the information we hold about you. The information will vary depending on your complaint, but could include any of the personal information we hold about you.

As long as you have provided your consent to the FOS to investigate your complaint, we will provide them with the information that they ask for, unless we believe there is an overriding reason not to.

Information sharing with SMS providers, e-mail providers and mailing houses

From time to time we may need to contact you, for example to update you on the progress of a loan application, to remind you that a payment is due or to let you know about missed payments. Sometimes we use external processors to send these communications.

To do this, we will share the following information about you with our communications providers:

Your name
Your address
Your mobile phone number
Your e-mail address
Information about the status of an application
Information about the status of the loan such as the balance, payment due dates, payment amounts, the date and amount of any late payment(s) and the amount of arrears

The third parties we may pass your information to for this purpose are:

Commify UK Limited (trading as TextAnywhere) – if we send you text messages

Spotler Limited (trading as Pure 360) – if we send you automated e-mails

Precision Marketing Group Limited – if we send you automated letters

Information sharing with auditors

We are obliged to provide information to external companies to audit our finance/accounts processes which may involve the disclosure of personal information.

Our funders may also periodically ask an independent external company to review some of our loan accounts, which may involve the disclosure of personal information.

These companies do not act as data processors.

We may share the following information about you with our auditors:

Your name, address and date of birth
Your contact information (telephone numbers and e-mail address)
Any information provided to us by you or by third parties during the loan application
Any information provided to us by you or by third parties after the loan was paid out
Any correspondence between you and NorT during your relationship with us, including letters, e-mails, text messages and telephone call recordings
Loan performance information including current balance, payment history and current status/arrears balance
Bank details

The third party auditors we may pass your information to for these purposes are:

Lovewell Blake Accountancy Services Limited – for audits of our finance and accounting processes

T. Mistry & Associates Limited (TMA)– for audits of our account management systems, responsible lending, treating customers fairly, compliance with our internal policies and procedures, and regulatory compliance

Third party systems providers

We use third party companies to host some of our systems in respect of the administration of loan accounts and to facilitate payments.

The third party companies whose systems we use are:

Anchor Computer Systems Limited (trading as Aryza) – the system we use to manage and administer loan accounts

National Westminster Bank Plc (Natwest Bankline) - the system we use to administer payments that we make and that people make to us

National Westminster Bank Plc (Natwest Autopay) – the system we use to administer direct debit payments

National Westminster Bank Plc (Natwest Payment Services) – the system we use to administer bounced direct debit payments

Elavon Financial Services DAC (trading as Opayo) – the system we use to enable payments via our customer portal

Lloyds Bank Plc (trading as Lloyds Cardnet) – a the system we use to process card payments

Acquired Limited – a system we use to process card payments

Key IVR Limited – the system we use to process automated telephone payments

Third party electronic communications providers

We use third party companies to host some of our electronic communication channels.

These companies do not act as data processors but we do use the platforms they provide to enable us to provide and maintain some of our communications.

The third party companies whose systems we use are:

Mimecast Services Limited– the system we use to protect e-mail traffic and to monitor any e-mails sent to us, including file attachments, for viruses or malicious software

Sharing your data outside of the European Economic Area (EEA)

Your data may be transferred to a destination outside the European Economic Area (EEA). It may also be processed by companies operating outside the EEA who work for us or introduce business to us. If your personal information is transferred outside the European Economic Area (EEA) for processing or storage purposes we will ensure that safeguards are in place to protect it to at least the standard applied within the EEA.

Credit searches and Credit Reporting

In order to process any application for a loan, NorT will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information about your financial situation and financial history including details of your current outstanding debts and repayment profiles. CRAs will also supply us with information to confirm your identity (by way of electronic identity verification) and both public information (including the Electoral Register) and shared credit, financial situation and financial history information, and fraud prevention information.
When we conduct a credit search against you, you may be treated as financially linked and your application will be assessed with reference to any “associated” credit records (joint accounts/loans/credit).

We will use this information to:

Assess your creditworthiness
Verify the accuracy of the data you have provided to us
Prevent criminal activity, fraud and money laundering
Manage the loan account
Trace and recover debts
Ensure any offers provided to you are appropriate to your circumstances.

Credit searches and credit reporting

When you first apply

When you enquire, our initial credit search, which is used to generate your loan quote, is a ‘soft’ search (often referred to as an enquiry search) and does not leave a footprint on your credit file. The CRAs will record details of the search whether or not the application proceeds, however the search should not impact upon your credit rating and cannot be seen by other people making searches in the future.

When the loan is granted

If you decide to proceed with the loan and funds are released, a ‘hard search’ (often referred to as an application search) will be carried out against you. This hard search will be recorded by the CRAs and may be seen by other people searching in the future. This is a requirement of the CRAs and common practice across the finance industry.

After the loan is granted

During the life of the loan, NorT will submit details of your account status including the balance and whether repayments are made as well as any arrangements or defaults which have been recorded on your account to the CRAs. We will also inform the CRAs about your settled accounts. This information may be supplied to other organisations by CRAs.

The information recorded by the CRAs will typically remain on your credit file for a period of six years.

If you obtain a loan with us we may, during the life of the loan, make periodic searches at Credit Reference Agencies and Fraud Prevention Agencies so that we can manage your account with us. These additional searches are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

After the loan is settled

After the loan is settled we will not usually conduct any further credit searches unless it is necessary for us to do so, for example in order for us to investigate a complaint you have raised. Any additional searches it is necessary for us to carry out are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

Anti-fraud measures

General

Before we grant a loan, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.
The personal data you have provided, we have collected from you, or we have received from third parties will be will be used to prevent fraud and money laundering, and to verify your identity.
The personal information which will be processed to perform these checks is:

Your name
Your address
Your date of birth
Your contact details (telephone numbers and e-mail address)
Financial information
Employment details
Device identifiers including IP address

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Automated decisions

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if:

our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers; or is inconsistent with your previous submissions; or
you appear to have deliberately hidden your true identity.

You have rights in relation to automated decision making. For more information, please refer to the Your data protection rights section of this policy
We use services provided by a third-party organisation, iovation Inc, for the purposes of fraud prevention and account authentication purposes. iovation are based in the US. Their third-party services help us decide whether to accept transactions from electronic devices by analysing device attributes and checking whether they have been associated with fraudulent or abusive transactions in the past. The service also helps verify your identity by registering and remembering devices associated with your account. We also report to iovation if we conclude that a device has been used in connection with a fraudulent or abusive transaction with us. iovation may track your activity over a network of different sites that subscribe to their services. Please see www.iovation.com and their privacy policy for more information about this service.

Consequences of processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services, goods or financing you have requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us.

Data transfers

Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

Your data protection rights

Under data protection law, you have certain rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

We may process and store information about you electronically and/or in manual records. You have the right to ask us for copies of your personal information, often referred to as a Data Subject Access Request (DSAR). This right always applies.

If you would like to make a Data Subject Access Request, please contact us.

There is no charge for submitting a DSAR, however in order to ensure the security of your personal information, we will ask you to provide certain personal details to verify you are who you say you are, before we action your request and release your personal information.
Upon receipt of a DSAR, NorT has a maximum of 1 month to respond.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

NorT will correct any information we hold about you if you are able to evidence that the information we hold is inaccurate or incomplete.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

NorT will delete your personal information, at your request, unless we have a legal obligation or legitimate interest to hold or process your data. For instance; the ongoing administration/management of a live loan, reporting to credit reference agencies the conduct of the loan account, recording and retaining information relating to complaints, retaining information for the purposes of Anti Money Laundering, retaining information for the purposes of responding to law enforcement agencies / government agencies.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

You can ask us to temporarily limit the use of your data when you have made a challenge to the accuracy of your data, or an objection to the use of your data.

You can also ask us to limit the use of your data rather than delete it if you believe your data has been processed unlawfully but you do not want it deleted, or we no longer need your data but you want us to keep it in order to create, exercise or defend legal claims.

Your right to object to processing

You have the right to object to NorT processing your information based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling). You also have the right to object to direct marketing (including profiling) and processing for purposes of scientific/historical research and statistics.

NorT may not agree to stop processing your information where we can evidence that we have legitimate reasons to continue using your information.

Your rights in relation to automated decision making including profiling

NorT does not operate a fully automated decision making process in respect to the granting of a loan, however it does reject applications based upon an automated basic eligibility checks.

If an application has been declined based on our automated eligibility checks, you can ask us to manually review the decision.

If you would like to exercise any of your data protection rights please, please contact us.

You can find more information about your individual rights on the Information Commissioner’s Office website.

If you are unhappy about how your personal data has been used, please refer to our complaints policy.
You also have a right to complain to the Information Commissioner’s Office which regulates the processing of personal data: https://ico.org.uk/concerns/

How long will Norwich Trust keep your personal data?

If you make an application for a loan but the application does not proceed

Where we have not completed credit searches

We will keep your information for a maximum of 6 months from the date of the application, unless we have an overriding obligation to retain your details for longer.

Where we have completed credit searches

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer

If you make an application for a loan and a loan is granted

Proof of identification and proof of address

All other personal information

Complaints data

We will keep information relating to any complaint(s) you have made for 6 years after the date on which your relationship with NorT ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All telephone call recordings

We will keep call recordings for a maximum period of fifteen years from the date of the call.

Emails

We will keep e-mails for a maximum period of ten years from the date of the email.

About the end of retention periods

It may not be practical for us to destroy personal data immediately following the end of a stated retention period. Where this is not practical we will destroy the relevant personal data within 1 month of the stated end of the retention period.

About destruction of personal data

Technical issues may make it impossible to destroy personal data completely, especially personal data that is held electronically.

We regard personal data as having been destroyed if:

it has been deleted; or
it has been “anonymised” (that is, the data subject is not identifiable); or
if not deleted or anonymised, it has been “put beyond use”.

We regard personal data as having been “put beyond use” if:

we are not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
we will not give any other organisation access to the personal data;
we will surround the personal data with appropriate technical and organisational security; and
we are committed to permanent deletion of the information if, or when, this becomes possible

About personal data held for more than one purpose

Although one section of this privacy policy may say that we will destroy personal data held for a particular purpose, we may continue to process that item of personal data if it is also held for some other purpose and the date for destruction of personal data held for that other purpose has not yet been reached.

Contact us

For general enquiries
Post: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.
Telephone: 01603 801911
Email: Welcome@norwichtrust.co.uk

Data Protection
Post: Data Protection Officer, Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.
Telephone: 01603 801911
Email: dataprotectionofficer@norwichtrust.co.uk

Complaints

You should find your dealings with us to be professional, efficient but also friendly. We recognise however that from time to time you may have cause for complaint.
If you have a complaint about any aspect of the service you have received, our staff will be happy to investigate.
Please bring your concerns to our attention as soon as possible – the sooner we know the sooner we can respond.
We have a formal complaints procedure to ensure your complaint is handled quickly, fairly and efficiently.
You can lodge your complaint by calling 01603 801911 or emailing complaints@norwichtrust.co.uk.
If you prefer to write to us, you can send your letter to: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich, Norfolk, NR1 3PA

If we can, we will resolve your concerns over the telephone. If we can resolve your complaint within three working days of receipt, we will consider the complaint closed. You will be sent written confirmation of this.

If we are unable to resolve your complaint within three working days, perhaps due to the complexity of the issues you have raised, we will follow the process as detailed below:

We will send you a written acknowledgement of your complaint outlining the matter(s) you have raised promptly, usually within five working days.
We will carry out a full investigation into the matter(s) you have raised.
Once the investigation is concluded, a full written response will be provided to you within eight weeks of receiving your complaint. It will detail our investigation into the matter(s) you have raised and the outcome of our findings. We will ensure the correspondence is in plain English.
If we fail to provide a final response within eight weeks of receiving your complaint, we will write to you again, detailing when we anticipate we will respond. At this point, you may be entitled to refer your complaint directly to the Financial Ombudsman Service.
If you are not fully satisfied with our final response, you are usually entitled to refer your complaint to the Financial Ombudsman.
We will provide you with details of the Financial Ombudsman Service and answer any questions you might have about referring your complaint to them, when we write to you. Some useful information is also provided below.
If you wish to refer your complaint to the Financial Ombudsman Service, you will need to do so within six months of the date of our final response.

The Financial Ombudsman Service may be contacted directly:
The Financial Ombudsman Service, Exchange Tower, London, E14 9SR
Tel: 0800 0234567

Website: www.financial-ombudsman.org.uk

Links to other websites

Where we provide links to websites of other organisations, this privacy policy does not cover how that organisation processes personal information. We encourage you to read the privacy policy on any other websites you visit.

Norwich Trust Limited (NorT)– Privacy Policy

Norwich Trust Limited (NorT) – Privacy Policy

Some concepts that are important to this privacy policy

The company this privacy policy relates to

About Norwich Trust Limited (NorT)

About this privacy policy

Who this privacy policy is relevant to

Changes to this privacy policy

Your questions about this privacy policy

Why we need to process your personal data

Security of your data

Telephone calls

Cookies

Data protection law

Lawful grounds for processing

Consent

Contract

Legal obligation

Vital interests

Public task

Legitimate interests

How does Norwich Trust use your information?

Processing an application for a loan

What information do we collect from you/about you?

If you apply for a loan with us and a loan is not granted

If you apply for a loan with us and a loan is granted.

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

If the application does not proceed and we have not completed any credit searches

If the application does not proceed and we have completed credit searches

If the application proceeds and we pay out a loan

Contacting you about your loan

What information do we collect from you/about you?

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

Credit searches

What information do we collect from you/about you?

Where do we get your information from?

What information will we obtain about you from the Credit reference Agencies?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

If the loan application does not proceed

If the application proceeds and we pay out a loan

Reporting to Credit Reference Agencies (CRAs)

What information do we collect about you/your loan?

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

Processing payments

What information do we collect from you/about you?

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

Tracing and enforcement action

What information do we collect from you/about you?

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

Complaint handling

What information do we collect from you/about you?

Where do we get your information from?

How we will use the information we collect about you?

Legal basis for processing personal data

Who will we share your information with?

How long will we keep your information?

Auditing