This is the website of Whichdeal Limited, operating under the trading name of Creditplus. Creditplus is authorised and regulated by the Financial Conduct Authority under Registration number 456327. We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration number Z8890305.
If you have any questions about how we collect, store or use your personal data, our contact details can be found under the ‘How to contact us’ section of this notice.
· sets out the types of personal data that we collect.
· explains how and why we collect and use your personal data.
· explains when and why we share personal data within and outside this company.
· explains who we share personal data with outside this company.
· explains how long we store your personal information; and
· Defines the rights and choices you have regarding your personal data.
This section explains what personal data we may collect when you use our services. Personal Information is any information which we would reasonably expect to identify you as an individual. The application form highlights which information is mandatory for you to enter into a contract with us and failure to provide such information may result in your application being declined.
· Your personal details may include your full name and title, your postal and billing addresses, phone numbers and date of birth.
· Images collected by way of CCTV, Body Worn Cameras and Facetime.
· Your IP addresses and email address.
· Your previous address history.
· Your bank account, credit/debit card details and transaction history.
· Details of your expenditure.
· Passport information.
· Driving licence information.
· Your employment details including length of service, name and address of employer and your job title. We may also need to verify your identity by contacting your employer.
· Information regarding other members of your household and any dependents.
· Information as to whether you are a ‘PEP’ (Politically Exposed Person) or any connection you have with a ‘PEP’.
· Insurance information.
· Credit history.
· Stored records will include the details of the vehicle (including make, model and registration number) or product that you purchased/hired, when and where you bought it and how much you paid for it.
· As we are committed to our responsible lending obligations, our employees will carry out due diligence checks on all applicants to determine whether your personal circumstances or a characteristic identifies you as a ‘vulnerable customer’ (a person who may be vulnerable to financial detriment’). In these circumstances, we will also collect personal sensitive information such as your health information in respect of any disability, illness or impairment.
· Personal sensitive information may also include closely protected data such as criminal convictions. It is not necessary for us to collect personal sensitive data unless you have volunteered this information to us or if you are considered by us to fall within our defined category of a ‘vulnerable customer’). By providing this information to us, you agree that you do so voluntarily, and we may use this information to determine whether the products or services that we offer are suitable for you.
· Your account logins such as your username and passwords that you have chosen.
· Details of your visits to the website and the resources that you access which may include traffic data and communication data.
Data is also collected to reduce and identify fraud and protect your identification.
We collect information about you for several different activities as described below:
· You may wish to apply for any of our products or services.
· You may wish to enquire or provide information to us.
· Information may be collected from third parties including credit reference agencies, market information sharing databases, motor dealers, brokers or introducers including authorities responsible for tax or fraud prevention.
· You may wish to apply for a job advertised by us.
· You may request information from us or raise a complaint.
· Features on our website may require your information for it to be used.
As part of assessing your application for credit, to confirm your identity, to prevent fraud and to prevent money laundering, we may;
· search the files held by credit reference agencies, Equifax and/or Experian, (or any other credit reference agency that we may use from time to time). Who will record any credit searches on your file. For further information on how credit reference agencies use your personal information, please Visit: http://www.experian.co.uk/crain/index.html; and
· To disclose details of how your account is conducted to such agencies. The information will be used by other credit grantors for making credit decisions about you and the people with whom you are financially associated, for fraud prevention, money laundering prevention and occasionally for tracing debtors. Information used for these purposes will include publicly available information such as electoral roll, county court judgments, bankruptcy orders or repossessions. We will also pass on any information you provide to us and any information we collect from other sources about you to potential lenders and insurers (if you have requested guaranteed asset protection, return to Invoice or extended warranty products) and to affiliates solely for analysis purposes.
If your application is declined by all of our available lenders, your personal data and information may be passed to a 3rd party lender for consideration for alternative financial products.
5.1 Internal Processing – The following internal uses may be;
· Your information will be used for allowing us to quote or provide the service or product that you applied for.
· We will use your information to compare the best services and rates available from our panel of lenders. Once an initial comparison has been completed, we will share your information to our carefully selected lenders to provide you with a service or product which is suitable for your needs.
· If your application is considered appropriate and meets our own lending criteria, our in-house underwriting team shall consider and process your application on behalf of our lender, whom we act as a Credit Intermediary. This process will involve the evaluation of risk and credit checking and automated decision/credit checking processes.
· Credit checking (both Soft and hard searches) is carried out by us to include identification, verification and bankruptcy checks in line with our anti-money laundering procedures.
· Any applications assessed by our in-house underwriting team (see 5.3) will be subject to automatic decision making (automatic credit scoring) in the first instance. Should the application be declined solely due to automatic decision making, you will be informed of the outcome of the scoring process and should you wish for your application to be re-assessed manually, our friendly team will be happy to carry out the request on your behalf.
· We will keep your data on file and this information will be updated where necessary. We shall also monitor your account to ensure that it is only being used by you or a nominated person when you have given consent.
· Should you wish to apply for a joint application, we will require the full details of the joint applicant. We will request for evidence that you have obtained the joint applicant’s permission to share their personal information. To process the application, it will be necessary for us to communicate with and verify the identity of the joint applicant in line with our data protection and anti-money laundering procedures.
· Our Collections Department will consider your information in the interests of forbearance if you find yourself in financial difficulty. Your information may also be used to recover any debt/money that you owe us in line with our litigation procedures.
· Should there be problems with our website, we may also use your data to improve its performance or to troubleshoot any problems.
· Our web server automatically recognises each visitor to our website and does not record information regarding the domain or e-mail address. We collect the e-mail addresses of those who communicate with us via e-mail or by applying, aggregate information on what pages consumers’ access or visit, user-specific information on what pages are visited, and information volunteered by the consumer e.g. survey information or site registrations.
· We will record and store all incoming and outgoing telephone calls for our internal quality control purposes. In the interest of security and compliance, credit, debit card and account information will not be recorded.
5.2 Maintaining a relationship
· We may contact you to provide general marketing information. Activities would include regular newsletters, invitations to questionnaires and general promotional information. You will be required to ‘opt in’ to this service and specify the means of contact (i.e. by post, email, SMS or by telephone). You will have an option to withdraw your consent at any time to this type of marketing. If you consent to this marketing, your details will remain on our marketing list for 2 years after you are no longer considered to be a customer of Creditplus/ or 2 years at the end of the life of the product/service that you purchased, whichever is later.
· Should an incomplete application be submitted, we will use your data to contact you for further information.
· Any information we collect is used to improve the websites content and/or layout, and to inform visitors of offers and promotions associated with Creditplus. If you have signed up via email or SMS to receive blog content or a report from our website, we will not pass your details to third parties, unless you have given explicit consent to do so.
5.3 Providing training - We may use your data for training purposes to improve and enhance the service that we provide.
5.4 Statistical Purposes and Reviews - Your information may also be used to ensure that the website remains effective and to provide site performance, system administration and evaluate the use of the site to provide you with an improved service.
5.6 Responding to Complaints - We will use your data to respond directly to you. In the first instance, we will acknowledge your complaint with a copy of our complaints procedure and keep you updated as to the progression of our investigation. We may, if appropriate and necessary, consult with third parties such as dealerships, expert engineers or relevant lenders to collate correct information and obtain advice to enable us to make informed decisions and to respond appropriately. Please see the list of third parties at the end of this policy for further information.
5.7 Legal Reasons
· Due to the regulated nature of the business, we are required to retain data for auditing purposes.
· We are obliged to disclose information with the appropriate authorities including law enforcement to detect, investigate and prevent crime including fraud and money laundering. We may also be required to respond and be involved in any legal proceedings, prosecution, court orders, regulation or law.
· In circumstances whereby, suspicions may be raised internally, by a fraud/crime preventing authority or we receive intelligence by another with regards to the validity of your application or identity, we reserve the right to decline the provision of any service or product that you have applied for or suspend any service that you currently have ongoing.
· Fraud Protection Agencies may retain a record of your personal details and share it with other companies/agencies should your record be considered as a risk to future applications that you may make. This may result in a refusal for future job applications or re-financing to obtain credit.
· Whilst any information that we collate will not be kept for any longer than is deemed necessary, the processing of your data is a contractual requirement.
· Under our obligations under The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, record keeping including details of customer due diligence and supporting evidence of business relationships need to be kept by us for five years at the end of the business relationship to enable us to reconstruct the transaction unless we have reasonable grounds to believe that the records need to be held for legal proceedings. The storage of this information may be extended if you have given your consent or if we are legally obliged to do so.
5.8 CCTV and Body Worn Cameras (BWC)
· Body worn video cameras are wearable video and audio devices worn by our delivery drivers for the purposes of health and safety and crime prevention reasons. These devices are not used for viewing documents.
· Images are collected and stored on the devices’ encrypted memory card and as soon as practicable, data is transferred for long term storage and deleted from the portable device. This is to allow information to be recovered in response to any subject access requests. This data may also be disclosed to law enforcement agencies and used in respect of any potential legal proceedings.
· Customers are advised Automated Number Plate Recognition Technology is used for access to our premises and is controlled by a third party. Should you wish to attend our offices, you may be asked for your personal information and reasons for your visit for authorised access to be granted. CCTV cameras are installed throughout the vicinity of our premises for deterring and detecting crime.
· Third-party dealerships involved in tri-party agreements are expected to identify and verify applicants online with enhanced anti-money laundering requirements and customer due diligence. This may involve the use of videotelephony communications.
When we share your personal data, we require those parties to keep it safe and they must not use your personal data for their own marketing purposes. We do not accept liability for the failure of data protection practices carried out by third parties of which we have no control. However, we shall inform you if we believe that a security breach may have occurred and if your data has been in anyway compromised
We will share your data with our affiliates for administering our business and maintaining our business relationships. These may include our advisors who provide compliance and legal advice and support our legal function.
We use service providers to enable us to carry out certain duties within the business such as email distribution companies, electronic signature processing, data storage and IT services.
Due to the nature of our comparison business, your details may be shared with third parties on applying for finance with us, as per our terms and conditions. Should you wish for your personal data to be removed, we will contact all third parties to also require that they also remove their data.
Upon making an application with us, we will assess whether we can assist. Should we be unable to provide our services, your data will be provided to a third party who will contact you to offer their services. Information as to the contact details are provided at the end of this policy.
6.1. Credit reference Agencies
· Unlike most car finance providers, when you apply through us, we carry out a ‘soft credit search’ to identify which lenders may be suitable. The soft credit search, also known as a 'quotation search' allows us to examine all the important details we need to see your creditworthiness and compare more than 90 lending options without leaving a footprint on your credit file.
· The Credit Reference Agency will provide a credit scoring computation and your score will determine which lenders may be suitable. You will be advised of which options are available and we will obtain your explicit consent to proceed with your application which will involve passing your information to your desired lender for them to perform a hard credit search on your file. Those hard searches will be recorded on your credit file to allow other lenders or organisations information as to how many times your credit information has been accessed.
· As we act as a Credit Intermediary to one of our panelled lenders, we have in-house underwriters to carry out the administration of the applications and agreements finance agreements on their behalf.
6.2. Third-party companies such as Warranty and GAP providers
· We offer a range of different products and services for example warranties, gap insurance and car valuations. Full information as to our panelled suppliers of these products and services can be found on our website and also in correspondence and documentation which will form part of your finance package.
· If any product such as warranty is included within the purchase of your vehicle, we will pass your data to the third party to allow for the service to be affected for your use. Consent to pass this information will be obtained from you whilst processing your application.
· Products which are available for purchase, such as GAP cover, will require your information to be passed to the relevant provider at the point of sale. The provider will contact you separately to confirm that a contract with them has been set up in accordance with your instructions.
· We may share information with insurance and warranty providers to underwrite, process, claim handle or prevent fraud.
6.2. Dealers - Due to this company operating at distance, it may be required for third party dealerships involved in your prospective transaction to undertake identification checks on our behalf. The dealership may be required to utilise video conferencing to confirm that you are the applicant of the agreement and to carry out enhanced money laundering checks by way of obtaining and providing to us verification of your ID.
6.3. Third-party Lenders - Your application, including your personal data will be provided to a third-party lender following the completion of the soft search (see section 6.7). If your application is declined by all of our available lenders, you may be considered for alternative loan options taking into consideration your circumstances. Those third-party lenders may carry out further searches against you to access your credit score and to establish whether they may be able to assist further. Details of the prospective lenders are available to you by contacting us by email to Data.Protection@creditplus.co.uk
6.4. Others - We may be required by law to exchange and share your information with other organisations in the following circumstances:
· We may be required by law to exchange and share your information to fraud prevention agencies to verify your identity and prevent crime.
· We may need to share personal data to establish, exercise or defend our legal rights. Furthermore, we may share your information to identify, contact or bring legal action against someone who may causing injury or who may interfere with our property, employees, users of the website or anyone else who may be affected or harmed by those activities.
6.5. The Sale of the Business - If we sell or transfer any part of our business or enter into negotiations to sell or transfer the business), the successor of the title of the business may use your personal data in the same way as adopted under the terms of this privacy notice.
6.6. The Recovery of Debt - To assist in the recovery of debt or monies outstanding on your account, we may exchange information with third parties such our lawyers, enquiry agents, High Court Enforcement Agents and any other relevant organisation including other lenders. We reserve the right to sell aged debts to debt recovery agencies.
Creditplus is based in the UK however information shared by us may include with third parties who are located within the UK or within the European Economic Area. Any information transferred to these locations are protected by the General Data Protection Regulation. Companies operating outside of the European Economic Area may not be protected by the same quality of legal protection however we will only transfer data if we are satisfied that compliance is met with applicable privacy laws and appropriate contracts are put in place and adhered to.
We use computer safeguards such as firewalls and data encryption, and we enforce physical access controls to our buildings and files to keep this data safe. We only authorise access to employees who need it to carry out their job responsibilities and we continuously screen employees after their appointment for any undisclosed criminal or financial implications.
We enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal data.
We carry out enhanced data protection procedures to verify your identity before we share your personal data with you. This includes obtaining your consent to share the information with another person whom you have previously given authorisation to speak on your behalf.
We will not reveal over the telephone or by email any banking or financial information when confirming an order or providing a refund.
Whilst we take appropriate technical and organisational measures to safeguard your personal data, we cannot guarantee the security of any personal data that you transfer over the internet to us.
In the unlikelihood that we become aware of a security breach involving your personal data, our dedicated Data Protection Team will be responsible for informing the Information Commissioner’s Office (ICO) and you as to the details of the breach. You will be notified of any breach which may give rise to any detriment to you and/or your personal data.
Upon making an application to us, you will have a choice to opt in to general marketing and market research (please see section 5.0). Your information will only be used upon receiving your explicit consent to use your information. You may receive this information by telephone, SMS, letter or email. All communications sent to you will give you information as to how you can unsubscribe from the marketing communications and electronic communications will include a link to enable you to opt out.
We will refer your personal information to third party companies, if we consider that there is a legitimate interest in doing so. Details of those companies are noted at the end of this policy. Marketing by third parties will be limited to activities specific to your needs.
10.1 Notwithstanding our investment into security and firewalls to protect your data and our website, it is still nevertheless not 100% guaranteed that any communication via email cannot be intercepted. On this basis, we cannot accept liability for any unauthorised or unintended access that is beyond our control.
Due to the nature of our business, our policy is not to actively market our products or services or encourage interaction with minors (i.e. with anyone under the age of 16). Anyone under this age may only use their site with parental consent. We do not knowingly collect data from anyone under the age of 16.
Parents/ Guardians should monitor and supervise their children’s internet usage and ensure parental controls and tools are in place.
You can also contact us directly over the phone on;
Tel: 0333 600 0290
Overseas: 0333 600 0290
When you call, ask to be put through to the Complaints department and a member of our team will connect you. Your complaint will be acknowledged within 5 working days of receipt. We'll then attempt to resolve the complaint as quickly as possible, liaising with you to keep you updated of the process throughout.
If you're still unhappy after we've resolved your complaint, you can then take it to the Financial Ombudsman Service (if 8 weeks has passed since the initial complaint).
The contact details for the Financial Ombudsman Service are as follows:
Tel: 0800 023 4567
Overseas: 0300 123 9123
Address: The Financial Ombudsman Service
London E14 9SR
You may also lodge your complaint with the Information Commissioner’s Office (ICO) if we have been unable to resolve the complaint to your satisfaction. The ICO may be contacted on 0303 123 1113 or https://ico.org.uk/concerns/.
Under the new data protection law starting in May 2018 we have several lawful reasons that we can use (or 'process') your personal information. One of the lawful reasons is called 'legitimate interests'.
Broadly speaking Legitimate Interests means that we can process your personal information if:
So, what does this mean? When you provide your personal details to us we use your information for our legitimate business interests to provide you with information regarding car finance options in the market place and to sell and deliver vehicles across the UK. Before doing this, though, we will also carefully consider and balance any potential impact on you and your rights. We will process the personal information you have supplied to us to conduct and manage our business to enable us to give you the most appropriate marketing, information, service and products and provide the best and most secure experience. These are what we consider to be our 'Legitimate Interests'. We only use individual’s data in ways you would reasonably expect and will continue to monitor the safeguards that we have put in place to reduce any impact and if circumstances change.
14.1. Legitimate Interest Assessment - We have conducted a Legitimate Interest Assessment (LIA) and identified the relevant legitimate interests that we rely on. Some typical examples of when we might use the approach are for;
· direct marketing
· maintaining the security of our system
· enhancing, modifying or improving our services and
· identifying usage trends.
14.2. Your interests - When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Remember, you can change the way you hear from us or withdraw your permission for us to process your personal details at any time by emailing: firstname.lastname@example.org
We are committed to protecting the rights and freedoms of our customers and to ensure that the processing of your data in kept safely and securely in accordance with all our legal obligations. We hold personal data about our employees, clients, suppliers and other individuals for a variety of business purposes.
§ Circumstances for retaining personal data = Length of time that we retain your data
Under the General Data Protection Regulations 2018 you have the right to
16.1 Be informed - The right to be informed encompasses our obligations to provide ‘fair processing of information’. This privacy notice provides all information regarding how your data is stored.
16.2 The right of access - You have the right to access your personal data and supplementary information. You have the right to see the personal data we hold about you. This is called a Subject Access Request.
16.3 The right to rectification - You have the right to have any incorrect or incomplete data to be rectified. Please contact us should you require any amendments to be made to the data we store.
16.4 The right to erasure - The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to allow you to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
16.5 The right to restrict processing - You have a right to ‘block’ or suppress processing of personal data. When processing is restricted, we are permitted to store the personal data, but not further process it.
16.6 The right to data portability - The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. We will provide copies of your personal data in a machine-readable format, for example, Excel or CSV.
16.7 The right to object - You may object to our processing of your personal data for direct marketing (including profiling).
16.8 The right not to be subject to automated decision making (including profiling). - You may opt out of any automated decision making (including profiling) which we conduct. You can request to obtain human intervention of any automated decisions, express your point of view or contest the automated decision (e.g. an automated creditworthiness assessment).
If you would like a copy of the personal data we hold about you, or would like to exercise your rights as detailed above, please write to:
Whichdeal Ltd t/a Creditplus
52 Willis Way
There will be no charge for a copy of the information however we reserve the right to charge a reasonable fee or refuse to respond when a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee to comply with requests for further copies of the same information. Information will be sent to you at the latest and within one month of the date of receipt of the Subject Access Request. We may extend the period of compliance by a further two months where the request is complex or numerous and we shall keep you updated as to why the extension is necessary.
Our postal address is:
52 Willis Way
Our Freephone telephone number is: 0333 6000 290
Our email address is email@example.com.