Data Privacy Notice

Personal data we collect in general

Name, title, address, contact details (including any previous changes), date of birth and/or age.

We use this to:

• identify you
• manage your relationship with us.

Lifestyle, social and family details, for example, location, web browsing history, marital status, next of kin and dependants.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us
• manage your experience with us.

Telephone, voice recording, video images (including CCTV, webchat, IP and/or MAC address where known, your location based on your mobile phone signals) and social media handles.

We use this to:

• provide a record of the dealings and conversations you have with us
• correspond with you and answer your queries
• understand your needs and assess the suitability of our products and services
• manage your experience with us
• protect you and provide security
• provide colleague training to help improve the quality of our service
• meet regulatory requirements
• support crime and fraud prevention.

Biometrics – finger print secure passcode.

We use this to:

• provide you with access to the Skipton Mobile App if you choose this validation option on your device. Skipton does not collect or store your biometric data.

Car registration.

We use this to:

• identify you when visiting our premises.

Nationality and national identifiers, for example, national insurance, passport and driving licence.

We use this to:

• identify you
• meet Her Majesty’s Revenue & Customs (HMRC) and Foreign Account Tax Compliance Act (FATCA) reporting regulations where required
• support crime and fraud prevention.

Details of the relationships, products and services you hold with us, our partners and/or other organisations including financial details, for example, balance, transactions, how you operate the accounts and services.

We use this to:

• assess the suitability of products and services you apply for or already hold
• manage your relationship, products and services with us and our partners
• meet regulatory requirements.

Property details and occupancy status, for example, current and previous properties you have lived at, other properties you own, whether you are an owner, tenant or living with parents.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us
• support crime and fraud prevention.

Employment details including your salary, other income and status, for example, employed, self-employed, retired.

We use this to:

• understand your circumstances and needs
• verify the data you provide
• assess the suitability of products and services you apply for or have with us
• meet regulatory requirements
• support crime and fraud prevention.

Additional financial details relating to other income, outgoings and spending habits, for example, benefit entitlement and income, rental income, credit, loans, debts.

We use this to:

• understand your circumstances and needs
• assess the suitability and affordability of products and services you apply for or have with us
• assess how you manage account payments and credit
• meet regulatory requirements
• support crime and fraud prevention.

Criminal convictions, pending convictions, bankruptcy/receivership, county court judgements, court records and pending orders.

We use this to:

• assess the suitability of products and services you apply for or hold
• support crime and fraud prevention.

Property details & occupancy status, for example, owner, tenant, living with parents.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us
• meet regulatory requirements
• provide financial advice and recommendations.

Employment details including your salary, other income and status, for example, employed, self-employed, retired.

We use this to:

• understand your circumstances and needs
• verify the data you provide
• assess the suitability of products and services you apply for or hold
• meet regulatory requirements
• provide financial advice and recommendations.

Additional financial details relating to your financial position. This includes details of any pensions, investments, life policies, your spending habits, debts and regular and ad hoc income and outgoings etc.

We use this to:

• understand your circumstances and needs
• assess the suitability and affordability of products and services you apply for or have with us
• meet regulatory requirements
• provide financial advice and recommendations.

Estate planning arrangements you have in place, for example, will, power of attorney, funeral plan and trust.

We use this to:

• understand your circumstances and needs
• assess the suitability and affordability of products and services you apply for or have with us
• meet regulatory requirements
• provide financial advice and recommendations.

Details relating to your financial attitudes and aspirations including attitude to risk, investment goals, plans and priorities.

We use this to:

• understand your circumstances, needs and attitude to risk
• assess the suitability and affordability of products and services you apply for or have with us
• meet regulatory requirements
• provide financial advice and recommendations.

Lifestyle, social and family circumstances, for example, location, web browsing history, marital status, next of kin, dependants, health, medical and smoker history.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us
• provide appropriate financial advice and recommendations
• meet regulatory requirements
• manage your experience with us.

Property details and occupancy status, for example, owner, tenant, living with parents.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us.

Family details, for example, marital status, next of kin, dependants.

We use this to:

• understand your circumstances and needs
• assess the suitability of products and services you apply for or have with us.

We use this to:

• identify you
• manage your relationship with us.

Your authorised representatives, for example, family members, attorneys.

We share personal data with them to:

• deal with their enquiries, requests and further applications
• manage the ongoing administration of your accounts, products and services
• process transactions.

We will do this where:

• they are authorised to provide information and operate the account without you being present
• we already hold authority for them or you or they confirm they have your authority to provide your data or to act on your behalf
• a power of attorney document has been registered against your account, products and services.

Joint account holders, including former, current and/or future potential account holders and trustees.

We share personal data with them to:

• deal with enquiries, requests and further applications
• manage the ongoing administration of your joint account, products and services
• process transactions.

We will do this where:

• the data is data in common to all account holders
• they are authorised to operate the account without you, for example, either or any account holder is authorised to operate and transact on the account (rather than both or all)
• they confirm they have your authority to provide your data on your behalf.

Financial advisers.

We share personal data with them to:

• review and assess your suitability and application for products and services
• manage your ongoing relationships.

We will do this when you have authorised them to act on your behalf.

Solicitors, licensed conveyancers, valuers, panel managers and other professional advisers.

We share personal data with them to:

• provide professional services
• review and assess your suitability and application for products and services
• manage your ongoing relationships
• administer and manage disputes and/or legal claims.

Financial organisations.

We share personal data with them to:

• review and assess your suitability and application for products and services
• manage payments (including the use of payment services involving the transfer of electronic payments into or out of your account), transactions and ISA transfers
• respond to requests for the postponement of a charge on your property
• support crime and fraud prevention purposes
• assist with enquiries and investigations.

Other companies in the Skipton Building Society Group.

We share personal data with them to:

• manage your relationships and experience with us and our Group companies
• refer you to them for the additional products and services they can offer you
• provide and improve our security and systems and protect you
• support any joint Group reporting requirements to our regulators
• support crime and fraud prevention.

Mailing houses and printers.

We share personal data with them to:

• provide you with service information, for example, account statements
• provide you with a range of other communications about our products, services, news and offers.

We will only send you marketing material when you have given us your consent.

Information Technology service providers.

We share personal data with them to:

• provide third party systems, storage, software and application support.

Credit reference agencies.

We share personal data with them to:

• verify your identity
• review and assess your suitability and affordability for products and services
• trace your whereabouts if we have been unable to contact you.

Fraud prevention agencies.

We share personal data with them to:

• carry out checks for the purposes of preventing fraud and money laundering
• verify your identity
• assess your suitability for products and services.

Voluntary and charitable organisations.

We share personal data with them to:

• register and manage your involvement in our charity or community events.

Law enforcement agencies including police forces, private investigators, security organisations and prosecuting authorities.

We share personal data with them to:

• assist with any ongoing investigations relating to the security and/or safety of individuals
• support crime and fraud prevention.

Courts and tribunals.

We share personal data with them to:

• respond to court and tribunal requests
• manage and resolve complaints, disputes and/or legal claims.

Ombudsmen and regulatory organisations, for example, Financial Ombudsman Service, Financial Conduct Authority, Prudential Regulation Authority, Financial Services Compensation Scheme, Information Commissioner’s Office.

We share personal data with them to:

• provide our regulatory and governing bodies with data about our business
• assist with enquiries, investigations, complaints and assessments.

Trade associations and industry groups, for example, UK Finance, Building Societies Association.

We share personal data with them to:

• assist with enquiries, investigations, complaints and assessments
• develop industry standards
• understand and predict trends in customer and financial behaviours.

HMRC.

We share personal data with them to:

• provide information for tax reporting purposes
• assist with enquiries, investigations, complaints and assessments
• support crime and fraud prevention.

Central and local government departments and agencies, for example, Department of Work and Pensions (DWP), Jobcentre Plus, local councils.

We share personal data with them to:

• confirm payments received and ongoing benefits
• assist with enquiries, investigations, complaints and assessments.

Field agents, debt collection agencies, tracing agents and appointed receivers and trustees in bankruptcy.

We share personal data with them to:

• understand your circumstances and financial situation
• assist in recovering debt
• locate you when we have been unable to contact you via our usual communication channels
• meet legal requirements where receivers or trustees in bankruptcy have been appointed to deal with your financial affairs.

Research and insight agencies.

We share personal data with them to:

• better understand our customers and members including their experiences, life stages, circumstances, needs and responses to current and potential Skipton Building Society products, services and wider initiatives
• gain a range of insights, for example, into market trends, consumer behaviour, competitors, technological change and more
• support a wide range of business decision making such as product development.

In addition we use data for profiling and customer segmentation to create a broad understanding of our customers.

This helps shape our communications, products and the overall customer experience from what our branches look like, to how we handle phone calls and other customer contacts.

Management Consultancy firms.

We share personal data with them to:

• gain a range of insights , for example, into market trends, consumer behaviour, competitors and technological change
• help make recommendations into future development and strategy
• get support with a range of business decisions.

Other organisations involved in handling mergers, acquisitions and other corporate transactions.

We share personal data with them to:

• enable the sale or purchase of all or part of our business.

External auditors, risk and rating agencies, for example, Moody’s, Fitch.

We share personal data with them to:

• support a wide range of business decision making such as product development
• validate reports
• facilitate the management and audit of business operations
• perform reviews of mortgage files for secured funding transactions to enable the necessary reporting to be completed
• assess the Society, including Group entities, to enable the granting of a credit rating
• assist in meeting our legal obligations.

Data modelling and risk organisations.

We share personal data with them to:

• understand and predict trends in customer and financial behaviours
• support a wide range of business decision making including the provision of credit to customers
• review and validate the accuracy of reports and/or model outputs from other organisations.

Registrars.

We share personal data with them to:

• keep registered shareholder information in relation to Permanent Interest Bearing Securities.

Scrutineers.

We share personal data with them to:

• oversee and inspect votes received in connection with our Annual General Meeting (AGM) and Extraordinary General Meetings (EGM) when applicable.

Credit Reference Agencies.

We share personal data with them to:

• review, assess and confirm your credit worthiness
• update your payment history (including defaults, arrears and repossession hearings) with them.

Employers (current, past or prospective).

We share personal data with them for them to:

• confirm your employment and employment status and income received.

Lenders and landlords.

We share personal data with them for them to:

• confirm your residency status and payment history.

Mortgage Guarantors or potential guarantors and their legal representatives.

We share personal data with them to:

• deal with their enquiries, requests and further applications
manage the ongoing administration of your accounts, products and services
• process transactions.

Non-borrowing adult occupiers.

We share personal data with them for them to:

• inform them of your application and confirm they have no claim on the property.

Housing Associations.

We share personal data with them to:

• administer and manage your shared ownership mortgage application and ongoing account by us and them.

We share personal data with them to:

• provide the products and services you have selected
• enable the effective and efficient management of your investments, funds, accounts and chosen products and services
• help manage your ongoing relationship with us and them
• enable the ongoing correct charging of products and services you have selected both to you, and between us and the third parties as appropriate.

We share personal data with them to:

• provide the products and services you have selected
• enable the effective and efficient management of your investments, funds, accounts and chosen products and services
• help manage your ongoing relationship with us and them
• enable the ongoing correct charging of products and services you have selected both to you, and between us and the third parties as appropriate.

Credit Suisse AG.

We share personal data for them to:

• manage existing structured deposits which combine traditional savings with stock market investments.

Insurance Companies.

We share personal data with them to:

• assist with enquiries, assessments, the provision of insurance and to administer claims.

Claims Management Companies.

We share personal data with them to:

• assist with enquiries and the assessment of compensation claims.

Social Media platforms & providers

We share personal data with them to:

• communicate with you and answer your queries.
• better understand our customers and members including their experiences, life stages, circumstances, needs and responses to current and potential Skipton Building Society products, services and wider initiatives.
• gain a range of insights, for example, into market trends, consumer behaviour, competitors, technological change and more
• support a wide range of business decision making such as product development.

In addition we use data for profiling and customer segmentation to create a broad understanding of our customers.

• This helps shape our communications, products and the overall customer experience from what our branches look like, to how we handle phone calls and other customer contacts

Your authorised representatives. This includes family members, attorneys, mortgage guarantor, executors and beneficiaries.

We collect, use, and hold personal data about them to identify them and to:

• manage our business relationship with them and to enable them to manage your accounts, products and services in line with your authorisation.

Personal data may also be shared with the account holder about these authorised representatives (e.g. communications, transactions.)

Other adults living in your mortgaged property.

We collect, use, and hold personal data about them to identify them and to:

• confirm they have no claim on the property.

Brokers and financial advisers.

We collect, use, and hold personal data about them to identify them and to:

• manage our business relationship with them.

Solicitors, licensed conveyancers, and other professional advisers.

We collect, use, and hold personal data about them to identify them and to:

• manage our business relationship with them.

Voluntary and charitable organisations and their representatives/members.

We collect, use, and hold personal data about them to identify them and to:

• manage the relationship they have with us as a representative/member of the charitable organisation and support their charitable cause.

Field agents, debt collection agents appointed receivers and trustees in bankruptcy.

We collect, use, and hold personal data about them to identify them and to:

• manage our business relationship with them.

Employers, lenders and landlords.

We collect, use, and hold personal data about them to identify them and to:

• obtain data about your relationship with them.

Skipton can offer or introduce you to a number of products and services provided by our third party partners. If you enquire or request details about these products and services we will share your personal data with our partner so they can answer your queries, provide you with illustrations and complete your application. They will also share data with us so we can identify all your relevant holdings and improve the experience you have with us. Currently our third party partners are:

Legal & General Insurance Limited.

Product or service provided/introduced

• Home and life insurance and claims administration.

Dignity Pre Arrangement Limited.

Product or service provided/introduced

• Funeral planning services.

Scottish Widows Limited.

Product or service provided/introduced

• Stock market based investments for our financial advice service.

Ascot Lloyd Financial Services Limited.

Product or service provided/introduced

Financial advice in relation to:

• defined benefit and other pension options
• Life Time Allowance and Annual Allowance.

Canopius Managing Agents Limited and Lloyds Syndicates.

Product or service provided/introduced

• Mortgage payment protection insurance and claims administration.

Skipton Building Society partners with Skipton Trustees Ltd (STL) which is a trust corporation. STL is a wholly-owned subsidiary of the Society. If you wish to contact STL for any purpose, please use the Society’s contact details.

Wills and Power of Attorney (POA) Referral Service

STL's Third Party:

• Redstone Wills Limited

Relationship:

• Provided by STL and administered by Redstone and Wills Limted

Legal Documents Care Package

STL's Third Party:

• Redstone Wills Limited

Relationship:

• Provided by STL and administered by Redstone Wills Limted

Estate, Trust & Property & Financial Affairs' POA Administration

STL's Third Party:

• 1825. '1825' is a trading name used by Pearson Jones plc, which is part of the Standard Life group

Relationship:

• Provided by STL and administered by 1825.

Family Bereavement and Serious Illness Helpline. Part of the Legal Documents Care Package

STL's Third Party:

• Red Arc Assured Limited

Relationship:

• Provided and administered by Red Arc Assured Limited.

Legal obligation.

Where we are required by law to collect, use, share or keep personal data we will do so.
As an organisation operating in a regulated industry we have to comply with the laws and regulations set by government bodies and our regulators.
Our regulators are the Financial Conduct Authority, Prudential Regulation Authority and, for personal data, the Information Commissioner’s Office. If we are unable to meet our legal obligations we will be unable to continue with your application and provide the ongoing management of your accounts, products and services.

Contract.

This is where you choose to enter into an agreement with us or make an enquiry with the intention of entering into an agreement. This includes the terms and conditions for the ongoing management of those accounts, and products and services once opened.
If you do not enter into an agreement with us we will be unable to continue with your application and provide the ongoing management of your accounts, products and services.

Legitimate business interest.

This is where we or another third party has a valid interest in the personal data we collect, use, share and keep as long as it does not unduly affect you or cause you undue detriment, damage or distress.
You have a right to challenge our legitimate interest if you believe we do not have a valid reason to collect, use, share or hold your data.

Consent.

This is where we ask for your agreement to carry out certain activities such as marketing. You can withdraw your consent at any time.
If you withdraw your consent for marketing you may miss out on information about our products, services, offers and other news that may be of interest to you.
We will however continue to contact you regarding the administration of your existing accounts and relationship with us.

Explicit consent.

Where we collect, use, share or keep special category (sensitive) personal data we will tell you and ask for your explicit consent before we do this.

Vital interest.

This is applied in very limited circumstances where we feel you or another individual may be at serious risk, (for example, life or death circumstances) and no other lawful basis can be applied.

We will collect, use, share and keep personal data needed for us to deal with your enquiry, process your application, provide any illustrations you require, and manage the ongoing administration of your accounts, products and services. This includes keeping your account records up to date and contacting you when needed.

We use agencies to provide analysis, financial and behavioural insight into customers. This includes the use of predictive modelling to assess future behaviours including likelihood of defaulting on payments. These agencies help us assess customer creditworthiness and other behaviours to help take a range of business decisions such as whether to provide future credit to customers. We also use the agencies to enable the management and audit of business operations, including accounting, to meet our legal obligation to carry out audits.

We will collect, use, share and keep personal data, including relevant sensitive data, to provide you with a Decision in Principle if required, assess, review and process your application, and contact you when needed.

When you request a Decision in Principle and/or apply for a mortgage, you will be taking the steps necessary to enter into a contract with us.

This process involves reviewing your application with the use of financial models, automated systems provided by Credit Reference Agencies and against our full lending criteria. This is to help us better understand your mortgage application and to assess the affordability of the products and services you apply for. When we do this the Credit Reference Agencies will keep a record of our search, whether or not you proceed with a full mortgage application. This is known as a credit footprint. They do this so that you can see who has looked at your credit report, when it was looked at and why. This record may also be seen by other lenders and could affect your ability to obtain future credit.

All of our mortgage applications are underwritten by a team here at Skipton.

We will be unable to proceed with your mortgage application without undertaking one or more of these activities.

We will continue to assess the ongoing performance of your mortgage once you have taken it out.

After the redemption of your mortgage, we will continue to use, share and keep your personal data for as long as required to meet our legal, regulatory or other lawful requirements. In addition, data will be used for ongoing modelling to support future business decisions such as ensuring the business has appropriate capital reserves for future lending and changes in the economic environment.

• Transfer of mortgage

  If you make a transfer of mortgage application, any borrower who is to be removed from the mortgage account, with our agreement, will remain on the account until our legal advisor sends us written confirmation that the transfer of the mortgaged property has been legally completed. Until we receive that confirmation, all borrowers will still be liable under the mortgage and can have access to the account details, including details of any additional lending.

  Until the transfer of mortgage application has been completed, we will share data about the mortgage account, the progress of the application and the existing and new borrowers, and any guarantors, with each of them.

• Guarantors

  Where a guarantor has been agreed on your mortgage account we will share details of your account, including balance outstanding, interest rate(s) applicable, early repayment charges and monthly payments with them. The guarantor will also be advised of any additional borrowing or further application while they remain a guarantor.

  If you are appointed as a guarantor on a mortgage account your data and payments made will be shared with the current and any future potential borrowers. This will include if one of them requests to add or remove a name from the account in the future.

• Adult occupiers

  If there are other adults living in the property, who are not party to any mortgage or additional borrowing application you make, we will contact them to inform them of your application and ask them to confirm that they have no claim on the property.

• Second charge

  If you take a second or subsequent mortgage or loan with another lender and secure it against the property you have in mortgage to us, this is known as a second charge. This means the second charge has secondary priority behind the main (first charge) mortgage with us. If we receive an application or request to postpone a charge on your property from another charge holder, we will share data about your account, including projected balance and projected monthly payments with them.

• Debt recovery

  We share data about you and how you conduct your account (including defaults, arrears and repossession hearings) with credit reference agencies, fraud prevention agencies, solicitors, debt collection agencies and/or tracing agents acting on our behalf to assist in recovering the debt and to locate you if we have been unable to contact you via our usual communication channels.

• Commercial lending

  For commercial mortgage accounts we hold data about the named contacts on the account, including company directors and authorised employees. This is so that we can effectively manage the account and are able to contact the relevant business owner where necessary.

• Shared ownership

  Where the application relates to a shared ownership mortgage, the Society will share details of the mortgage account including application, payment history, requests for variation and all other relevant matters relating to the conduct of the account with the housing association which holds an interest in the property.

When you take out a savings product with us, we need data to carry out functions like verifying your identity, opening your account, processing payments, calculating and applying interest and government Lifetime ISA bonuses.

ISA transfers

• If you request an ISA transfer between us and another provider – either transferring your ISA from us to another provider, or to us from another provider – we will share your data with the other provider in order to meet your request and comply with ISA regulations.

Payment services

• If you choose to use payment services to make or receive electronic payments between us and another service provider we will share your personal data with that service provider in order to administer and manage your request and to comply with payment services regulations.

Tax reporting

• We will deal with tax and government bonuses as required by legislation and following HMRC guidance. Your account information will be reported to HMRC where legally required. HMRC may share this information with the government of another territory.

When you contact us about financial advice we will collect data in order to get to know you and understand your needs, so we can offer personalised advice and provide financial planning recommendations tailored to your needs and circumstances.

If you choose to proceed with any of the recommendations given by our financial adviser we will share your data with external organisations such as fund providers and platforms, where needed, to:

• provide the products, services and investments you choose
• communicate with you about your investments, products and services
• manage your ongoing relationship
• send you details about our products, services, news and offers where you have given your permission for us to do this
• support crime and fraud prevention purposes.

Should you select an ongoing review service we will communicate with you about your investments, products and services performance and undertake reviews. As part of the reviews we will discuss your existing product/service/investment performance and your current circumstances in order to make any new recommendations if appropriate to understand and meet your changing needs.

If you take out Skipton Building Society Home Insurance, we will share data about you and details of your policy and claims with:

• our third party partner who provides and underwrites the insurance product
• fraud prevention bodies.

These organisations will also share data directly with us and with each other when needed to manage your policy, renewal and claims.

This data will additionally be made available to other prospective lenders and insurers to assist with enquiries, investigations and to detect and prevent fraud.

In respect of insurance, we will use your data, including details of any criminal offences and proceedings, health and other relevant items to:

• understand your needs
• assess the suitability of our products and services
• verify your identity
• contact you
• prevent and detect fraud
• comply with legal and regulatory requirements
• undertake market research
• provide marketing communications with your consent.

Mortgage Payment Protection Insurance

We will share data with Claims Management Companies and/or Insurance Companies to assist them with their enquiries and assessment of any mortgage payment protection insurance you hold or have taken out in the past. We will only do this if they provide evidence that they have your signed authority to act on your behalf. The signed authority must be dated within six months of us receiving the request.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

More information about how we use this data is below.

• Credit and identity checks

  In order to process your application, we are required by law to identify you and assess the affordability of the products and services you apply for. We do this by using automated systems provided by one or more credit reference agencies. If you take products and services from us we may also make periodic searches at credit reference agencies to manage your account in future.

  To do this, we will share your data with the credit reference agencies and they will give us data about you. This will include public data, for example, from the electoral register and other data, for example, from your credit applications about your financial situation, financial history, shared credit and specific fraud prevention data.

  We will use this data to:

  • identify you
  • assess your creditworthiness and whether you can afford to take the product
  • prevent criminal activity, fraud and money laundering
  • manage your accounts
  • trace and recover debts
  • ensure any offers provided to you are appropriate to your circumstances.

  We will continue to exchange data about you with credit reference agencies while you have a relationship with us. We will also inform the credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, credit reference agencies will record the outstanding debt. This data may be supplied to other organisations by credit reference agencies.

  When credit reference agencies carry out a search they will place a footprint on your credit file that may be seen by other lenders.

  If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together. You should make sure you share this information and discuss it with them before making an application. Credit reference agencies will also link your records together if they identify a link between you, joint applicants and/or any individual identified as your spouse or financial partner. These links will remain on the files until such time as you or your partner successfully files for a disassociation with the credit reference agencies to break that link.

  The credit reference agency checks we carry out are a condition of the lending contract you take out when applying for products and services with us.

  Any documents requested or provided to help prove your identity may be checked with the issuing authority and/or anyone who has certified a copy.

  The data from the credit reference agencies is used to automatically assess your application against the Society's lending criteria. If your application is declined based on this automatic assessment you have a right to challenge the decision. If you do not agree with the assessment you can contact us to challenge the decision and we will give you the opportunity to discuss this with us and review the results of the assessment for accuracy.

  The information we obtain from credit reference agencies is owned by them and limited to what is needed for our own purposes. We will tell you if your application is rejected because of information we have received from credit reference agencies but will not be able to provide any details. You will need to contact the credit reference agencies directly to request a full credit report if you require details of what they hold about you.

  More details about which credit reference agencies we use, their role as fraud prevention agencies, what personal data they hold (including how they use and share it), their retention periods and your data protection rights with the credit reference agencies, are explained in more detail in the Credit Reference Agency Information Notice (CRAIN).

  The CRAIN is accessible from each of the three credit reference agencies – clicking on any of the three links below will take you to the same CRAIN document: Callcredit, Equifax, Experian.

• Fraud prevention

  We will use and share your data with fraud prevention agencies to carry out checks for the prevention of fraud, money laundering and to verify your identity.

  We and fraud prevention agencies may also allow law enforcement agencies to access and use your data to detect, investigate and prevent crime.

  The fraud prevention checks we carry out are a condition of the contract you take out when applying for products and services with us.

  If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to employ you, or we may stop providing existing services to you.

  A record of any fraud or money laundering risk will be retained by the fraud prevention agencies.

  Fraud prevention agencies can hold your data for different periods of time. If you are considered to pose a fraud or money laundering risk your data can be held for up to six years.

  Data held by credit reference and fraud prevention agencies can be accessed by other financial organisations, law enforcement and government agencies and may result in others refusing to provide services, finance or employment to you.

• Crime prevention and public safety

  Within our premises we have CCTV in operation. Footage may be reviewed by ourselves, or passed to police or law enforcement agencies upon request, following any incidents relating to the security and/or safety of individuals and to assist with any ongoing crime investigations.

• Annual General Meeting (AGM)

  We have a legal obligation under the Building Societies Act to hold an AGM. We will use your information to identify if you are eligible to vote in the AGM and, if so, to send you your voting pack. We use an external scrutineer to issue the voting packs and to undertake the vote count.

  How you vote is confidential to our external scrutineer. If you vote, we will receive data after the AGM to say you’ve done so, so we can update your record. We will also receive a copy of any comments you’ve made. Your vote is viewed as an interaction with the Society, which is important because it shows us your account is not dormant. We will only know if you have voted, but not how you voted.

We will use any of the contact details we hold for you to communicate with you about the products and services you hold with us, contact you as requested and to send you information we are required to provide you with by law, for example, account statements, notification of annual and extraordinary general meetings.

• Marketing

  We may use your information to provide details about our products, services, news and offers that we believe may be of interest to you. The communications sent to you will be based on a range of factors including what products you already have with us, whether you are a member of the Society, where you live, data received from third parties, for example, customer lifestyle information from external data agencies and other information gained about your behaviours and dealings with us.

  We will only get in touch with these types of communication if you have given your consent to be contacted for marketing purposes, and only contact you by the methods you have agreed to, for example, post, telephone, email or text.

  You can change your marketing consents at any time by visiting a branch, logging into Skipton Online and going to ‘My Account’ (if you’re registered for Skipton Online), calling us on 0345 850 1700 or writing to us at FREEPOST SKIPTON BUILDING SOCIETY (please use block capitals).

• Social Media

  We have a presence across a range of social media channels. When you use any of our channels we may record and retain personal data and other information about you including your social media handle, the frequency, dates and times of your visits, and any information you share on our social media pages or as direct messages to us.

  Any information you provide through our social media channels may be shared with other Skipton Building Society Group companies, and any third parties who provide services on our behalf to enhance our social media services, presence and your customer experience. Your comments, opinions and messages may be used so that we can better understand our customers and improve our products, services and overall customer offering.

• Market Research and customer relationship management

  We want to provide you with the best products, services and experience. To do this, we need to understand what you and other customers’ needs and circumstances are, what you like about Skipton and any improvements you think could be made.

  Market Research

  We use external agencies including market research companies to help us gain such insights, carry out market research, and obtain feedback about products, services and experiences. We will pass your contact details to the agencies so they can contact you. They will share the data they obtain from you with us, this can be at an individual customer level, at group level or anonymised. This supports a wide range of business decision making such as product development.

  If you are contacted by our market research companies you can choose not to participate and we will not contact you again for market research.

  Customer Relationship Management

  We use data for profiling and customer segmentation to create a broad understanding of our customers. This helps shape our communications, products and other activity. We also carry out behaviour and trend analysis, including the use of financial, behavioural and other models. In this way we can understand not only what is important to our customers now, but also predict future behaviours and needs. This includes looking at information we hold about you, or that we may have received from other sources, such as credit reference agencies.

• Competitions

  We sometimes run competitions for customers, members and the wider public. When we collect personal data for this reason, it is only kept for the duration of the competition and then deleted unless otherwise stated at the time.

• Promotional material

  From time to time, we may use case studies, video footage and/or photographic images of our customers in promotional content for the Society, both internally and externally. We will obtain your consent prior to the collection and use of this type of content. If the use of it changes we will notify you and re-obtain your consent for the new usage.

  You can withdraw your consent for the use of your information in case studies and promotional material by emailing marketingpromotions@skipton.co.uk or by telephoning 0345 850 1700.

  If you withdraw your consent we will not use your case studies, video footage and/or photographic images in any future promotional material and will remove them from any existing material already made public at the next update/re-print.

• Quality assurance and communication monitoring

  We may sometimes access your data as part of our internal quality assurance processes, to ensure that you have received the best and correct outcome for your situation. These monitoring activities also allow us to carry out ongoing training with our colleagues.

  We will record and monitor some of your contact with us, this includes telephone calls, email and, where you use Skipton Link, the verbal content of the meeting - we do not record or monitor visual content. This is to help us in our continuous attempts to improve customer service and to offer additional protection and security. We also retain information for evidential purposes and to meet legal and regulatory requirements. Telephone calls, Skipton Link and other electronic communications may also be monitored for reasons of staff training.

• WIFI - How we will use, share and keep your personal data

  We provide free WiFi in some of our offices. Where you choose to use this we will use your IP/MAC address to:

  • process your registration in order to provide you with connectivity to the Wi-Fi service
  • meet our legal, regulatory and government reporting obligations (e.g. Ofcom, court order)
  • understand the total number of users of the Wi-Fi service

We take our responsibilities to our customers seriously, especially those who may be vulnerable including the families and loved ones of bereaved customers.

• Adjustments for customers needing help

  Everyone needs a little help sometimes and we want to ensure that you get the best experience from Skipton Building Society. With your consent, we will add notes to your records about any adjustments we need to make, such as using large print when we communicate with you, to ensure it’s easier for you to interact with us.

• Bereavement

  If you’re named as an executor in the Will or there is no Will and you’re the legal next of kin, and can show us proof of this, we can tell you the account balance(s) and interest due up to the date of death.

  At the request of the executor(s) we will share data with solicitors, HMRC and the customer’s beneficiaries.

  If you inform us about the death of one of our customers, we may tell the executor(s) who has informed us of the death.

  For more details about this please visit our Bereavement Support site.

If we sell or transfer all or part of our business, we may share or transfer customer records and data as part of the proposed/actual sale or transfer. Before we do this we will ensure there is adequate protection in place by imposing contractual obligations on the buyer/seller to ensure the security and confidentiality of your data.

We continually look to improve our systems, delivering change and new functionality. To ensure that these improvements are robust and suitable for use, we use customer data within our testing environments. We ensure that these activities are carried out in a secure and controlled environment.

If we need to transfer data outside the European Economic Area (EEA) and the country it’s transferred to is not on an approved list for having adequate security controls in place, we will limit when we do this and the amount of personal data we send.

We have a subsidiary company called Jade Software Corporation Limited based in New Zealand, which provides us with systems and technical support. New Zealand is on a list of countries approved by The Information Commissioner’s Office as having adequate security controls in place.

Organisations in the USA can sign up to the EU-US Privacy Shield which is recognised by the Information Commissioner’s Office as having adequate security controls in place. When we use third party systems, application support and cloud based providers based in the USA, we will use third parties who have signed up to the EU-US Privacy Shield and impose contractual obligations on them to ensure the security and confidentiality of your data.

We will also ensure that there is adequate protection in place before sending anything to other countries outside the EEA by imposing contractual obligations on the recipients to ensure the security and confidentiality of your data.

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

We may store data about you using cookies, (files which are sent by us to your computer or other device you use to access our website) which we can access when you visit our site in future. We do this to provide the online services you request, understand your needs, improve our website services and provide a better experience for you.

We use the following types of cookies:

• persistent to recognise you when you re-visit our site. These will remain on your computer until deleted, or until they reach a specified expiry date
• session to keep track of where you are whilst navigating our website. These are deleted from your computer when you close your browser
• strictly necessary to provide the services you have requested.

We also use Google Analytics to analyse the use of our website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users' computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google's privacy policy is available at: google.com/privacypolicy.html.

Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third party cookies. For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “internet options”, “privacy”, and selecting “block all cookies” using the sliding selector. Blocking all cookies will, however, have a negative impact upon the usability of many websites, including this one.

Further information about deleting or controlling cookies is available at AboutCookies.org. Please note that by deleting our cookies or disabling future cookies you may not be able to access certain areas or features of our website.

To find out more about cookies see our Cookies Policy or visit AboutCookies.org.

We have a Records Management and Retention Policy in place to determine how long personal data needs to be kept, which is based on our legal, regulatory and business requirements. How long we keep your personal data is based on your relationship with us, membership status and the types of accounts, products and services you have with us.

When determining retention periods we consider the following:

• legal and regulatory guidance, case law and expected outcomes
• maximum or minimum retention periods identified by the law or our regulators
• ours and others’ contractual rights and obligations
• your expectations
• current or future operational requirements
• the cost of maintaining, storing, archiving, and retrieving the data
• forensic requirements, for example, the potential need to access data no longer actively used in order to manage or respond to complaints and disputes
• our policies and standards
• the risks involved in retention, deletion and removal
• the capability or restraints of our systems and technology.

In accordance with the payment card industry data security standard (PCI-DSS), we do not store cardholder data on our systems.