At Uncle Buck Finance LLP (“Uncle Buck”, “we”, “us” and “our”), we understand the security and privacy of your personal data is important, so we apply strict security standards to how we store and use your personal data.
Uncle Buck is a limited liability partnership registered in England and Wales with company registration number OC356091. Our registered office is Riverbridge House, Anchor Boulevard, Crossways Business Park, Dartford DA2 6SL. We are authorised and regulated by the Financial Conduct Authority (“FCA”) with firm reference number 673545. Uncle Buck is registered as a data controller with the Information Commissioner’s Office (“ICO”) with registration number Z2487954.
2. Information we may process about you
Personal data means any information that can personally identify you, such as your name, address and contact details.
We may collect and process the following personal data:
- Personal information such as your title, name, date of birth, contact details (such as your address, email address and telephone number), marital status, number of dependants, residential details (including status and time at address), employment information and financial information (such as bank account details and bank transaction data).
- Publicly available information, such as County Court Judgments (“CCJs”), bankruptcies and electoral register information
- Correspondence and records of all contact with you, including any call recordings (as calls between us may be recorded and monitored for security and training purposes)
- Details of transactions carried out through our website (www.unclebuck.co.uk) (the “Website”) and in relation to any loan you have with us
- Information contained in surveys that you have completed and that we use for research purposes to understand how we can better improve our products
- Any other information that you provide to us. This may include special categories of personal data, such as your health information. Where you volunteer such information to us we will seek your explicit consent for us to process it.
- Vulnerability Registration Service (VRS) information
3. How we collect your information
We may collect your personal data from:
- You directly, including information you provide on the Website and online payment portal and through any application forms including the data you provide to access our eBooks.
- Third parties such as credit brokers where you have provided the information to them (for example by filling in forms on their websites) and consented for the information to be passed to us
- Credit reference agencies (“CRAs”) and fraud prevention agencies (“FPAs”) from their records relating to you and other people with whom you are linked financially
- The register of vulnerable customers – The Vulnerability Registration Service (VRS) (see section 11 below). The only information we receive from the VRS, if applicable, is whether you are in fact a vulnerable customer. We do not receive any details as to the reasons you are classified as a vulnerable customer or any details regarding your personal circumstances. You will be registered with the VRS until you or your representative feel your situation has changed and it is no longer appropriate to be registered. At this point, VRS will stop sharing your registration with organisations. You or your representative can ask to be removed from the VRS by contacting the VRS at email@example.com
- Publicly available sources, such as social media sites
- Open Banking providers. During your loan application we may require further banking or building society account information to help us assess your suitability for a loan. If we do require this information, we will safely and securely direct you to our third party provider’s portal who will ask you to provide your bank account details to enable them to access your banking transaction information. As soon as your banking transaction information is received by the third party, it will be reported back to us in the form of a completed search. For further information on how we collect and use this information, click here.
4. Why we process this information
Uncle Buck collects and processes your personal data for a number of reasons connected with providing you with access to high cost short term personal loans. We use information held about you to:
- process your application and enable you to access and use the services we provide;
- communicate with you by telephone, email, SMS or in writing;
- assess your creditworthiness and affordability to make lending decisions and for the prevention of fraud and money laundering (including making searches through CRAs and FPAs);
- verify your identity and employment status;
- manage any account you have with us, including seeking to recover any debt you owe us which may include tracing your whereabouts;
- conduct statistical analysis in order to develop, improve and update our products and provide advertising that is relevant to you;
- contact you to offer informative content and offers about Uncle Buck products and services that you may be interested in (where we have your consent to do so);
- notify you of any changes to our service; and comply with our regulatory obligations, including reporting to regulatory bodies where we are required to do so.
5. the lawful grounds we have to process this information
We rely upon different legal bases to process your personal data depending on the reason for which we have collected or obtained it:
- In processing your application, we are taking steps at your request before entering into an agreement with you. We also have legitimate interests for the processing required at the application stage, in order to decide whether or not we can offer you the product you have applied for and in respect of fraud prevention. This type of processing is required in order to enter into an agreement with us. If you do not provide it then we cannot proceed with your application.
- If your application is accepted and funded, we will process your personal information in order to perform our agreement with you, to fulfil our legal obligations and legitimate interests of promoting responsible lending.
- If your application is declined we will store your personal information in accordance with our record retention procedures and to comply with our legal obligations.
- As described further in section 7, if you have applied through our website and we have been unable to fund you, where we have your specific consent, we may pass your application details to credit brokers.
- As described further in section 7, if your application has been passed to us from a third-party broker and we are unable to fund you, we may pass your application data to credit brokers and have legitimate interests in doing so in order to facilitate your loan search.
- We will contact you for direct marketing purposes where we have your consent to do so. Note that if you withdraw any consent that you have given to us, this does not affect the lawfulness of any processing which occurred prior to the withdrawal of consent.
- The personal information that we process when you are browsing the Website (such as your IP address) is done so on the basis that we have legitimate interests in doing so, namely to improve your experience on the Website and to remember your preferences.
For accepted applications, both funded and non funded (including application data received from third party providers) and declined applications (including those received from third party providers) our legitimate interests includes to develop and improve our services and business operations and obtain insights into usage patterns and performance. We may use statistical analysis and reporting to help achieve these aims. If we do so, we will only retain personally identifiable data in accordance with our retention policy.
Your personal data may also be used for other purposes for which you give your specific permission, for example surveys or research. We may also use your personal data when required by law or otherwise lawfully permitted.
Please note that we may use your information in the ways set out above using automated processes, this means processes that are carried out without human intervention. We may make automated decisions about you to assess whether you meet our lending criteria (such as being over 18 or being a resident in the UK) including the use of credit scoring techniques. If these decisions find that you do not meet our lending criteria, any application for credit will be automatically declined.
6. How we store your personal data and keep it secure
We will retain your information for as long as it is needed to manage your account and for a maximum of six years from the end of our relationship with you unless a longer period is required by law or we have legitimate reasons for doing so.
In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. We use secure socket layer (“SSL”) encryption technology, store data in encrypted form, and control access to data. All our security systems and procedures meet or exceed industry standards, and we constantly monitor technological and internet developments to ensure our system security is up to date.
Countries within the European Economic Area (“EEA”) are required to have a similar standard of protection of personal data under the GDPR. Should we transfer data outside the EEA we will ensure that there is adequate protection in place in respect of that transfer in accordance with application data protection legislation.
7. Sharing your information
We may share your personal information as follows:
- If you have applied directly using the Uncle Buck website and your loan application with us is unsuccessful, and you consent to us doing so, we may pass your application details to credit brokers, including Nouveau Finance Limited, a credit broker authorised by the FCA (authorisation number 727348), so that they may help you find a suitable lending solution by providing your details to lenders on their panels. These lenders may carry out additional credit searches in order to assess whether they are able to offer you a loan and you may be contacted by SMS, email, telephone or automated message by any lender that has approved your application for the purpose of progressing your application with them.
- to third parties who act on our behalf or who provide services to us which include but are not limited to dealing with matters such as payment handling, credit checking, debt collection, debt purchase, cloud storage, data validation, search engine facilities, analysis to help us improve your experience with us, advertising and marketing (see section 8 below).
- to the Vulnerability Registration Service (see section 11 below)
- to law enforcement agencies or regulatory bodies in circumstances where we are required to do so by law, and CRAs and FPAs (as discussed at section 10 below).
- if Uncle Buck or substantially all of its assets (including your debt) are acquired by a third party (as personal data held by us about our customers will be one of the transferred assets)
- in order to comply with any legal obligations, or in order to enforce or apply the Website Terms and Conditions and other agreements, or to protect the rights, property, or safety of Uncle Buck, our customers, or others.
8. Promotional and marketing communications
We may contact you by email about products, services and offers of ours that might be of interest to you. We use a third party provider, Hubspot, to deliver our marketing. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our marketing.
We will only contact you for marketing purposes where we have your consent to do so. You may opt-out at any time in any of the following ways that are convenient to you:
- respond to any of our email communications (or use the unsubscribe link within the email)
- send us an email to firstname.lastname@example.org
- telephone us on 01959 543400
- write to us at Uncle Buck Finance LLP, Riverbridge House, Anchor Boulevard, Crossways Business Park, Dartford DA2 6SL
Please include your name and either your postcode or your mobile telephone number in the communication to help us identify you. We reserve the right to take reasonable steps to authenticate your identity with respect to any such request or other enquiry.
If you opt-out of our use of your data for marketing purposes, we will honour such choice once we have had a reasonable opportunity to process your request.
9. Your data protection rights
You have specific rights in respect of the personal data we process about you, please see further details below.
If you seek to exercise your rights, we will explain whether or not the right applies to you. Please be aware that if your request is manifestly unfounded or excessive we may refuse to deal with your request or charge a reasonable fee for dealing with it.
- The right of access to the personal data we hold.
- The right to rectify (i.e. correct) your personal data where it is inaccurate or incomplete.
- The right to delete your personal data, but only in specific circumstances, for example where the personal data are no longer necessary in relation to the purpose for which it was originally collected or processed. It may not therefore be possible for us to delete the information we hold about you if you request this, for example, if we have an ongoing contractual relationship with you.
- The right to restrict processing in specific circumstances, for example while we are reviewing the accuracy or completeness of data or deciding on whether any request for erasure is valid. In such cases we shall continue to store the data, but not further process it until such time as we have resolved the request.
- The right to data portability which means the right to receive, move, copy or transfer your personal data to another controller. You have the right to this when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means.
- The right to object in cases where processing is based upon our legitimate interests. You may also object to the processing of your personal data for the purposes of direct marketing (including profiling).
- Further information on how you can request a copy of the personal data we hold about you can be found HERE.
Please contact email@example.com if you would like to exercise any of your data protection rights or if you have any queries in respect of your rights.
10. Credit reference and fraud prevention
In order to process your application, we will perform credit and identity checks on you with one or more CRAs. Where you borrow from us, we may also make periodic searches at CRAs to manage your account with us.
To do this, we will supply your personal information to CRAs, and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We will use this information to:
- Assess your creditworthiness and whether you can afford to take the product;
- Verify the accuracy of the data you have provided to us;
- Prevent criminal activity, fraud and money laundering;
- Manage your account(s);
- Trace and recover debts; and
- Ensure any offers provided to you are appropriate to your circumstances.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
When CRAs receive a hard search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in the CRA Information Notice (CRAIN). CRAIN is accessible from each of the three CRAs – clicking on any of these three links will also take you to the same CRAIN document:
TransUnion www.callcredit.co.uk/crain; Equifax www.callcredit.co.uk/crain; Experian www.experian.co.uk/crain/index.html.
You have the right to be told which CRAs we use and obtain a copy of your file from CRAs. The CRAs that we use are Callcredit Limited, part of the TransUnion Information Group (registration number 04968328) with registered office at One Park Lane, Leeds, West Yorkshire LS3 1EP.
11. The Vulnerability Registration Service (VRS)
The VRS is a platform providing vulnerable customers with a single reference point for recording their personal circumstances at a given point in time when they are looking to protect themselves against further debt or related financial problems.
VRS do not record any reasons for your registration. All that can be seen will be your name, address, date of birth and contact details together with your chosen vulnerability flag. This flag will show that you have opted to always be declined credit should you make a credit application or that you have asked to have any application or similar request looked at and discussed with you prior to a decision being made as to whether to grant you credit.
You will initially be registered on the VRS for a period of three months. This is so that you have a reasonable period within which your circumstances may improve, hopefully to the point where you no longer feel vulnerable. After the first three months you can ask to be removed from the VRS.
Only users of the VRS will be alerted, and only if or when they need to make a decision relating to you – for example, a credit application so that they will be made aware of your personal situation.
For more information regarding VRS, please refer to the Vulnerability Registration Service website using the following link www.vulnerabilityregistrationservice.co.uk
By ticking the “Yes” box on the application form or continuing to use the Website you confirm that you have read and accept Uncle Buck’s Website Terms & Conditions and this Policy.
By submitting your application (moving to “Next Stage”), you acknowledge that Uncle Buck will review your application and perform credit and verification checks with CRAs and FPAs to make lending decisions and for the prevention of fraud and money laundering. Uncle Buck is a participating member of the Vulnerability Registration Service and will search the register when assessing your application and managing your account with us.
If you have a complaint relating to data protection please contact firstname.lastname@example.org or write to us at Uncle Buck Finance LLP, Riverbridge House, Anchor Boulevard, Crossways Business Park, Dartford DA2 6SL.
Alternatively, you can complain to our supervisory authority, the ICO, at www.ico.org.uk, by telephoning 0303 123 113 or writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
14. Further Information
If you would like more information or you have any comments about this Policy, please either write to us at Uncle Buck Finance LLP, Riverbridge House, Anchor Boulevard, Crossways Business Park, Dartford DA2 6SL or email us at email@example.com.
We may amend this Policy from time to time without notice to you, in which case, we will publish the amended version on the Website. We shall not be liable to you or any third party for any change to this Policy.
You can ask us for a copy of this Policy and of any amended Policy by writing to the above address or by emailing us at firstname.lastname@example.org. This Policy applies to personal data we hold about individuals. It does not apply to information we hold about companies and other organisations.
The Website may, from time to time, contain links to and from the websites of our advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
Last updated 3 February 2020