Norwich Trust Limited – Privacy Policy

This Privacy Policy sets out what information Norwich Trust Limited will collect about you and how Norwich Trust Limited uses and protects any information that you give us (via this website or during any other transactions with us). Norwich Trust Limited may change its Privacy Policy wording from time to time by updating this page.

This policy was last updated 28.01.2026

By submitting your application to Norwich Trust Limited, you confirm you have read this Privacy Policy and the Norwich Trust Limited Terms of use and Cookie Policy.

Some concepts that are important to this privacy policy

The law restricts what can be done with personal information that relates to an identifiable living person. Commonly, such information is referred to as “personal data”, the person it relates to as the “data subject” and what is done with that information as “processing”. Providing that information to another person and storing that information are both examples of processing. A person who gets to say what personal data is collected and/or how personal data is processed is commonly referred to as a “controller” in respect of that personal data. A person who carries out processing under the direction of someone else is commonly referred to as a “processor” in respect of that personal data.

The main pieces of law that apply to us regarding the processing of personal data is the Data Protection Act 2018 (or the “DPA”) and the UK General Data Protection Regulation (or the “UK GDPR”).

All of the law that applies to us in respect of personal data is referred to in this privacy policy as the “data protection legislation”.

The company this privacy policy relates to

References in this privacy policy to “we”, “us”, “our”, “ours”, “company” are all to Norwich Trust Limited.

Norwich Trust Limited will only process personal data in accordance with the applicable legislation.

References in this privacy policy to Norwich Trust Limited, however referred to, include predecessors and successors to its rights and obligations in respect of:

• loans;
• applications for loans; and/or
• its business or any part of its business.

About Norwich Trust Limited

Norwich Trust Limited is a company registered in England and Wales under company number 12706211

Registered office: 25-27 Surrey Street, Norwich NR1 3NX

VAT number: 765353512

Authorised and regulated by the Financial Conduct Authority Reference (FCA) No. 979682

Registered with the UK Information Commissioner’s Office. Registration number: ZB346729.

About this privacy policy

We set out here how we process personal information that relates to would-be, current and past borrowers from Norwich Trust Limited. We also explain how we process personal information that relates to other people who act on behalf of would-be, current and past borrowers.

Such a document is referred to often as a data protection policy or a privacy policy.  We refer to it as our “privacy policy”.

If we process personal data in respect of you, then how and why we process it, and the people we may provide it to, largely depend on the nature of the relationship we have, or have had, with you at the relevant time.

In this privacy policy where we describe the personal data we may process, we explain the personal data that is involved and:

• how we have obtained it;
• the purpose of us processing it;
• the lawful grounds on which we are relying when conducting that processing;
• the other people to whom we may provide it;
• our reason for providing it to those other people; and
• how long we may retain it.

This privacy policy also sets out your principal rights in respect of personal data that we process where you are the data subject.

Who this privacy policy is relevant to

This privacy policy is relevant to you if:

• you are a current, past or prospective borrower from us (“borrower”); or
• You are a person (a “third party”) acting on behalf of a borrower, with their authority, such as a family member, carer, support worker or someone who has power of attorney (or similar authority) over a borrower’s financial affairs; or
• You are a third party who has a relationship with a borrower and make payments on their behalf.

Such persons are referred to in this privacy policy by the terms “you”, “your” and “yours” except in those sections directed specifically at third parties.

Changes to this privacy policy

The most likely reasons that we may need to change this privacy policy are:

• developments in our business, as innovations occur and/or we identify better ways of doing things that may be of benefit to us and/or to customers and/or other people that we deal with;
• changes in the law and/or the interpretation that the Courts place on it;
• changes to the third parties suppliers we use;
• certain decisions and directions of the Financial Ombudsman Service (FOS); and
• changes in the requirements or guidance of regulators that relate to our business and/or your personal data.

For these, and other reasons, we may need to change this privacy policy from time to time.

We will not notify you of changes to this privacy policy, so we recommend that you check it from time to time. You can see here when this privacy policy was most recently updated.

Your questions about this privacy policy

If you have any questions regarding this privacy policy please contact our Data Protection Officer

Why we need to process your personal data

We cannot engage with you unless we process your personal data, but if you do not want us to process your personal data in accordance with this privacy policy you should not provide your personal data to us.

When you give us your personal data your rights in respect of it can be restricted, so, if you do not agree with the terms of this privacy policy:

• do not apply for a loan from us; and
• do not agree to act on behalf of a borrower, or make payments on their behalf.

Security of your data

Norwich Trust Limited is committed to ensuring that your personal information is held securely.
We have put in place various controls and procedures to protect and keep secure the information we collect online or hold separately.
If you contact Norwich Trust Limited, you will be asked a number of security questions before we will discuss your personal details or loan account with us.

Telephone calls

Norwich Trust Limited records telephone calls for monitoring, staff training and compliance purposes.

Cookies

Please refer to our cookies page

Data protection law

The data protection legislation:

• says that a controller can only process personal data if it has a lawful reason for doing so;
• sets out six lawful grounds for processing;
• says that a controller must tell data subjects how it, and any processors acting on its behalf, will process their personal data; and
• gives rights to data subjects in respect of their personal data.

What information will Norwich Trust collect from you/about you?

During our dealing with you, we may collect the following personal data from/about you:

• Your name and date of birth
• Your residential address and address history (including postcodes)
• Contact information including telephone number(s) and email addresses
• Your employment type (whether you are employed, self-employed, retired or in receipt of benefit income)
• Your last known employment
• Details of your income (including details of benefits/secondary income)
• Evidence of your income eg: payslips, accounts, pension/benefits statements
• Details of any property which you own
• Identification documents (where we are unable to electronically verify your identity)
• Nationality / right to reside
• Financial information, including details of your outgoings/monthly expenditure, bank details and transactions on your bank statement(s)
• Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address (device location, device type etc)
• Visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data
• Information from credit reference agencies about your financial situation and financial history, including details of your current outstanding debts and repayment profiles
• Information to confirm your identity (by way of electronic identity verification)
• Public information (including the Electoral Register)
• Information from fraud prevention agencies
• Details of the loan including the amount, term, contractual monthly payment and interest rate
• Loan documents including the credit agreement
• The date the loan was arranged
• The amount that you owe and any arrears balance
• The conduct of your account i.e. whether repayments are made
• Any arrangements which have been recorded on your account
• Any defaults which have been recorded on your account
• Whether your loan has been included as part of any Debt Management Plan, Individual Voluntary Arrangement, or bankruptcy
• The date your loan was settled
• Your bank details
• Your payment card details
• Correspondence between you and us, including the recording of telephone calls, e-mails, text messages, statutory notices and any other written correspondence
• Details of any complaints you have made or are making
• Any information provided to us by you or by third parties during the loan application
• Any information provided to us by you or by third parties after the loan was paid out

Special Category Data

The UK GDPR singles out some types of personal data as likely to be more sensitive, and gives them extra protection:

• personal data revealing racial or ethnic origin;
• personal data revealing political opinions;
• personal data revealing religious or philosophical beliefs;
• personal data revealing trade union membership;
• genetic data;
• biometric data (where used for identification purposes);
• data concerning health;
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation

We do not request ‘sensitive’ information during the application process, however during the course of your relationship with Norwich Trust Limited there may be situations in which you provide us with information, or we ask you for information, concerning your health or other sensitive information relating to your personal circumstances, for example, if it has given rise to a change in your circumstances and is affecting your ability to manage your loan repayments.

This information is classed as Special Category Data and as such we will only record and use this information with your explicit consent.

Norwich Trust Limited will never ask you for any other form of Special Category Data.

Where/Who will Norwich Trust get your information from?

We may obtain your information from one or more of the following sources:

• You
• Someone acting on your behalf (such as a broker)
• A third party acting on your behalf (such as a support worker)
• Third party debt advisors/Debt Management Companies
• Your employer/accountant/pension provider (if you have one)
• Your bank
• Credit reference agencies
• Fraud prevention agencies
• Tracing agents
• Field agents
• The land registry
• Our own databases
• A medical professional or other third party who you have authorised to provide us with information on your behalf

How does Norwich Trust use your information?

The information we collect about you will be used for the following purposes:

Processing an application for a loan

If you, or a broker acting on your behalf, submits an application to us for a loan, we will process your personal data to assess the application and make a decision about whether or not to provide a loan. We will use the data we obtain to assess whether you can afford the loan repayments, to ensure any offers provided to you are appropriate to your circumstances and to ensure we are complying with all relevant rules, regulations and policies, and are lending responsibly.

We will also use your data to keep your broker (if any) informed about the progress of your loan application

Credit searches

In order to process any application for a loan, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”) and searches of other public registers such as the electoral register, the land registry and insolvency registers. We will use this data to verify the accuracy of the data you have provided to us and to assess your credit profile

From time to time Norwich Trust Limited may also perform credit searches after the loan has paid out in order to enable the ongoing administration and management of the loan.

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy

Corresponding with you about your loan

From time to time we may need to contact you, or you may contact us, about your loan. We will use your information when we correspond with you, for example to update you on the progress of a loan application, to update you about any changes or important information relating to the loan account, to remind you that a payment is due or to let you know about missed payments and to administer and manage the account including offering appropriate forbearance options.

We may also use your information to send you information about our products and services.

Reporting to Credit Reference Agencies (CRAs)

During the life of the loan, Norwich Trust Limited will submit details of your account to the CRAs.

Processing payments and Loan administration

When you make payments to a loan with Norwich Trust Limited,  we will need to process certain items of your personal data in order to process those payments. We also use the data we obtain to ensure we are complying with all relevant rules, regulations and policies.

Tracing, field agents and enforcement action

If we are unable to contact you for an extended period of time, or we have reason to believe that the contact information we hold for you may be inaccurate, we may take steps to trace up to date contact information for you.

If we are considering an attachment of earnings order, we may also take steps to trace your employment information.

If the loan falls into arrears and we have been unsuccessful in our attempts to contact you, we may instruct field agents to visit you at your home to re-establish contact with you.

If we are still unable to contact you or are not able to negotiate a payment arrangement with you, it may be necessary for us to commence legal proceedings against you to recover any sums owed. We refer to this as enforcement action.

Complaint handling and Data Subject Access Requests (DSARs)

From time to time, you may have cause for complaint about an aspect of the service you have received from Norwich Trust Limited and ask us to investigate your concerns. We will use your data to Investigate any complaints and provide a response setting out our findings. We will also use the information we collect to calculate any sum of redress which may be due to you and to deal with the escalation of any complaint which cannot be resolved directly between you and Norwich Trust Limited.

We will also use your data to respond to any subject access requests we may receive for you.

Auditing

From time to time, our funders will ask an independent external company to review some of our loan accounts to ensure we are complying with all relevant rules, regulations and policies, and to ensure we are lending responsibly.

We are also obliged to provide information to external companies to audit our finance/accounts processes which may involve the disclosure of personal information. To ensure our finance/accounts processes are accurate, adequate and comply with relevant regulation and legislation.

Research, Analysis and Product and Service Improvement

From time to time, we may use third party systems providers to conduct statistical analysis, research and behavioural analysis using data we have collected from you, in order to develop scorecards and to improve our products and services and to improve this website.

Fraud prevention

We will request details of any information held about you by fraud prevention agencies in order to assist with our lending decision and to prevent criminal activity, fraud and money laundering .

If, at any time, we suspect that false information has been provided, or if fraud, money laundering or any other criminal offence is suspected we may provide information to fraud prevention agencies or other relevant authorities. We may also use the information we obtain to respond to requests from bodies such as police, national crime agency, department for work and pensions etc.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Lawful grounds for processing

These are six lawful bases for processing of personal data.  At least one of these must apply whenever we process your personal data.

We explain throughout this privacy policy the lawful basis on which we undertake the processing that we carry out on your personal data.

Although not all are relevant to us, the six bases are:

Consent

For this to apply, the data subject needs to have given clear consent for us to process their personal data for a specific purpose.

Contract

For this, the processing must be necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract with us.

Legal obligation

For this, the processing must be necessary to comply with the law (but not including contractual obligations).

Vital interests

For this, the processing must be necessary to protect someone’s life.  We would only envisage this applying if were requested to provide information to a 999 service provider or government department.

Public task

For this, the processing must be necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.  We do not foresee this being relevant to us in respect of your personal information.

Legitimate interests

This can apply where the processing is necessary for our legitimate interests or the legitimate interests of someone else, unless there is a good reason to protect your personal data that overrides those legitimate interests.

Which lawful basis we rely on

We set out in the table below the lawful bases we rely on to process your personal data for each of the purposes we process it.

Who will we share your information with?

Norwich Trust Limited use third party data processers who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisations apart from us. They will hold it securely and retain it for the period we instruct.

In some circumstances we are legally obliged to share information, for example under a court order. We might also share information with regulatory bodies. In any scenario, we will satisfy ourselves we have a lawful basis on which to share the information.

Below we set out details of any third parties we may share your information with, what information we will share with them and the reasons why we may do so.

Processing a loan application

During the application process we may pass some of your information to third parties.

If you have been introduced to us via a third party, for example a credit broker or price comparison website, we may disclose information concerning the progress of your application to them.

The third parties we currently share information with for these purposes are:

• Commify UK Limited (trading as TextAnywhere) – our SMS provider
• Spotler Limited (trading as MailPlus) – our email provider
• Cifas, the police, national crime agency and the department for work and pensions
• The member of our third party introducer network/the broker who introduced you to us 

We may update or change our third-party suppliers from time to time. As a result, the names of third parties to whom we may pass your data may change.

Corresponding with you about your loan

When we need to contact you, or you contact us, sometimes we use external processors to manage communications with you and to ensure that any personal data that forms part of those communications is protected.

The third parties we currently use for these purposes are:

• Commify UK Limited (trading as TextAnywhere) – our SMS provider
• Spotler Limited (trading as MailPlus) – our email provider
• Snorkl Money Limited (trading as Snorkl) – our AI chat system provider
• Mimecast Services Limited– our cybersecurity provider

We may update or change our third-party suppliers from time to time. As a result, the names of the third parties to whom we may pass your data for this purpose may change.

Credit searches

In order to make a decision about your loan application, or to assist us in the management of your loan, we will obtain information about you from the credit reference agencies.

The credit reference agency we currently use for these purposes is:

• Equifax

We may update or change our third-party suppliers from time to time. As a result, the names of third parties to whom we may pass your data for this purpose may change.

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

Reporting to Credit Reference Agencies (CRAs)

If a loan is granted Norwich Trust Limited will share information about the account with the CRAs.

We share information with CRAs in accordance with the principles of reciprocity.

The credit reference agencies we currently supply information to for these purposes are:

• TransUnion
• Equifax
• Experian

We may update or change our third-party suppliers from time to time. As a result, the names of third parties to whom we may pass your data for this purpose may change.

For more information about credit searches and credit reference agencies, please refer to the credit searches section of this policy.

Processing payments and Loan administration

We will share some of your personal information with third party companies who host some of our systems in respect of the administration of loan accounts and to facilitate payments.

The third parties we currently use for these purposes are:

Anchor computer systems Limited (trading as Aryza)– the system we use to manage and administer loan accounts

• National Westminster Bank Plc (Natwest Bankline)  - the system we use to administer payments that we make and that people make to us
• National Westminster Bank Plc (Natwest Autopay) – the system we use to administer direct debit payments
• National Westminster Bank Plc (Natwest Payment Services) – the system we use to administer bounced direct debit payments
• Lloyds Bank Plc (Trading as Lloyds Cardnet)  – a system we use to process card payments
• Acquired Limited – a system we use to process card payments

These companies do not act as data processors but we do use the systems and platforms they provide to host information to enable us to administer loan accounts and to process payments. Although these companies have access to the information held on those systems due to their role as system hosts, they are not permitted to use the information for their own purposes.
We may update or change our third-party suppliers from time to time. As a result, the names of the third parties to whom we may pass your data for this purpose may change.

Tracing, field agents and enforcement action

If we need to trace your address or employment information, re-establish contact with you, or take enforcement action against you, we will share some of your personal data with third parties to help us do so.

The courts may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with them or our solicitors in connection with any legal proceedings.

The third parties we currently use for these purposes are:

• Hunter Tracing Services (UK) Limited – the firm we use to conduct contact and employment traces
• Fieldcall Limited – the firm we use to arrange home visits to re-establish contact
• The County Court Money Claim Centre – the central processing centre for money claims in England and Wales
• The County Courts in England and Wales – the local courts which deal with enforcement in England and Wales
• The Sheriff Courts in Scotland - the courts which deal with enforcement in Scotland
• HCR Legal LLP – the solicitors we use if you live in England or Wales
• Yuill & Kyle Limited - the solicitors we use if you live in Scotland

We may update or change our third-party suppliers from time to time. As a result, the names of the third parties to whom we may pass your data for these purposes may change.

Complaint handling and Data Subject Access Requests (DSARs)

As part of our complaint handling process we may share information relating to your complaint with third parties.

The courts may ask us for information in addition to the items listed above, and we reserve the right to share any further information requested by them with them or our solicitors in connection with any legal proceedings.

The third parties we currently share information with for these purposes are:

• Your nominated third party representative – As long as you have provided your consent for us to provide information to a third party, we will provide them with the information they ask for.
• The Financial Ombudsman Service - As long as you have provided your consent to the FOS to investigate your complaint, we will provide them with the information that they ask for, unless we believe there is an overriding reason not to.
• HCR Legal LLP – the solicitors we use if you live in England or Wales
• Yuill & Kyle Limited - the solicitors we use if you live in Scotland
• The County Courts in England and Wales – the local courts which deal with disputes in England and Wales
• The Sheriff Courts in Scotland - the local courts which deal with disputes in Scotland

We may update or change our third-party suppliers from time to time. As a result, the names of the third parties to whom we may pass your data for these purposes may change.

Auditing

In order for our auditors to carry out their role, we may share some of your personal data with them.

The third party auditors currently instructed for these purposes are:

• Lovewell Blake Accountancy Services Limited – for audits of our finance and accounting processes
• Rockstead Limited – for audits of our account management systems, responsible lending, treating customers fairly, compliance with our internal policies and procedures, and regulatory compliance

These companies do not act as data processors. Although we provide these companies with access to the information listed above, they are not permitted to use the information for their own purposes.

We and our funders may update or change auditor firms from time to time. As a result, the names of the third parties to whom we may pass your data for this purpose may change.

Research, Analysis and Product and Service Improvement

From time to time, we may use third party systems providers to conduct statistical analysis, research and behavioural analysis using data we have collected from you. From time to time, Norwich Trust Limited might also share loan performance data (whether you have paid) with the credit reference agencies, for the purposes of data analysis / development of new products / scorecards.

The third parties we currently use for these purposes are:

• BTR Future Limited
• Equifax Limited

We may update or change our third-party suppliers from time to time. As a result, the names of the third parties to whom we may pass your data for these purposes may change.

These service providers are obligated to handle the data provided to them by Norwich Trust Limited in accordance with applicable data protection laws and the terms agreed upon with Norwich Trust Limited.

Norwich Trust Limited ensures that the service providers implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction.

Special Category Data

We will never pass any Special Category Data to any third party without your explicit consent unless we are compelled to do so by law.

Fraud Prevention

To help prevent fraud, Norwich Trust Limited will share personal information about you with fraud prevention agencies. This is used to prevent money laundering and fraud, and to verify your identity. If fraudulent activity is detected, Norwich Trust Limited will submit details to Fraud Prevention Agencies and you could be refused certain services, finance or employment.

We may also share information with other appropriate organisations or third parties if we suspect that false information has been provided or if fraud, money laundering or any other criminal offence is identified.

The information we share may vary, depending on individual circumstances, and may include any information about you which has been provided to us by you, or that we have received from third parties.

For more information about fraud prevention, please see the Anti-fraud measures section of this policy.

Sharing your data outside of the European Economic Area (EEA)

Your data may be transferred to a destination outside the European Economic Area (EEA). It may also be processed by companies operating outside the EEA who work for us or introduce business to us. If your personal information is transferred outside the European Economic Area (EEA) for processing or storage purposes we will ensure that safeguards are in place to protect it to at least the standard applied within the EEA.

How long will we keep your information?

If the application does not proceed and we have completed credit searches

We will keep your information for a maximum of 30 months from the date of the credit searches, unless we have an overriding obligation to retain your details for longer.

If the application proceeds and we pay out a loan

Proof of identification and proof of address

We will keep this information for 5 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

All telephone call recordings

We will keep call recordings for a maximum period of fifteen years from the date of the call.

Emails

We will keep e-mails for a maximum period of ten years from the date of the email.

All other information

All other information referred to under the heading “What information do we collect from you/about you?” above will be kept for 6 years after the date on which your relationship with Norwich Trust Limited ends (the date the loan is paid off), unless we have an overriding obligation to retain your details longer.

The information recorded by the CRAs will typically remain on your credit file for a period of six years.

We will never keep your full payment card details.

About the end of retention periods

It may not be practical for us to destroy personal data immediately following the end of a stated retention period.  Where this is not practical we will destroy the relevant personal data within 1 month of the stated end of the retention period.

About destruction of personal data

Technical issues may make it impossible to destroy personal data completely, especially personal data that is held electronically.

We regard personal data as having been destroyed if:

• it has been deleted; or
• it has been “anonymised” (that is, the data subject is not identifiable); or
• if not deleted or anonymised, it has been “put beyond use”.

We regard personal data as having been “put beyond use” if:

• we are not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
• we will not give any other organisation access to the personal data;
• we will surround the personal data with appropriate technical and organisational security; and
• we are committed to permanent deletion of the information if, or when, this becomes possible

About personal data held for more than one purpose

Although one section of this privacy policy may say that we will destroy personal data held for a particular purpose, we may continue to process that item of personal data if it is also held for some other purpose and the date for destruction of personal data held for that other purpose has not yet been reached.

Credit searches

In order to process any application for a loan, Norwich Trust Limited will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information about your financial situation and financial history including details of your current outstanding debts and repayment profiles. CRAs will also supply us with information to confirm your identity (by way of electronic identity verification) and both public information (including the Electoral Register) and shared credit, financial situation and financial history information, and fraud prevention information.

When we conduct a credit search against you, you may be treated as financially linked and your application will be assessed with reference to any “associated” credit records (joint accounts/loans/credit).

We will use this information to:

• Assess your creditworthiness
• Verify the accuracy of the data you have provided to us
• Prevent criminal activity, fraud and money laundering
• Manage the loan account
• Trace and recover debts
• Ensure any offers provided to you are appropriate to your circumstances.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN) which is available from each of the three CRAs by clicking any of the links below.

• TransUnion
• Equifax
• Experian

When you first apply

When you enquire, our initial credit search, which is used to generate your loan quote, is a ‘soft’ search (often referred to as an enquiry search) and does not leave a footprint on your credit file. The CRAs will record details of the search whether or not the application proceeds, however the search should not impact upon your credit rating and cannot be seen by other people making searches in the future.

When the loan is granted

If you decide to proceed with the loan and funds are released, a ‘hard search’ (often referred to as an application search) will be carried out against you. This hard search will be recorded by the CRAs and may be seen by other people searching in the future. This is a requirement of the CRAs and common practice across the finance industry.

After the loan is granted

During the life of the loan, Norwich Trust Limited will submit details of your account status including the balance and whether repayments are made as well as any arrangements or defaults which have been recorded on your account to the CRAs. We will also inform the CRAs about your settled accounts. This information may be supplied to other organisations by CRAs.

The information recorded by the CRAs will typically remain on your credit file for a period of six years.
If you obtain a loan with us we may, during the life of the loan, make periodic searches at Credit Reference Agencies and Fraud Prevention Agencies so that we can manage your account with us. These additional searches are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

After the loan is settled

After the loan is settled we will not usually conduct any further credit searches unless it is necessary for us to do so, for example in order for us to investigate a complaint you have raised. Any additional searches it is necessary for us to carry out are also ‘soft searches’ and are not visible to other organisations viewing your credit file.

Anti-fraud measures

General

Before we grant a loan, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.
The personal data you have provided, we have collected from you, or we have received from third parties will be will be used to prevent fraud and money laundering, and to verify your identity.

The personal information which will be processed to perform these checks is:

• Your name
• Your address
• Your date of birth
• Your contact details (telephone numbers and e-mail address)
• Financial information
• Employment details
• Device identifiers including IP address

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Automated decisions

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if:

• our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers; or is inconsistent with your previous submissions; or
• you appear to have deliberately hidden your true identity.

You have rights in relation to automated decision making. For more information, please refer to the Your data protection rights section of this policy

We use services provided by a third-party organisation, iovation Inc, for the purposes of fraud prevention and account authentication purposes. iovation are based in the US. Their third-party services help us decide whether to accept transactions from electronic devices by analysing device attributes and checking whether they have been associated with fraudulent or abusive transactions in the past. The service also helps verify your identity by registering and remembering devices associated with your account. We also report to iovation if we conclude that a device has been used in connection with a fraudulent or abusive transaction with us. iovation may track your activity over a network of different sites that subscribe to their services. Please see www.iovation.com and their privacy policy for more information about this service.

Consequences of processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services, goods or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us.

Data transfers

Fraud prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

Your data protection rights

Under data protection law, you have certain rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

We may process and store information about you electronically and/or in manual records. You have the right to ask us for copies of your personal information, often referred to as a Data Subject Access Request (DSAR). This right always applies.

If you would like to make a Data Subject Access Request, please contact us.

There is no charge for submitting a DSAR, however in order to ensure the security of your personal information, we will ask you to provide certain personal details to verify you are who you say you are, before we action your request and release your personal information.

Upon receipt of a DSAR, Norwich Trust Limited has a maximum of 1 month to respond.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Norwich Trust Limited will correct any information we hold about you if you are able to evidence that the information we hold is inaccurate or incomplete.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Norwich Trust Limited will delete your personal information, at your request, unless we have a legal obligation or legitimate interest to hold or process your data. For instance; the ongoing administration/management of a live loan, reporting to credit reference agencies the conduct of the loan account, recording and retaining information relating to complaints, retaining information for the purposes of Anti Money Laundering, retaining information for the purposes of responding to law enforcement agencies / government agencies.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

You can ask us to temporarily limit the use of your data when you have made a challenge to the accuracy of your data, or an objection to the use of your data.

You can also ask us to limit the use of your data rather than delete it if you believe your data has been processed unlawfully but you do not want it deleted, or we no longer need your data but you want us to keep it in order to create, exercise or defend legal claims.

Your right to object to processing

You have the right to object to Norwich Trust Limited processing your information based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling). You also have the right to object to direct marketing (including profiling) and processing for purposes of scientific/historical research and statistics.

Norwich Trust Limited may not agree to stop processing your information where we can evidence that we have legitimate reasons to continue using your information.

Your rights in relation to automated decision making including profiling

Norwich Trust Limited does not operate a fully automated decision making process in respect to the granting of a loan, however it does reject applications based upon an automated basic eligibility checks.

If an application has been declined based on our automated eligibility checks, you can ask us to manually review the decision.

If you would like to exercise any of your data protection rights, please contact us.

You can find more information about your individual rights on the Information Commissioner’s Office website.

If you are unhappy about how your personal data has been used, please refer to our complaints policy

You also have a right to complain to the Information Commissioner’s Office which regulates the processing of personal data:https://ico.org.uk/concerns/

Contact us

For general enquiries

Post: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.

Telephone: 01603 801 911

Email: welcome@norwichtrust.co.uk

Data Protection

Post: Data Protection Officer, Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich NR1 3PA.

Telephone: 01603 801 911

Email: dataprotectionofficer@norwichtrust.co.uk

Complaints

If you have a complaint about any aspect of the service you have received, our staff will be happy to investigate.

You can lodge your complaint by calling 01603 801 911 or emailing complaints@norwichtrust.co.uk.

If you prefer to write to us, you can send your letter to: Norwich Trust, Floor 1, Norfolk Tower, 48-52 Surrey Street, Norwich, Norfolk, NR1 3PA

You can find more information about how we handle complaints on our website here.

Links to other websites

Where we provide links to websites of other organisations, this privacy policy does not cover how that organisation processes personal information. We encourage you to read the privacy policy on any other websites you visit.