Volvo Car Financial Services UK Ltd (“VCFSUK”) and Santander Consumer (UK) Plc (“SCUK”) are joint data controllers of your personal data. This means that VCFSUK and SCUK jointly decide the purposes and means of processing your information. Reference to “we”, “our” or “us” in this statement are references to VCFSUK and SCUK as joint data controllers, unless the context otherwise permits.
If you have any queries about our handling of your information, you can contact our Data Protection Officer by writing to DPO@vcfsuk.com. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query or we may refer you to SCUK’s Data Protection Officer or customer services department, as appropriate.
SCUK’s Data Protection Officer can be contacted by writing to Santander House, 86 Station Road, Redhill, RH1 1SR.
This data protection statement explains how we will use the personal data that you provide to us via your intermediary or via an online application or that we have obtained about you through our use of the personal data you have provided (referred to in this policy as your “information”) when you enter into a finance agreement with us. Please read this statement in conjunction with the privacy statement provided to you when you applied for finance with us as this explains how we use your information when you make an application for finance. Please read this statement carefully.
Where we refer to “intermediary” in this statement, this means the dealership or finance broker (as applicable) that has contacted us on your behalf regarding vehicle finance.
Information we collect about you
The categories of information that we may collect about you are as follows: name, address, e-mail address, telephone number, address history, residential status, date of birth, marital status, driving licence number, bank details, employer’s name and address, occupation, time in employment and any ID documents required to be provided by you (such as Passport, ID Card, driving licence, credit / debit card, proof of disability, proof of home ownership, P60, Wage Slip, Pension Statement, Ltd Company Accounts, council/ housing association tenancy agreement, bank, council tax bill, statement utility bills) and information we have obtained from credit reference and fraud prevention agencies. From time to time we may require other forms of personal information as required to comply with legal or regulatory requirements or for the adequate management of your agreement. If you fail to provide us with the mandatory information that we request from you, we may not be able to properly manage the agreement we have with you (for example, it may have an impact on our ability to assist you with any queries) and may eventually result in us taking action in accordance with the terms of your finance agreement, including cancellation.
If your information changes during the term of the agreement we have with you, you must inform us immediately.
Use of your information
The purposes for which we use your information and the legal bases under data protection laws on which we rely to do this are as follows (as relevant):
- It is necessary for the performance of the contract with you or to take steps to enter into it. This includes verifying your identity, administering the agreement between us (including tracing your whereabouts to contact you and recover debt) and to provide you with the service under that agreement (i.e. managing your account, communicating with you, providing updates on the status of your account, mid and end agreement reviews, dealing with any complaints and notifying you of any changes to this statement).
- It is necessary for our legitimate interests or that of a third party. This includes:
- assessing lending and insurance risks;
- to understand your needs and provide a better service to you, and to help us develop and improve our products and services;
- preventing fraud and money laundering, and to verify your identity, in order to protect our business and to comply with laws that apply to us;
- monitoring communications between us (calls, letters, emails and texts) to prevent and detect crime, to protect the security of our communications, systems and procedures, and for quality control and training purposes;
- contacting you to ask you to participate in customer satisfaction surveys and market research (by email, letter, SMS or phone) and to undertake and analyse those surveys and research, this is to allow us to benchmark our services and evaluate new and existing products and services;
- for management and audit of our business operations including statistical analysis and accounting and system testing in order to protect our business;
- creating a profile of you to enable us to identify and personalise what products and services to offer to you for marketing purposes;
- conducting a propensity to renew analysis and evaluating those results to enable us to provide relevant and timely renewal communication activities;
- use by your intermediary for the reasons described under ‘Disclosure to and use by third parties’.
- It is necessary for compliance with a legal obligation. This includes when you exercise your legal rights under data protection law, to verify your identity, for the establishment and defence of our legal rights, for activities relating to the prevention, detection and investigation of crime, to conduct credit, fraud prevention and anti-money laundering checks and for compliance with our legal and regulatory responsibilities. This may also include processing special categories of data about you, for example for our compliance with our legal obligations relating to vulnerable people or if you go into arrears with your payments due to a health-related reason.
- You have given us your consent to use it in certain ways including when you request that we disclose it to a third party and for direct marketing communications (by us and the third parties named under ‘Marketing’). You can withdraw your consent to marketing at any time by following the instructions provided below under ‘Marketing’.
Disclosure to and use by third parties
We disclose your information to the following third parties:
- Our group of companies* who will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. These companies will also use your information to send you marketing communicationsif you have consented to this.
- Credit reference agencies (including Experian, TransUnion, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0800 085 1541. Alternatively you can view a copy of this privacy statement at https://www.levcfinancialservices.co.uk/your-data/.
- Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies).
- Third party debt collecting agencies engaged by us to recover monies owed to us.
- Any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information.
- Your intermediary (or any intermediary that acquires your intermediary’s business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this.
- If applicable and as advised in your customer agreement; the associated vehicle Manufacturer of the franchised intermediary where you purchased your vehicle. They will use your information to better understand you as a customer, for reporting and analysis purposes, and to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this.
- If applicable, an alternative franchised intermediary, which takes responsibility for the management of your vehicle via transfer or reallocation of responsibilities, to assist us with administering your agreement.
- Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services.
- Outsourced service providers required for compliance with a legal or regulatory obligation, provision of your account service or for marketing activities where your consent has been provided.
- Market research organisations engaged by us to undertake customer satisfaction surveys and market research.
- Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
- If we or the Santander group undergoes a group reorganisation or is sold to a third party, your personal information provided to us may be transferred to that reorganised entity or third party and used for the purposes highlighted in this data protection statement.
Use by credit reference and fraud prevention agencies
Please refer to the privacy statement provided to you when you applied for finance with us for more information about the credit reference and fraud prevention agencies that we use and what they do. Alternatively, you can view a copy of this privacy statement at https://www.levcfinancialservices.co.uk/your-data/.
Automated decisions and profiling
As part of the processing of your information, decisions may be made by automated means.
Please refer to the privacy statement provided to you when you applied for finance with us for more information about our use of automated decisions when you make an application for finance. Alternatively, you can view a copy of this privacy statement at https://www.levcfinancialservices.co.uk/your-data/.
During the term of the finance agreement we have with you, we may also conduct automated processing of your information in other ways. In particular, we may use automated processing to analyse or predict (amongst others) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your information. For instance, we might do an analysis of certain customer demographics (such as your characteristics). We may also analyse triggers and events such as the maturity dates of your accounts and opening anniversaries.
In some instances we may carry out automated processing and decision making to do behavioural scoring, including by looking at the accounts and products you already have with us and how they are being conducted, such as account activity, arrears and other indications of financial difficulties. We will do this where this information is relevant to the product that we think you might be interested in. This will help us to decide whether other products and services might be suitable and appropriate for you. All of this includes an element of automated processing.
We will use the information gleaned from this activity to: (i) send direct marketing communicationsto you where you have consented to this; and (ii) decide which of our other products and services might be suitable and appropriate for you, including those which are offered by us, or by us in conjunction with our partners, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, when you receive them and what marketing activity is conducted by us or one of our third parties.
In addition, when we provide a product or service to you, we take into account other information that we hold about you, including how you use this and other accounts you have with us.
Data anonymisation and use of aggregated information
Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies*.
Retention of your information
If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have.
Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed. Please refer to the privacy statement provided to you when you applied for finance with us for more information about the information that we give to credit reference agencies. Alternatively, you can view a copy of this privacy statement at https://www.levcfinancialservices.co.uk/your-data/.
Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years.
We may hold your information for a longer or shorter period from that described above where:
- the law requires us to hold your personal information for a longer period, or delete it sooner;
- you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and
- in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.
Transfers to third countries/ where we store your information
We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law.
You have the following rights (which may not always apply or be subject to certain circumstances):
• to be informed about the processing of your information (this is what this statement sets out to do);
• to have your information corrected if it’s inaccurate and to have incomplete information completed;
• to object to processing of your information;
• to restrict processing of your information;
• to have your information erased;
• to request access to your information and information about how we process it;
• to move, copy or transfer your information (“data portability”); and
• rights relating to automated decision making, including profiling.
More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at https://www.levcfinancialservices.co.uk/your-data/ or by requesting a copy via email from firstname.lastname@example.org or calling our customer services team on 0800 085 1541. If you would like to discuss or exercise any of these rights, please contact us by writing to Volvo Car Financial Services UK Ltd, Scandanavia House, Norreys Drive, Maidenhead, SL6 4FL or using the above contact information.
We may update the data protection statement from time to time. When we change the data protection statement in a material way, a notice will be displayed on our website along with the updated data protection statement.
We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.
The Santander group of companies includes but is not limited to Banco Santander S.A., SCF Madrid, S.A.; Santander UK Group Holdings plc, Santander UK plc, Santander UK, Santander Consumer (UK) plc trading as Santander Consumer Finance ; Santander Insurance Services UK Ltd.