Using my personal data

How we use your personal data

When you applied for a financial product or service with Santander International you will have been given a Data Protection Statement, explaining how we would treat your personal data.

The Data Protection Statement explained

Introduction

This section sets out who the Data Controller is and provides contact details for the Data Protection Officer (‘DPO’).

In this Data Protection Statement ‘we’ or ‘Santander International’ means Santander Financial Services plc. In legal terms Santander International, which is the trading name of Santander Financial Services plc, is designated as the Data Controller because it is the entity that (either alone or jointly with others) determines the purposes and means of the processing of your personal data.

If you have any questions about how your personal data is used, or the information included in this booklet, our DPO can be contacted at Santander International, 13-15 Charing Cross, St Helier, Jersey JE2 3RP or by email at DPO@santanderinternational.co.uk.

The types of personal data we collect and use

The sort of personal data we collect and use will vary depending on the products or services you require or have, and your preferred relationship with us.

Whether providing your personal data is required by law or contract or not

You will be told whether the provision of your personal data is optional or mandatory.

If the provision of the data is mandatory and we don’t already hold it then you will need to provide the information so that we can process your application, service and maintain your account.

Monitoring of communications

This section explains why we may monitor your on-going communications with us.

This includes us monitoring our communications with you for the following purposes:

• so that we comply with regulatory rules, or our own internal process and protocols relevant to our business and the services we provide;
• to prevent or detect crime;
• in the interests of protecting the security of our communications systems and procedures;
• for quality control and staff training purposes; and
• when we need to access these as a record of what we have said to you/what you have said to us. For example, where we are required by the UK Financial Conduct Authority (‘FCA’), the Isle of Man Financial Services Authority (‘IOMFSA’) or the Jersey Financial Services Commission (‘JFSC’) regulations to record certain telephone lines we will do so.

Our monitoring will also check for obscene or profane content in communications.

In very limited and controlled circumstances we may conduct short-term and carefully controlled monitoring of activities on your account or service. This will only be done where this is necessary for our legitimate interests, or to comply with legal obligations – for example, if we have reason to believe that a fraud or other crime is being committed, and/or where we suspect non-compliance with anti-money laundering regulations to which we are subject.

Using your personal data: the legal basis and purposes

This section describes how your personal data may be used, and the legal basis for the processing of your information. The legal basis for us processing or analysing your personal data will depend on the service being provided.

Data Protection legislation allows us to process your personal data for our own legitimate interests – provided those interests don’t override your own interests and/or your fundamental rights and freedoms.

An example of ‘legitimate interests’ would be if you believed you were the victim of a fraud or scam, and you asked us to investigate your claim.

To understand what has happened we may need to share your name and account number, the details of any payment(s) made and details of the case with the other bank(s) involved, so they could trace transactional activity, help to recover any of your monies that may remain and reduce the opportunity of the funds being used to support criminal activity. Therefore, the sharing of your data with the bank(s) involved falls within your legitimate interests as well as ours – to ensure that funds are prevented from being used for fraudulent and/or money laundering activities. Please note: The bank(s) we may share your data with may be located outside of the UK or a Crown Dependency, and therefore may not be subject to the same data privacy legal obligations as banks within the UK or Crown Dependency.

Complying with established legal obligations is another reason for us to share your personal data. For example, if you require us to transfer funds via CHAPS or internationally, via SWIFT your personal data may be provided to overseas authorities and the beneficiary bank to comply with applicable legal obligations and to prevent crime. This may require us to share your personal data outside of the UK or Crown Dependency. This information may include your full name, address, date of birth and account number – and by making your payment instructions to us, you consent to us sharing personal information to overseas authorities and beneficiary bank(s) as appropriate. We are also required to exchange tax information for tax transparency purposes.

Consent for processing of special categories of personal data, at your request, must be explicit. For example:

1. 1. If we require a copy of your passport (as a new customer) and if that reveals your racial or ethnic origin data, by providing a copy you will be explicitly consenting to us seeing your racial or ethnic origin in this way.
   2. If you volunteer data concerning your health when we ask you about the conduct of your account you will be explicitly consenting to us processing this personal data in connection with your account.

Under Data Protection legislation you can withdraw your consent at any time. If you do this, and if there is no alternative lawful reason that justifies our processing of your personal data for a particular purpose, this may affect what we can do for you.

For example, it may mean that if you have arrears on your account, we can’t take into account any personal data concerning your health, which may result in us being unable to provide you with a service that you had requested.

Sharing of your personal data

This section details when personal data may be shared, and the types of people/organisations it can be shared with.

Subject to applicable data protection law in the United Kingdom, the Isle of Man and/or Jersey we may share your personal data with the Santander group of companies, as defined in the Glossary of Terms under the heading of Group companies, and associated companies in which we have shareholdings and employees, officers, agents or professional advisors of these companies, some of whom may be in other countries.

As outlined in our General Terms and Conditions we will ensure your information is used in line with our own strict confidentiality policies and as required under data protection legislation in the relevant jurisdiction.

We may also share your personal data with:

• Service providers and business partners. We may share your personal information with our service providers and business partners that perform marketing services and other business operations for us. For example, we may partner with other companies to process secure payments, fulfil orders, optimize our services, send newsletters and marketing emails, support email and messaging services and analyse information.
• Protection of rights and other legal purposes. We may share the information we collect, including personal information, with any law enforcement agency, court, regulator, government authority or other third party where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
• Asset purchases. We may share the information we collect, including personal information, with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this Privacy Statement.
• Fraud prevention agencies and credit reference agencies as detailed further below.

International transfers

Where we transfer your personal data outside of the United Kingdom, the Isle of Man or Jersey, appropriate safeguards will be put in place to protect that data.

Safeguards can include:

1. 1. Contractual Clauses. You can obtain a copy of these by contacting our DPO.
   2. Binding Corporate Rules, provided the recipients in other countries have obtained the requisite approvals.

Identity verification and fraud prevention checks

Your personal data can be used to check your identity and for fraud prevention and anti-money laundering purposes. To find out more, refer to the ‘Fraud prevention agencies explained’ section.

Credit reference checks

We may share your personal data with credit reference agencies. To find out more, refer to the ‘Credit reference agencies explained’ section.

Your marketing preferences and related searches

We may use your information for marketing and market research purposes. You can tell us at any time that you don’t want to receive marketing or market research requests.

You can provide your specific marketing preferences as part of your application. Equally you can contact us at any time to provide and/or update those preferences.

Automated decision making and processing

This section explains what automated decision making is, and the circumstances when it may take place.

We may automatically process your personal data, without human intervention, to evaluate certain personal aspects about you (known as profiling).

In particular, we may analyse or predict (among other things) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your personal data. For example, we might analyse certain customer demographics, account holdings and account behaviours (such as Direct Debits you have set up on your accounts including those which identify accounts and products such as credit cards and store cards which you hold with other providers/ elsewhere) and look at details of transactions relevant to your accounts. We may also analyse events such as the maturity dates of your accounts and opening anniversaries.

We may use your personal data to assess lending risk. If we conduct automated decision making including profiling activity to assess lending risks, this will be performed on the basis of it being necessary to perform the contract with you or take steps to enter into that contract.

In some instances we may use automated processing and decision making, where relevant, to decide which of our other products or services might be suitable for you. We will look at the types of accounts that you already have with us, as well as your age, where this is relevant to the product we think you might be interested in. We may also conduct behavioural scoring, including by looking at the accounts and products you already have with us and how they are being used, such as account turnover, arrears and other indications of financial difficulties.

We may use the information from this activity to:

1. 1. Decide which other products and/or services from us or the Santander group of companies, might be suitable for you, and for which you might be eligible. These can include those products/services that are offered by us, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, and what marketing happens face-to-face when you visit us in-branch (this is what we mean in our Data Protection Statement when we refer to ‘marketing in-branch’).
   2. Send marketing communications to you and to conduct marketing in-branch to you.

In addition, when we provide a product or service to you, we take into account other personal data that we hold about you – including how you use this and other accounts you have with us. We may use your personal data for statistical analysis and system testing. We do all this on the basis that we have a legitimate interest in protecting our business, to understand your needs and provide a better service to you, and to help us develop and improve our products and services.

Where profiling is based on legitimate interests you have the right to object to that processing.

Criteria used to determine retention periods

This section within the Data Protection Statement explains the criteria we use when deciding how long personal data needs to be retained.

Your rights under applicable Data Protection law

This section lists the various data protection rights that you have.

Your personal data is protected under Data Protection legislation, and as a consequence you have a number of rights that you can enforce against us as your Data Controller. Please note that these rights do not apply in all circumstances. Your rights include:

• The right to be informed – including about how we might process your personal data. This was provided to you in the Data Protection Statement.
• To have your personal data corrected if it is inaccurate and to have incomplete personal data completed in certain circumstances.
• The right (in some cases) to object to processing of your personal data (as relevant). This right allows individuals in certain circumstances to object to processing based on legitimate interests, direct marketing (including profiling) and processing for purposes of statistics.
• The right in some cases to restrict processing of your personal data, for instance where you contest it as being inaccurate (until the accuracy is verified); where you consider that the processing is unlawful and where this is the case; and where you request that our use of it is restricted; or where we no longer need the personal data.
• The right to have your personal data erased in certain circumstances (also known as the ‘right to be forgotten’). This right is not absolute – it applies only in particular circumstances, and where it does not apply, any request for erasure will be rejected. Circumstances when it might apply include: where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed; if the processing is based on consent which you subsequently withdraw; when there is no overriding legitimate interest for continuing the processing; if the personal data is unlawfully processed; or if the personal data has to be erased to comply with a legal obligation.
• Requests for erasure will be refused where that is lawful and permitted under Data Protection law, for instance where the personal data has to be retained to comply with other legal obligations, or to exercise or defend legal claims.
• To request access to the personal data held about you and to obtain certain prescribed information about how we process it. This is more commonly known as submitting a ‘data subject access request’. Please do this in writing. This right will enable you to obtain confirmation that your personal data is being processed, to obtain access to it, and to obtain other supplementary information about how it is processed. In this way you can be aware of, and you can verify, the lawfulness of our processing of your personal data.
• To move, copy or transfer certain personal data. Also known as ‘data portability’. You can do this where we are processing your personal data based on consent or a contract and by automated means. Please note that this right is different from the right of access (see above), and that the types of data you can obtain under these two separate rights may be different. You are not able to obtain through the data portability right all of the personal data that you can obtain through the right of access.
• Rights in relation to some automated decision-making about you, including profiling (as relevant) if this has a legal or other significant effect on you as an individual. This right allows individuals, in certain circumstances, to access certain safeguards against the risk that a potentially damaging decision is taken without human intervention.
• To complain to the relevant Information Commissioner, the independent bodies empowered to investigate whether we are complying with the Data Protection law, based on the jurisdiction where your account is held. You can do this if you consider that we have infringed the legislation in any way. You can visit their websites for more information.
  
  United Kingdom: ico.org.uk
  Isle of Man: inforights.im
  Jersey: jerseyoic.org
  
  If you seek to exercise any of your rights against us we will explain whether or not that or those rights do or don’t apply to you with reference to the above, and based on the precise circumstances of your request.

Data anonymisation and aggregation

Your personal data may be turned into statistical or aggregated data, data that can no longer identify you.

Your personal data may be converted (‘anonymised’) into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data can’t, by definition, be linked back to you as an individual. This data might be used to conduct research and analysis, including to prepare statistical research and reports. This data may be shared in several ways, including with the Santander group companies, and for the same reasons as set out in the Data Protection Statement.

Updating our Data Protection Statement

We may update this data protection statement from time to time. When we change the data protection statement in a material way, this will be communicated to you together with the updated data protection statement.

Business Changes

If we or the Santander group undergoes a group reorganisation or is sold to a third party, your personal information provided to us may be transferred to that reorganised entity or third party and used for the purposes highlighted in this data protection statement.

Fraud prevention agencies explained

Before we provide financial services and/or financing to you, we undertake a series of checks – not only to verify your identity, but also to prevent fraud or money laundering. These checks require us to process your personal data.

What we process and share

The personal data we process and share is what you have provided us with, details we have collected from you directly, and/or information we have received from third parties. This may include your:

• Name
• Date of birth
• Residential address and address history
• Contact details, such as email addresses and telephone numbers
• Financial information
• Employment details
• Identifiers assigned to your computer or other internet connected devices, including your Internet Protocol (IP) address

When we and/or the fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest in verifying your identity and preventing fraud and money laundering, in order to protect our business and to comply with legal requirements. Such processing is also a contractual requirement of the services or financing you have requested.

We and/or the fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Automated decision making

As part of our personal data processing procedures, decisions may be made by automated means. This means we may decide that you could pose a fraud or money laundering risk if:

• our processing reveals your behaviour to be consistent with that of known fraudsters, or money launderers, or is inconsistent with your previous submissions/activity; or
• you appear to have deliberately hidden your true identity.

You have certain rights in relation to automated decision making processes. To find out more, refer to the ‘Your personal data rights explained’ section.

Consequences of processing

If we (or a fraud prevention agency) determine that you pose a fraud or money laundering risk, we may refuse to provide the financial services or financing you have requested, to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

Data transfers

Whenever fraud prevention agencies transfer your personal data outside of the UK, they take relevant steps to ensure your data is adequately protected, for example by imposing contractual obligations on the recipients of that data in order to protect it to the standard required in the UK.

Credit reference agencies explained

When we process your application, we will perform standard credit and identity checks on you with one or more credit reference agencies. Where we provide banking services for you we may also conduct periodic searches at the credit reference agencies to manage your account.

In doing this we will supply your personal information to the credit reference agencies and they will give us information about you. This, if applicable, will include information from any credit application you may make, information about your financial circumstances, and your financial history. The credit reference agencies will supply to us information that is in the public domain (including electoral registers), and shared credit, financial, and fraud prevention information.

We will use this information to:

• assess your creditworthiness, and whether you can afford to repay the financial product in question;
• verify the accuracy of the data you have provided to us;
• prevent criminal activity, fraud and money laundering;
• manage your account(s);
• trace and recover debts; and
• ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with the credit reference agencies while you have a relationship with us. We will also inform credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, credit reference agencies will record the outstanding debt. This information may be supplied to other organisations via the credit reference agencies.

When the credit reference agencies receive a search from us, they will place a search footprint on your credit file that may be seen by other lenders.

For more information about the fraud prevention agencies that we use, and how they will process your personal data, please contact:

The Compliance Officer, Cifas, 6th Floor, Lynton House, 7-12 Tavistock Square, London WC1H 9LT Email: compliance@cifas.org.uk Website: cifas.org.uk/privacy-notice

If you are making a joint application, or tell us that you have a spouse, civil partner or any other person you wish to hold an account with in joint names, we will link your records together – so you should make sure you discuss the application with them in advance, and share this information with them before making the application. The credit reference agencies will also link your records together, and these links will remain on your and their files until such time as you or your partner successfully file for a ‘disassociation’ with the credit reference agencies to break that link.

For more information about the credit reference agencies that we use and how they will process your personal data please contact:

Trans Union One Park Lane Leeds West Yorkshire LS3 1EP Telephone: 0330 024 7574 Website: transunion.co.uk/crain

Equifax Equifax Ltd Customer Service Centre PO Box 10036 Leicester LE3 4FS Telephone: 0333 321 4043 or 0800 014 2955 Website: equifax.co.uk/crain

Experian Experian Customer Support Centre PO Box 9000 Nottingham NG80 7WF Telephone: 0344 481 0800 or 0800 013 8888 Website: experian.co.uk/crain

Your personal data rights explained

Your personal data is protected under Data Protection legislation, and as a consequence you have a number of rights that you can enforce against us as your Data Controller.

Right to rectification

This right refers to having your personal data corrected if it’s inaccurate, or to have any incomplete personal data completed.

To request a right to rectification please contact us.

Marketing and market research opt-out

If you’d prefer not to continue to receive up-to-date information on our products and services, or to be included in market research, you can indicate this by updating your marketing preferences at any time. To opt-out of marketing and market research please contact us.

E-mail opt-out

If you have previously opted to receive marketing emails and don’t want to in future, please use the unsubscribe link within the email and we will remove you from all future campaigns.

Sharing of your personal data

If you open an account with us, your information will be kept after your account is closed. Your information may be shared across the Santander group or associated companies, service providers or agents for administration purposes to:

• provide and run the account or service you have applied for, and develop and/or improve our products and services;
• identify and advise you by post, telephone or electronic media (including email and SMS) of products or services which our group of companies and our associated companies think may be of interest to you (for credit products this may involve releasing your details to a credit reference agency).

Complaints

We always strive to provide you with the best products and services. Unfortunately things can sometimes go wrong, but telling us about errors or oversights will give us the chance to fix things for you and make long-term improvements to our services.

The easiest and quickest way to get in touch about a complaint is by calling us.

Further information on our complaints process, including the handling timescales, is available on our website.

You may also be able to refer your complaint to the relevant Financial Ombudsman Service. The Financial Ombudsman Service acts as an independent and impartial organisation which helps settle disputes between consumers and financial services businesses. You can find out more information at:

United Kingdom: financial-ombudsman.org.uk

Isle of Man: gov.im/about-the-government/statutory-boards/ isle-of-man-office-of-fair-trading/financial-services-ombudsman-scheme/

Jersey: ci-fo.org/

Data subject access requests

You have the right to find out what information, if any, is held about you. This is known as a data subject access request.

A data subject access request is not designed to deal with general queries that you may have about your account. We therefore aim to provide you with the information you require without you having to make a formal request. If you would like to find out specific information about your account, you can contact us in writing, by phone or in our Jersey and Isle of Man branches.

To make a formal data subject access request please contact us using the details on page 10 of this booklet.

Automated decision making and processing

In some instances we may undertake automated processing and decision-making to decide which of our other products or services might be of interest to you. You have a right not to have a decision made based solely on automated processing (including profiling) that produces legal or similar effects. This doesn’t apply where the processing is necessary for the performance of a contract, is authorised by law, or the person has given their consent to the processing (though they can revoke their consent thereafter).

Where you have been adversely affected by an automated decision, and/or you think we have made a mistake, or you have further information to support your case, there is an underwriting process in place. We can’t guarantee to reverse a decision, but we will always be happy to reconsider your application if you believe you have been wrongly declined.

To ask us to reconsider your application, please contact us.

Our contact details – United Kingdom

• Santander International, 13-15 Charing Cross, St Helier. Jersey JE2 3RP
• 08000 84 28 88 – from a UK landline, or +44 (0)1534 885 000 – if calling from overseas Monday to Friday 9am to 5pm (UK time), except Wednesdays when we open at 9.30am
• EAMSC@santanderinternational.co.uk
• santanderinternational.co.uk

Our contact details – Isle of Man branch

• Santander International, 19-21 Prospect Hill, Douglas, Isle of Man IM1 1ET, British Isles
• 08000 84 28 88 – from a UK landline, or +44 (0)1534 885 000 – if calling from overseas Monday to Friday 9am to 5pm (UK time), except Wednesdays when we open at 9.30am.
• info@santanderinternational.co.uk
• santanderinternational.co.uk

Our contact details – Jersey branch

• Santander International, 13-15 Charing Cross, St Helier. Jersey JE2 3RP
• 08000 84 28 88 – from a UK landline, or +44 (0)1534 885 000 – if calling from overseas Monday to Friday 9am to 5pm (UK time), except Wednesdays when we open at 9.30am.
• info@santanderinternational.co.uk
• santanderinternational.co.uk

Glossary of terms

Behavioural scoring

Techniques that help organisations decide whether or not to grant credit to customers.

Beneficiary bank

A beneficiary bank is the receiving bank where you have your account.

Binding Corporate Rules

Personal data protection policies which are adhered to by a controller or processor established in the UK or a Crown Dependency for transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or a group of enterprises engaged in a joint economic activity.

Biometric data

Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or things like fingerprints.

CHAPS

Clearing House Automated Payment System.

Cifas

Cifas is a not-for-profit fraud prevention membership organisation. Cifas is the UK’s leading fraud prevention service, managing the largest confirmed fraud database in the country. Members are organisations from all sectors, sharing their data across those sectors to reduce instances of fraud and financial crime.

Data Controller

The natural or legal person, public authority, agency or other body which alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Crown Dependency or UK law, the controller or the specific criteria for its nomination may be provided for by Crown Dependency or UK law.

Data Protection Officer (DPO)

A person charged with advising the controller or processor on compliance with data protection legislation and assisting them to monitor such compliance.

Disassociation

A disassociation is a method of removing a financial connection between individuals that have been connected together as financial associates at the credit reference agencies. When people have joint accounts or they live together where their earning and spending behaviour affects each other, information on these financial relationships is taken into account when individuals apply for credit. Credit reference agencies hold this information as ‘financial associations’. If an individual has been incorrectly linked to someone else or all financial ties have been broken so there are no longer any shared finances such as income or spending, then an individual can request for a ‘disassociation’ at the credit reference agencies.

EEA

The European Economic Area (‘EEA’) is the area in which the Agreement on the EEA provides for the free movement of persons, goods, services and capital within the European Single Market, including the freedom to choose residence in any country within this area. The EEA includes the EU countries as well as Iceland, Liechtenstein and Norway.

Group companies

The Santander group of companies includes but is not limited to Banco Santander S.A., SCF Madrid, S.A.; Santander UK Group Holdings plc, Santander UK plc, Santander Financial Services plc trading as Santander International, Santander UK Santander Consumer (UK) plc trading as Santander Consumer Finance; Santander Insurance Services UK Ltd.

Legal basis

The legal basis for processing personal data.

Legitimate interest

A lawful ground for data processing which applies where processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

Personal data

‘Personal data’ means any information relating to an identified or identifiable natural person (‘Data Subject’). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, where or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data

The special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data or data concerning an individual’s sex life or sexual orientation, and the processing of genetic data or biometric data for the purpose of uniquely identifying an individual.

Santander International is the trading name of Santander Financial Services plc. Santander Financial Services plc is incorporated in England and Wales with number 2338548 and its registered office is 2 Triton Square, Regent’s Place, London NW1 3AN, United Kingdom. Santander Financial Services plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Santander Financial Services plc’s Financial Services Register number is 146003. Santander and the flame logo are registered trademarks. Calls to Santander International are recorded and may be monitored for security and training purposes.