Privacy Policy

‘We’, ‘our’, ‘us’, ‘Melton’’ and the ‘Society’ in this Privacy Policy means Melton Mowbray Building Society. Melton is a controller, responsible for the protection of the data it collects about you.

This Privacy Policy explains the types of personal data we collect, what we do with it, who we share it with, how long we keep it and your rights.

It does not extend to other organisations, such as any external websites you may access from our website.

If you have any questions about the data that you share or we collect, don’t hesitate to get in touch. We’ll be more than happy to help.

Personal information we collect from you

We collect your personal information when you:

• Apply for our products or services in branch, online or on the phone
• Update your information online, in branch or over the phone (such as when you change your address)
• Visit us in branch
• Speak to us on the phone
• Visit our website, use our online web chat services and any digital or mobile app we may offer now or in the future
• Send us letters, emails or other documents.

The types of personal information we collect from you are:

• Identity details which includes your full name, title, date of birth, age, unique personal identifier and account number
• Contact details which includes your home address, email address and phone number
• Financial data which includes your bank account number, credit/debit card number, earnings, income, expenditure, spending habits, transaction history, tax reference number and source of funds
• Personal information about your family which includes your marital status, next of kin, dependents and emergency contact details
• Profile data about you which includes your sex, occupation, employment status, citizenship status, residential status, property details, occupancy status and insurance information
• Identification data which includes your driving licence, passport, National Insurance number and other national identifiers
• How you interact with us which includes call recordings or any other form of communication.
• Technical data which includes internet protocol (IP) address, location data, operating system, time zone etc.

We also collect special categories of personal data which includes:

• Health data which includes any physical disability, mental disability, or any medical condition
• Criminal data which includes information about criminal convictions and offences, allegations (proven or unproven) and investigations, penalties and restrictions, County Courts Judgements, and insolvency details as well as information relating to the absence of convictions
• Sensitive data Information about your race or national or ethnic origin, religion or beliefs, sexual orientation, and political affiliations.

It is important that the personal information we hold about you is accurate and up to date.

Please keep us informed of any changes to your personal information, such as change of contact details etc.

Personal information we collect from others

Sometimes we work with carefully selected third parties and we may receive your personal information from them.

The third parties include:

• Business partners
• Suppliers
• Sub-contractors
• Advertisers
• Referrers
• Industry databases CIFAS – you can learn more about how your personal information is used here https://www.cifas.org.uk/fpn)
• Public sources (such as the electoral register)
• Credit Reference Agencies (CRAs) are used to perform credit, identity and fraud prevention checks against public (electoral register) and shared credit information (You can learn more about how your personal information is used here: Experian Equifax).

We may obtain personal information relating to you from other individuals as part of the application process for one of our products or services. This can include individuals who are:

• A joint applicant on an account you hold or are applying for
• A trustee on an account
• A parent
• A guardian
• A nominated representative
• Acting under a Power of Attorney or similar authority
• A mortgage broker or mortgage intermediary (such as Accord Mortgages) who is acting on your behalf.

If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

When you provide personal information about another individual, we’ll assume that you have told them that you are sharing their details and where they can find more information on how we process their personal information.

We also collect information from public sources as part of our investigations and due diligence checks.

Purposes of the processing

We must have a lawful basis to collect, use, share and keep your personal data. The different lawful bases we use and how these affect you, include:

• Legal obligation
  • At times we are required by law to collect, use, share or hold personal data.
  • As we operate in a regulated industry we have to comply with the laws and regulations set by government bodies and our regulators. Our regulators include the Financial Conduct Authority, Prudential Regulation Authority and the Information Commissioner’s Office.
• Contract
  • This is where you choose to enter into an agreement with us or make an enquiry with the intention of entering into an agreement. It includes the collection, use and sharing of personal data necessary for the opening and ongoing administration of your accounts, products and services.
• Legitimate interest
  • This is where it is necessary to collect, use, hold or share personal data to pursue a legitimate aim that does not unduly affect you or cause you undue detriment, damage or distress.
  • You have a right to challenge our legitimate interest, see the section on ‘Your Rights’ in this Policy for further details.
• Consent
  • This is where we ask for your consent to carry out certain activities such as marketing. You may withdraw your consent at any time.
• Explicit consent
  • This may be relied upon regarding sensitive (special category) data.
• Vital interest
  • This is applied in very limited circumstances where we feel you or another individual may be at serious risk, for example, life or death circumstances and no other lawful basis can be applied.
• Public Interest
  • This may be relied on in the exercise of official authority or to perform a specific task in the public interest that is set out in law.

We’ll only ask for Special Category Personal Data when we absolutely need to and use it in limited circumstances.

Sharing your personal information

When necessary, we share your personal information with:

• Service providers
• Tax, government, and any relevant regulatory authorities
• Prosecuting authorities and courts, and/or other relevant third parties connected with legal proceedings or claims
• Fraud prevention and/or law enforcement agencies
• Industry databases (such as CIFAS. You can learn more about how your personal information is used for CIFAS’ National Fraud Database at cifas.org.uk/fpn)
• Third parties where you have asked us to share your information
• Third parties where it’s necessary to enter into or Necessary for the performance of a contract
• Third parties where we are required to do so by law
• Credit reference agencies are used to perform credit, identity and fraud prevention checks against public (electoral register) and shared credit information.

All companies we work with are assessed for adequacy of their security controls, so we aim to ensure that your personal data is safe. You can find more details on the organisations we may share your data with here.

Transfer outside the UK and EEA

Certain suppliers, applications, and systems that we use to support the provisions of our services rely upon transfers of data outside the United Kingdom (UK), European Economic Area (EEA).

When we use third party systems, application support and cloud-based providers that are either based outside of or send or access data outside of the UK or EEA, we will, where necessary, impose contractual obligations on the recipients to help safeguard your rights in respect of your data.

Whenever fraud prevention agencies transfer your personal data outside of the UK or EEA, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the UK or EEA as applicable dependent upon their location. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

If you would like more information on this, please feel free to contact us by using the details provided in this policy.

Keeping your personal information

We keep personal information for as long as it is required by us:

• For the purposes described in ‘How We Use Personal Information’ section above
• To meet our legal or regulatory obligations
• For the exercise and/or defence of any legal claims.

When determining retention periods, we consider the following:

• The maximum or minimum retention periods identified by the law or regulatory guidance
• Our contractual rights and obligations
• Customer expectations, the nature of your relationship with us, your membership status and the types of accounts, products and services you have with us
• Current or future operational requirements
• Forensic requirements, for example, the potential need to access data no longer actively used in order to manage or respond to complaints and disputes
• The risks involved in retention, deletion and removal
• The cost of maintaining, storing, archiving and retrieving data
• The capability or restraints of our systems and technology.

Profiling

There may be some circumstances where we use your personal information for profiling (processing of personal information to evaluate certain things about you).

For example, to ensure that we’re providing a consistent service and giving people the best products and advice at the right times.

We’ll always make sure the way we process your information is safe and not unfair to you.

Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports. This way, you will not be identifiable from the data.

You have the right to object to us using your personal information for profiling activities. Please refer to the Subject rights section for more information.

Automated decision making

There may be circumstances where we use automated decision making using your personal information.

We use automated decision making to check that we can enter into an agreement with you, and also carry out our legal and regulatory obligations (e.g. when complying with UK money laundering regulations).

You have certain rights over your personal information when using automated decision making. If you would like more information on this, please see the “Your Data Subject Rights and How to Exercise Them” section below.

Your data subject rights and how to exercise them

You have rights relating to the personal information we hold about you, however, they may be subject to various exceptions and limitations.

You can request to exercise your rights at any time by contacting us using the details in this Privacy Policy.

Right to be informed: We are obliged to provide clear and transparent information about our processing activities of your personal information.

Right to request access to your personal information (commonly known as a “data subject access request”): You have the right to understand what personal information we hold about you and why.

Right to request correction of the personal information: If you believe that we hold inaccurate or incomplete personal information, you have the right to request us to rectify or correct your personal information.

Right to request erasure of your personal information: You may ask us to delete or remove personal information where there is no good reason for us to continue to process it. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons.

Right to request restriction of processing of your personal information: You may ask us to stop processing your personal information. We will still hold the data but will not process it any further. You may exercise the right to restrict processing when one of the following conditions applies:

• The accuracy of the personal information is contested
• Processing of the personal information is unlawful
• We no longer need the personal information for processing but the personal information is required for part of a legal process
• The right to object has been exercised and processing is restricted pending a decision on the status of the processing.

Right to data portability: You may request your personal information be transferred to another controller or processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means, and if the processing is based on the fulfilment of a contractual obligation.

Right to withdraw consent: You may withdraw consent at any time if we are relying on your consent to process your personal information. This won’t affect any processing already carried out before you withdraw your consent or processing under other grounds.

Right to object: You have the right to object to our processing of your personal information where:

• Processing is based on legitimate interest
• Processing is for the purpose of direct marketing

We may need specific information from you to help us confirm your identity before we can review your request.

By Website
The simplest and quickest way to request this information is by completing our online request form on our website.

By Phone
You can call our Customer Service Centre on 01664 414141.

By Branch
Alternatively, you can visit us in one of our five branches:

Data protection questions and complaints

If you have any questions or are unhappy about this document, how we use your information or any of your rights, contact our Data Protection Officer.

By Email
We would always encourage you to contact us by email to reduce the environmental impact: DPO@mmbs.co.uk

By Post
Melton Mowbray Building Society
Mutual House
Leicester Road
Melton Mowbray
Leicestershire
LE13 0DB

If you’re not satisfied with the way we handle your complaint, you are entitled to raise a complaint directly with the UK Information Commissioner’s Office. See www.ico.org.uk for details