Your personal information

Your personal information We may share your information with, and obtain information about you from, credit reference agencies to verify your identity. For full information on how your data is processed by credit reference agencies please visit https://www.experian.co.uk/crain

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering, to verify your identity and help debt collection. If fraud is detected, you could be refused certain services. You can get further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, by contacting us on 0800 1959 530.

You have a right of access to a copy of the personal data we hold about you. Please email informationrequests@cheque-exchange.co.uk, write to the Rights Request Team, Cheque Exchange Ltd, No 1 Godwin Street, Bradford, BD1 2SU, or call 0800 1959 530 providing as much information as possible to enable us to locate your information. Once we have everything we need to locate your information we will supply this to you within 30 days of this date.

For full information on your rights and how we collect, use, protect your information and please go to https://www.chequeexchange.co.uk/privacy-policy or contact us on 0800 1959 530.

Cheque Exchange Ltd is a wholly owned subsidiary of Vanquis Banking Group plc.

Privacy Policy

Introduction

Data protection legislation (which includes the General Data Protection Regulation or GDPR) places obligations on us Cheque Exchange Ltd in relation to the way that we handle your personal information. We must process your information fairly and lawfully. This also means you are entitled to know how we intend to use your information. You can then decide whether or not you want to give it to us so that we can provide the product you require. All our employees are responsible for maintaining customer confidentiality. We provide training to all our colleagues to remind them about their obligations. In addition our policies and procedures are regularly audited and reviewed.

The identity of the controller and their contact details

Your information will be held by Cheque Exchange Ltd who is a wholly owned subsidiary of Vanquis Banking Group plc. Cheque Exchange Ltd is part of the Vanquis Banking Group, which includes other companies such as Vanquis Bank Ltd and Moneybarn Ltd. More information on the Vanquis Banking Group can be found at https://www.vanquisbankinggroup.com

The identity of the Data Protection Officer

Cheque Exchange Ltd has a Data Protection Officer to ensure that your personal data is being treated fairly and lawfully and protected at all times. If you need to contact the DPO please email informationrequests@cheque-exchange.co.uk, write to Rights Request Team, Cheque Exchange Ltd,1 Godwin Street, Bradford West Yorkshire BD1 2SU, or call 0800 1959 530

Categories of personal data processed

We only collect the data we need to provide you with the product or service you require and to administer your account(s) with us. In most cases this will mean that we are processing personal data such as:

Customer transaction:

1. Information required on your transaction form such as name, address, date of birth etc.

2. Information provided to us by the Credit reference and fraud prevention agencies to verify your identity

Agency Application:

1. Information required on your application form such as name, address, income, outgoings etc.

2. Information provided to us by the Credit reference agencies on your finance with other credit/lending organisations

3. Any additional information you provide whilst we are administering your account such as changes in personal circumstances.

Where we obtain your personal data from

Your personal information will be held securely so that we and any other companies in the Vanquis Banking Group that you have dealings with (either now or in the future) can manage your relationship with us/them. This will include information you provide when you apply to us and any additional information provided by you or others in various ways, including but not limited to;

1. In applications, emails, letters, phone calls and conversations, when registering for services, in customer surveys, when you participate in competitions, through our websites and during conversations about your account

2. From information we receive from others such as credit reference agencies and fraud prevention agencies.

3. From our agents (CEL Agents)

4. From the use of data obtained from social media sites by matching email address with social media accounts.

Why we process your data

As a business we use data we obtain from you and data we collect about you to perform a number of activities. Under data protection legislation we are only permitted to use your personal information when we have a legal basis that permits us to do so. We set out below an overview of the purposes for which we use your personal information and, in each case, the legal basis that permits us to use that information.

Processing your data as a Legitimate Interest

The Vanquis Banking Group companies as outlined above will share your information amongst each other for the following administrative activities where we have a legitimate business need;

a) Managing your relationship with each company and notifying you of any changes to those products and services.

b) Responding to your queries and complaints.

c) Administering offers, competitions and promotions so that you are provided with the most appropriate product or service enhancement for your needs.

d) Updating, consolidating and improving the accuracy of our records by sharing any updates to your personal data, for example if you change address.

In addition, we will share and individually use each other's customer data for the following legitimate data usage across all companies in our group;

e) Transactional analysis.

f) Arrears and debt recovery and debt sale activities including where we may need to trace your whereabouts.

g) Crime detection, prevention and prosecution.

Some of this sharing will be done on an individual basis, in other cases the data is shared using secure data transfer or is uploaded into a central database repository where we are able to apply strict controls over the security and access to the data. By sharing this information it enables our group companies to better understand your needs and run your account(s) responsibly and in the efficient way you expect.

Sharing your information to assist with asset buying or selling

We will undertake this processing under a legitimate business interest. Cheque Exchange Ltd may in the future wish to sell, transfer or merge part or all of its business assets or to acquire a business. If so, we sometimes disclose your personal information to a potential buyer, merger partner or seller so long as they agree to keep it confidential and to use it only to consider the potential transaction.

Using your details for service contact

We will undertake this processing under a legitimate business interest. Making sure we deliver excellent customer service is important to us and to do this various methods of communication may be used when sending you information about your account. Sometimes this may be by SMS, or Email. For example this may include sending you information in relation to the administration/servicing of your account. We will always ensure that we are not putting your data at risk. If you have requested that we email you information relating to your account we will ensure that we have explained the risks of sending an insecure email and that you are happy to accept that risk.

Viewing information on public and external websites

We will undertake this processing under a legitimate business interest. As part of our ongoing commitment to understanding our customers better, we value the opportunity to see the views and opinions made in relation to our business. We do this by scanning public and external websites, social media sites and related mobile apps to collate comments and opinions which may help us to improve our products and services. The majority of the information collated will be aggregated or anonymous.

Using your information to improve our performance

We will undertake this processing under a legitimate business interest. We may use your information to make sure we give you and other customers the best possible service. This could include where we need to perform testing on new and existing systems, are upgrading existing systems or undertaking transactional analysis.

How we use Fraud prevention agencies

We will undertake this processing under a legitimate business interest. If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention Agencies. Law enforcement agencies may access and use this information. We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

1. Checking details on applications for credit and credit related or other facilities.

2. Managing credit and credit related accounts or facilities.

3. Tracing your whereabouts and recovering debt that you owe.

4. Verifying your identity if you or a financial associate applies to be become an agent

5. Undertaking statistical analysis and system checking.

6. Checking details of job applicants and employees.

Please contact us on 0800 1959 530 if you want to receive details of the relevant fraud prevention agencies. We and other organisations may access and use the information recorded by fraud prevention agencies from other countries.

Processing your data for legal reasons

We will treat your information as private and confidential, but may share it with other Group companies and only disclose it outside the Group if we are legally obliged to do so or required to do so to satisfy a court order. Examples of this are:

1. Passing information to HMRC (in the UK) and the revenue commissioners' (in the ROI) where a court order is in place.

2. Required by the Police and other law enforcement agencies to investigate or prevent crime.

3. Required by the authorities when we report on any suspicious activity that could indicate money laundering.

4. Required to undertake internal audit activities to examine and evaluate the effectiveness of our internal systems and controls.

Processing your data with your consent

There will be circumstances where we will only process your data if we have your consent to do so. For example, if you provide us with data that is classed as a special category of data such as health information, we will only process this with your permission (unless we feel the processing is necessary to protect your vital interests). You have a right at any time to ask us to stop the processing of that specific data.

How we manage your special categories of personal data

Data Protection Legislation define certain information as special categories (racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual life, biometric and genetic data). As part of your ongoing relationship with us we may be provided with such information. We will always ask your explicit consent to process this information (unless we feel the processing is necessary to protect your vital interests). We may share it with other parts of the Vanquis Banking Group and our subcontractors to keep your records up to date.

Third parties using your data for direct marketing

Unless you have given us your consent, we will not provide information about you to other companies outside the Vanquis Banking Group to use for their own marketing purposes.

Your rights

You have a number of rights in relation to your personal data. For example you can ask for a copy of your personal data through a Subject Access Request, you can ask for your information to be corrected if it is inaccurate, you can ask for the processing of your data to be restricted whilst we may be resolving an issue, you can ask for your data to be deleted, and you have the right to data portability. See below for further details. If you wish to exercise one of your rights please email informationrequests@cheque-exchange.co.uk, write to the Rights Request Team, Cheque Exchange Ltd, No 1 Godwin Street, Bradford, BD1 2SU, or call 0800 1959 530 providing as much information as possible to enable us to locate your information. Once we have everything we need to locate your information we will supply this to you within 30 days of this date.

Your right to object

You have a right to object to any processing activity where the business states it has a legitimate business need to use your data in the way described. If you need to contact us please email informationrequests@cheque-exchange.co.uk, write to the Rights Request Team, Cheque Exchange Ltd, No 1 Godwin Street, Bradford, BD1 2SU, or call 0800 1959 530 providing as much information as possible to enable us to locate your information. Once we have everything we need to locate your information we will supply this to you within 30 days of this date.

Your right to data portability

Data Protection legislation contains a right to data portability that may give you a right in some data processing contexts, to receive your personal data in a portable format when it is processed on certain grounds, such as consent. If you wish for this limited data to be "ported" to another organisation direct, please contact us at informationrequests@cheque-exchange.co.uk, write to the Rights Request Team, Cheque Exchange Ltd, No 1 Godwin Street, Bradford, BD1 2SU, or call 0800 1959 530 providing as much information as possible to enable us to locate your information. Once we have everything we need to locate your information we will supply this to you within 30 days of this date.

Obtaining a copy of your data

You have a right of access to a copy of the personal data we hold about you. Please email informationrequests@cheque-exchange.co.uk, write to the Rights Request Team, Cheque Exchange Ltd, No 1 Godwin Street, Bradford, BD1 2SU, or call 0800 1959 530 providing as much information as possible to enable us to locate your information. Once we have everything we need to locate your information we will supply this to you within 30 days of this date.

Using cookies and IP addresses

By visiting our websites, we may collect your IP address using cookies. Your IP address is a unique identifier for your computer or other access device. We do not use your IP address to identify you. Cookies are used to store small amounts of information on your device, which allows certain information from your web browser to be collected. We have a legitimate interest to use cookies for certain activities; other cookies will require your explicit consent. For further information in relation to these, please go to our Cookie Policy: https://www.chequeexchange.co.uk/cookies.

Who do we share your data with

We use a number of third party companies to help us to manage your account and to deliver the service you expect. Examples of where we may employ the services of a third party are;

1. To help send out electronic, written or voice communications to you.

2. To provide IT support.

3. To provide us with software and systems to help manage your account and the activities we need to complete.

4. To help prevent fraudulent transactions or online security/fraud threats.

5. To help collect outstanding debt payments

Cheque Exchange Ltd will ensure that it and any third parties whom it engages to process Personal Data on its behalf will process the Personal Data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Cheque Exchange Ltd will ensure that a written contract (a 'Data Processor Agreement') is put in place with third party processors and the terms of that Data Processor Agreement will comply with requirements of the Data Protection Legislation.

Processing your data outside the UK and EEA

We sometimes use third parties based outside the UK and European Economic Area. For example some of our IT administrative activities are supported by third parties based in India and Israel. We will always ensure they will protect your information to EU standards.

If we do transfer information outside of the UK and EEA, we will make sure that it is protected in the same way as if it was being used in the UK and EEA. We'll use one of these safeguards.

1. Transfer it to a non-EEA country with privacy laws that give the same protection as the UK or EEA. Learn more on the European Commission Justice website. (http://www.ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm).

2. Put in place a contract with the recipient that means they must protect it to the same standards as the UK or EEA. Read more about this here on the European Commission Justice website. (http://www.ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm).

Sometimes these organisations may disclose information to foreign authorities in the fight against crime and terrorism where they are legally obliged to do so.

How long do we keep your data for

As a regulated business we are often required to hold personal data for set periods of time. There may also be certain legal requirements to hold onto data. We have a legitimate business need to keep data for a certain period of time. We operate to an approved set of retention schedules which identify the type of data held and for how long. A key retention periods is that most customer data will be held for up to 6 years after the end of the relationship.

If you require details on retention periods for any other type of data held please contact us on email informationrequests@cheque-exchange.co.uk, write to Rights Request Team, Cheque Exchange Ltd,1 Godwin Street, Bradford West Yorkshire BD1 2SU, or call 0800 1959 530

Information Commissioner

Further information on your data privacy rights are available on the website of the Information Commissioner's Office at https://www.ico.org.uk

Changes to this notice

We keep our privacy policy under regular review. This notice was last updated March 2023.