Privacy Notice

Privacy Notice

We collect and use your personal information only in ways that are described in this privacy policy. We respect your privacy and are committed to protecting it.

We collect and use your personal information only in ways that are described in this privacy policy. We respect your privacy and are committed to protecting it.

Who are we?

Oodle Financial Services Ltd ("Oodle", "we", “our” or "us") and we are the data controller of personal data that you provide to us, in connection with our services. This privacy notice tells you how we use your personal data to provide our services. It’s important that you understand what happens when you give us personal data or when we receive personal data about you from other sources. We use some words and phrases in this privacy notice that have specific meanings under data protection law. We’ve put these words and phrases in bold and included a glossary at the end of the notice, with definitions.

 

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

Who are we?

Oodle Financial Services Ltd ("Oodle", "we", “our” or "us") and we are the data controller of personal data that you provide to us, in connection with our services. This privacy notice tells you how we use your personal data to provide our services. It’s important that you understand what happens when you give us personal data or when we receive personal data about you from other sources. We use some words and phrases in this privacy notice that have specific meanings under data protection law. We’ve put these words and phrases in bold and included a glossary at the end of the notice, with definitions.

 

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

Who are we?

Oodle Financial Services Ltd ("Oodle", "we", “our” or "us") and we are the data controller of personal data that you provide to us, in connection with our services. This privacy notice tells you how we use your personal data to provide our services. It’s important that you understand what happens when you give us personal data or when we receive personal data about you from other sources. We use some words and phrases in this privacy notice that have specific meanings under data protection law. We’ve put these words and phrases in bold and included a glossary at the end of the notice, with definitions.

 

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

What is included in the Privacy Notice?

Our privacy notice tells you what we do with your personal data, how we use it, who we share it with and how long we keep it. The types of personal data that we hold about you and how long we keep it will depend on your relationship with us and why we have it.

Here we’ll tell you

           • how we get your information;

           • what information we process;

           • why we are processing it for and why we are allowed to process it;

           • who we share your information with;

           • how long we hold your information for; and

           • how we store your information including country locations;

           • your rights in relation to your information that we hold.

If you decide to enter into a credit or finance agreement with us, we may give you some extra information about how we process your personal data. If there is a difference between this privacy notice and the extra information, then the extra information will apply to the extent that it relates to the finance  agreement we enter into with you.

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

What is included in the Privacy Notice?

Our privacy notice tells you what we do with your personal data, how we use it, who we share it with and how long we keep it. The types of personal data that we hold about you and how long we keep it will depend on your relationship with us and why we have it.

Here we’ll tell you

           • how we get your information;

           • what information we process;

           • why we are processing it for and why we are allowed to process it;

           • who we share your information with;

           • how long we hold your information for; and

           • how we store your information including country locations;

           • your rights in relation to your information that we hold.

If you decide to enter into a credit or finance agreement with us, we may give you some extra information about how we process your personal data. If there is a difference between this privacy notice and the extra information, then the extra information will apply to the extent that it relates to the finance  agreement we enter into with you.

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

What is included in the Privacy Notice?

Our privacy notice tells you what we do with your personal data, how we use it, who we share it with and how long we keep it. The types of personal data that we hold about you and how long we keep it will depend on your relationship with us and why we have it.

Here we’ll tell you

           • how we get your information;

           • what information we process;

           • why we are processing it for and why we are allowed to process it;

           • who we share your information with;

           • how long we hold your information for; and

           • how we store your information including country locations;

           • your rights in relation to your information that we hold.

If you decide to enter into a credit or finance agreement with us, we may give you some extra information about how we process your personal data. If there is a difference between this privacy notice and the extra information, then the extra information will apply to the extent that it relates to the finance  agreement we enter into with you.

We are registered with the Information Commissioner’s Office with registration number ZA121323 and you can search our registration details on the Public Register of Data Controllers www.ico.org.uk.

How do we obtain information?

Customers and prospective customers

A lot of the personal information we process is provided to us directly by you for one of the following reasons:

           • You have made an application for motor finance with Oodle;

           • You have accessed our website, app and online services; or

           • You have contacted us directly to discuss your account

We may also receive information indirectly about you from the following sources:

           • From a motor dealer, broker or other third party when you are making an application for motor finance via them;

           • From credit reference agencies, financial crime prevention agencies or other third parties that help us to prevent fraud and meet our legal obligations, as well as checking your creditworthiness to take out a loan (further information below);

           • Your financial services providers where you have allowed us to use Open Banking to verify your income and other financial information (further information below);

           • If you have authorised a third party to act on your behalf such as a solicitor or claims management company;

           • Other third parties and publicly available sources.

How do we obtain information?

Customers and prospective customers

A lot of the personal information we process is provided to us directly by you for one of the following reasons:

           • You have made an application for motor finance with Oodle;

           • You have accessed our website, app and online services; or

           • You have contacted us directly to discuss your account

We may also receive information indirectly about you from the following sources:

           • From a motor dealer, broker or other third party when you are making an application for motor finance via them;

           • From credit reference agencies, financial crime prevention agencies or other third parties that help us to prevent fraud and meet our legal obligations, as well as checking your creditworthiness to take out a loan (further information below);

           • Your financial services providers where you have allowed us to use Open Banking to verify your income and other financial information (further information below);

           • If you have authorised a third party to act on your behalf such as a solicitor or claims management company;

           • Other third parties and publicly available sources.

How do we obtain information?

Customers and prospective customers

A lot of the personal information we process is provided to us directly by you for one of the following reasons:

           • You have made an application for motor finance with Oodle;

           • You have accessed our website, app and online services; or

           • You have contacted us directly to discuss your account

We may also receive information indirectly about you from the following sources:

           • From a motor dealer, broker or other third party when you are making an application for motor finance via them;

           • From credit reference agencies, financial crime prevention agencies or other third parties that help us to prevent fraud and meet our legal obligations, as well as checking your creditworthiness to take out a loan (further information below);

           • Your financial services providers where you have allowed us to use Open Banking to verify your income and other financial information (further information below);

           • If you have authorised a third party to act on your behalf such as a solicitor or claims management company;

           • Other third parties and publicly available sources.

What personal data do we collect?

The personal data we collect includes:

           • Contact information – such as your name (and any previous names), date of birth, address, previous addresses from the last three years, email address, IP address, contact telephone number and bank details;

           • Identity information – such as ID documents and information about your nationality and residency;

           • Financial details – such as details of your employment and salary, your borrowing requirements, financial dependents, residential status and outgoings; 

           • Information about how you use our products and services – including payments you make and the dates you make them, or if you are in arrears, and any communications we have with you throughout our relationship with you;

           • Biometric information – we verify your identity with facial recognition technology, which processes biometric data which is special category data. The third party we use for this process is Jumio Corporation.

           • Criminal convictions and offences – to safeguard against fraud and comply with anti-money laundering requirements;

           • Special category data - any health conditions or protected characteristics to help consider any specific requirements you may have.

What personal data do we collect?

The personal data we collect includes:

           • Contact information – such as your name (and any previous names), date of birth, address, previous addresses from the last three years, email address, IP address, contact telephone number and bank details;

           • Identity information – such as ID documents and information about your nationality and residency;

           • Financial details – such as details of your employment and salary, your borrowing requirements, financial dependents, residential status and outgoings; 

           • Information about how you use our products and services – including payments you make and the dates you make them, or if you are in arrears, and any communications we have with you throughout our relationship with you;

           • Biometric information – we verify your identity with facial recognition technology, which processes biometric data which is special category data. The third party we use for this process is Jumio Corporation.

           • Criminal convictions and offences – to safeguard against fraud and comply with anti-money laundering requirements;

           • Special category data - any health conditions or protected characteristics to help consider any specific requirements you may have.

What personal data do we collect?

The personal data we collect includes:

           • Contact information – such as your name (and any previous names), date of birth, address, previous addresses from the last three years, email address, IP address, contact telephone number and bank details;

           • Identity information – such as ID documents and information about your nationality and residency;

           • Financial details – such as details of your employment and salary, your borrowing requirements, financial dependents, residential status and outgoings; 

           • Information about how you use our products and services – including payments you make and the dates you make them, or if you are in arrears, and any communications we have with you throughout our relationship with you;

           • Biometric information – we verify your identity with facial recognition technology, which processes biometric data which is special category data. The third party we use for this process is Jumio Corporation.

           • Criminal convictions and offences – to safeguard against fraud and comply with anti-money laundering requirements;

           • Special category data - any health conditions or protected characteristics to help consider any specific requirements you may have.

Using your information

Data protection law requires us to have a lawful basis for using your personal data. We rely on one or more of the following bases to use your personal data:

• The processing is necessary for a contract, i.e. to fulfil our contract with you;

• The processing is necessary to comply with the law, for example to prevent fraud and report to regulators such as the Financial Conduct Authority;

• The processing is necessary for our legitimate interests, for example monitoring our products and services so that we can improve them; and our interests aren’t outweighed by your interests, rights or freedoms;

You have given us your consent.

Below we describe in more detail the purposes for which we process your personal data and the corresponding lawful bases.

Purpose:

To onboard and serve you as a customer:


 • Verify your identity (including through using our third-party facial recognition technology) and any other information you’ve provided us, including your financial situation.

• Assess your eligibility for our products and services.

• Assess your credit worthiness, to determine whether you can afford the payments for the motor finance you have applied for.

• Manage your account(s) with us.

• Receive/send service messages about your account.

• Process payments that are paid to you or by you.

• Verify your employment status, including by contacting your employer.

• Monitor your repayment record and any events relevant to your ability to repay Oodle.

• Respond to your queries.

• Allow you to use our lending platform.

Lawful Basis:

Necessary for a contract, to provide our services to you or to decide whether to offer our services to you.

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC.

Purpose:

To comply with our legal obligations:

• Prevent or detect attempted fraud, money laundering or other crimes.

• Comply with your data protection rights.

• Fulfil our regulatory reporting obligations.

• Manage internal and external audit processes.

Lawful basis:

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC, and UK data protection laws.

Purpose:

To improve our business and products:

• Develop new products and services, both in-house and in conjunction with our partners.

• Prepare statistical reports using information about you, other customers and non-customers to help us manage our business better, for example improving our risk models.

• Analyse, assess and improve our services to customers, and for training and monitoring purposes.

• Profile our existing customers to enable us to more accurately target new customers.

Lawful basis:

Necessary for our legitimate interests, including:

· Developing and marketing new products and services our customers and prospective customers will find useful.

· Helping us to find new customers for Oodle’s products and services.

To protect our business:

Purpose:

• To establish, exercise or defend legal claims against us.

• To trace and take appropriate action against you should you fail to maintain payments to your finance agreement (including by getting in touch using any contact details you’ve provided to us)

Lawful basis:

Necessary for our legitimate interests, including protecting our business and our investors, defending Oodle’s financial and reputational position and enforcing our contracts.

Purpose:

To refer to you to credit brokers or other lenders if we’re unable to offer you motor finance.

Lawful basis:

Necessary for our legitimate interests and those of any relevant other lenders/credit brokers, including maintaining strong relationships with prospective customers and others within the industry.

Purpose:
To send you marketing messages on behalf of Oodle, including:

• Letting existing customers know about other products and services you may be interested in.

• Inviting people who have started but not finished an application to return to complete it.

• Contacting previous customers about potential products and services they may be interested in.

• Improving the relevance of any marketing messages we may send you.

Sending you marketing messages on behalf of third parties, where you have provided your consent.

Lawful basis:

Necessary for our legitimate interests, including informing you of new products and services and helping to grow our business. We may rely on this lawful basis where you are a customer, and we are marketing our own similar products and services to you.

Consent where we have obtained your consent to receive certain marketing messages, including for third party marketing.

You can change your marketing preferences and opt out of receiving marketing communications at any time by unsubscribing from the relevant communications.

Purpose:

To display advertising to you across the web and on social media platforms:

• Showing you adverts for Oodle, including through providing your personal data to Facebook and other social media platforms.

• Sharing personal data with third parties offering online advertising space, to show you adverts that we think are most relevant for you.

• Measuring the effectiveness of adverts, including if you interact with the advert.

Lawful basis:

Necessary for our legitimate interests, including promoting our business.

Consent where cookies or similar technologies are used for such advertising. Please see our Cookies Notice  for more information.

Purpose:

To consider any specific requirements you may have due to a health condition or characteristics of vulnerability.

Lawful basis:

Necessary for our legitimate interests, to ensure that we can comply with regulatory obligations relating to treatment of vulnerable customers.

Where we process special category data for these purposes, we do so on the basis that it is necessary to protect your economic wellbeing.

Purpose:

To conduct research with customers to improve our service. This includes inviting you to take part in online surveys or in-depth interviews so we can improve the experience we can provide to customers.

Lawful basis:

Necessary for our legitimate interests, including improving our business and responding to customer feedback.

Using your information

Data protection law requires us to have a lawful basis for using your personal data. We rely on one or more of the following bases to use your personal data:

• The processing is necessary for a contract, i.e. to fulfil our contract with you;

• The processing is necessary to comply with the law, for example to prevent fraud and report to regulators such as the Financial Conduct Authority;

• The processing is necessary for our legitimate interests, for example monitoring our products and services so that we can improve them; and our interests aren’t outweighed by your interests, rights or freedoms;

You have given us your consent.

Below we describe in more detail the purposes for which we process your personal data and the corresponding lawful bases.

Purpose:

To onboard and serve you as a customer:


 • Verify your identity (including through using our third-party facial recognition technology) and any other information you’ve provided us, including your financial situation.

• Assess your eligibility for our products and services.

• Assess your credit worthiness, to determine whether you can afford the payments for the motor finance you have applied for.

• Manage your account(s) with us.

• Receive/send service messages about your account.

• Process payments that are paid to you or by you.

• Verify your employment status, including by contacting your employer.

• Monitor your repayment record and any events relevant to your ability to repay Oodle.

• Respond to your queries.

• Allow you to use our lending platform.

Lawful Basis:

Necessary for a contract, to provide our services to you or to decide whether to offer our services to you.

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC.

Purpose:

To comply with our legal obligations:

• Prevent or detect attempted fraud, money laundering or other crimes.

• Comply with your data protection rights.

• Fulfil our regulatory reporting obligations.

• Manage internal and external audit processes.

Lawful basis:

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC, and UK data protection laws.

Purpose:

To improve our business and products:

• Develop new products and services, both in-house and in conjunction with our partners.

• Prepare statistical reports using information about you, other customers and non-customers to help us manage our business better, for example improving our risk models.

• Analyse, assess and improve our services to customers, and for training and monitoring purposes.

• Profile our existing customers to enable us to more accurately target new customers.

Lawful basis:

Necessary for our legitimate interests, including:

· Developing and marketing new products and services our customers and prospective customers will find useful.

· Helping us to find new customers for Oodle’s products and services.

To protect our business:

Purpose:

• To establish, exercise or defend legal claims against us.

• To trace and take appropriate action against you should you fail to maintain payments to your finance agreement (including by getting in touch using any contact details you’ve provided to us)

Lawful basis:

Necessary for our legitimate interests, including protecting our business and our investors, defending Oodle’s financial and reputational position and enforcing our contracts.

Purpose:

To refer to you to credit brokers or other lenders if we’re unable to offer you motor finance.

Lawful basis:

Necessary for our legitimate interests and those of any relevant other lenders/credit brokers, including maintaining strong relationships with prospective customers and others within the industry.

Purpose:
To send you marketing messages on behalf of Oodle, including:

• Letting existing customers know about other products and services you may be interested in.

• Inviting people who have started but not finished an application to return to complete it.

• Contacting previous customers about potential products and services they may be interested in.

• Improving the relevance of any marketing messages we may send you.

Sending you marketing messages on behalf of third parties, where you have provided your consent.

Lawful basis:

Necessary for our legitimate interests, including informing you of new products and services and helping to grow our business. We may rely on this lawful basis where you are a customer, and we are marketing our own similar products and services to you.

Consent where we have obtained your consent to receive certain marketing messages, including for third party marketing.

You can change your marketing preferences and opt out of receiving marketing communications at any time by unsubscribing from the relevant communications.

Purpose:

To display advertising to you across the web and on social media platforms:

• Showing you adverts for Oodle, including through providing your personal data to Facebook and other social media platforms.

• Sharing personal data with third parties offering online advertising space, to show you adverts that we think are most relevant for you.

• Measuring the effectiveness of adverts, including if you interact with the advert.

Lawful basis:

Necessary for our legitimate interests, including promoting our business.

Consent where cookies or similar technologies are used for such advertising. Please see our Cookies Notice  for more information.

Purpose:

To consider any specific requirements you may have due to a health condition or characteristics of vulnerability.

Lawful basis:

Necessary for our legitimate interests, to ensure that we can comply with regulatory obligations relating to treatment of vulnerable customers.

Where we process special category data for these purposes, we do so on the basis that it is necessary to protect your economic wellbeing.

Purpose:

To conduct research with customers to improve our service. This includes inviting you to take part in online surveys or in-depth interviews so we can improve the experience we can provide to customers.

Lawful basis:

Necessary for our legitimate interests, including improving our business and responding to customer feedback.

Using your information

Data protection law requires us to have a lawful basis for using your personal data. We rely on one or more of the following bases to use your personal data:

• The processing is necessary for a contract, i.e. to fulfil our contract with you;

• The processing is necessary to comply with the law, for example to prevent fraud and report to regulators such as the Financial Conduct Authority;

• The processing is necessary for our legitimate interests, for example monitoring our products and services so that we can improve them; and our interests aren’t outweighed by your interests, rights or freedoms;

You have given us your consent.

Below we describe in more detail the purposes for which we process your personal data and the corresponding lawful bases.

Purpose:

To onboard and serve you as a customer:


 • Verify your identity (including through using our third-party facial recognition technology) and any other information you’ve provided us, including your financial situation.

• Assess your eligibility for our products and services.

• Assess your credit worthiness, to determine whether you can afford the payments for the motor finance you have applied for.

• Manage your account(s) with us.

• Receive/send service messages about your account.

• Process payments that are paid to you or by you.

• Verify your employment status, including by contacting your employer.

• Monitor your repayment record and any events relevant to your ability to repay Oodle.

• Respond to your queries.

• Allow you to use our lending platform.

Lawful Basis:

Necessary for a contract, to provide our services to you or to decide whether to offer our services to you.

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC.

Purpose:

To comply with our legal obligations:

• Prevent or detect attempted fraud, money laundering or other crimes.

• Comply with your data protection rights.

• Fulfil our regulatory reporting obligations.

• Manage internal and external audit processes.

Lawful basis:

Necessary to comply with the law, including UK anti-money laundering laws and regulations, UK and UN sanctions (which prohibit us from providing products to certain individuals), rules and regulations imposed by the Financial Conduct Authority and HMRC, and UK data protection laws.

Purpose:

To improve our business and products:

• Develop new products and services, both in-house and in conjunction with our partners.

• Prepare statistical reports using information about you, other customers and non-customers to help us manage our business better, for example improving our risk models.

• Analyse, assess and improve our services to customers, and for training and monitoring purposes.

• Profile our existing customers to enable us to more accurately target new customers.

Lawful basis:

Necessary for our legitimate interests, including:

· Developing and marketing new products and services our customers and prospective customers will find useful.

· Helping us to find new customers for Oodle’s products and services.

To protect our business:

Purpose:

• To establish, exercise or defend legal claims against us.

• To trace and take appropriate action against you should you fail to maintain payments to your finance agreement (including by getting in touch using any contact details you’ve provided to us)

Lawful basis:

Necessary for our legitimate interests, including protecting our business and our investors, defending Oodle’s financial and reputational position and enforcing our contracts.

Purpose:

To refer to you to credit brokers or other lenders if we’re unable to offer you motor finance.

Lawful basis:

Necessary for our legitimate interests and those of any relevant other lenders/credit brokers, including maintaining strong relationships with prospective customers and others within the industry.

Purpose:
To send you marketing messages on behalf of Oodle, including:

• Letting existing customers know about other products and services you may be interested in.

• Inviting people who have started but not finished an application to return to complete it.

• Contacting previous customers about potential products and services they may be interested in.

• Improving the relevance of any marketing messages we may send you.

Sending you marketing messages on behalf of third parties, where you have provided your consent.

Lawful basis:

Necessary for our legitimate interests, including informing you of new products and services and helping to grow our business. We may rely on this lawful basis where you are a customer, and we are marketing our own similar products and services to you.

Consent where we have obtained your consent to receive certain marketing messages, including for third party marketing.

You can change your marketing preferences and opt out of receiving marketing communications at any time by unsubscribing from the relevant communications.

Purpose:

To display advertising to you across the web and on social media platforms:

• Showing you adverts for Oodle, including through providing your personal data to Facebook and other social media platforms.

• Sharing personal data with third parties offering online advertising space, to show you adverts that we think are most relevant for you.

• Measuring the effectiveness of adverts, including if you interact with the advert.

Lawful basis:

Necessary for our legitimate interests, including promoting our business.

Consent where cookies or similar technologies are used for such advertising. Please see our Cookies Notice  for more information.

Purpose:

To consider any specific requirements you may have due to a health condition or characteristics of vulnerability.

Lawful basis:

Necessary for our legitimate interests, to ensure that we can comply with regulatory obligations relating to treatment of vulnerable customers.

Where we process special category data for these purposes, we do so on the basis that it is necessary to protect your economic wellbeing.

Purpose:

To conduct research with customers to improve our service. This includes inviting you to take part in online surveys or in-depth interviews so we can improve the experience we can provide to customers.

Lawful basis:

Necessary for our legitimate interests, including improving our business and responding to customer feedback.

Who we share your personal data with and why

We may share your data with the following parties:

           • service providers and other third parties who process and store data on our behalf, including marketing agencies, mail outsourcing service provider, Information Technology service providers who provide and maintain our systems and our website host;

           • motor dealers and brokers, including their business partners;

           • financial crime prevention agencies and credit reference agencies;

           • third parties who provide maintenance and servicing of any vehicles you hire as part of the services;

           • professional advisors;

           • in the event that our business, either in whole or in part, is acquired by a third party;

           • if we are under a duty to disclose or share your personal data to comply with any legal obligation, or in order to enforce any contract with you;

           • to protect our rights, property, or the safety of our employees, customers or others, for example exchanging information with other companies and organisations for the purposes of financial crime prevention and credit risk reduction;

           • a third-party company that may take over your contract, so that you can continue with your contract;

           • third party insurance providers;

           • debt collection agencies; and

           • the courts in connection with court proceedings.

We will take reasonable steps to make sure that whoever we share your personal data with protects it as well as we do.

Who we share your personal data with and why

We may share your data with the following parties:

           • service providers and other third parties who process and store data on our behalf, including marketing agencies, mail outsourcing service provider, Information Technology service providers who provide and maintain our systems and our website host;

           • motor dealers and brokers, including their business partners;

           • financial crime prevention agencies and credit reference agencies;

           • third parties who provide maintenance and servicing of any vehicles you hire as part of the services;

           • professional advisors;

           • in the event that our business, either in whole or in part, is acquired by a third party;

           • if we are under a duty to disclose or share your personal data to comply with any legal obligation, or in order to enforce any contract with you;

           • to protect our rights, property, or the safety of our employees, customers or others, for example exchanging information with other companies and organisations for the purposes of financial crime prevention and credit risk reduction;

           • a third-party company that may take over your contract, so that you can continue with your contract;

           • third party insurance providers;

           • debt collection agencies; and

           • the courts in connection with court proceedings.

We will take reasonable steps to make sure that whoever we share your personal data with protects it as well as we do.

Who we share your personal data with and why

We may share your data with the following parties:

           • service providers and other third parties who process and store data on our behalf, including marketing agencies, mail outsourcing service provider, Information Technology service providers who provide and maintain our systems and our website host;

           • motor dealers and brokers, including their business partners;

           • financial crime prevention agencies and credit reference agencies;

           • third parties who provide maintenance and servicing of any vehicles you hire as part of the services;

           • professional advisors;

           • in the event that our business, either in whole or in part, is acquired by a third party;

           • if we are under a duty to disclose or share your personal data to comply with any legal obligation, or in order to enforce any contract with you;

           • to protect our rights, property, or the safety of our employees, customers or others, for example exchanging information with other companies and organisations for the purposes of financial crime prevention and credit risk reduction;

           • a third-party company that may take over your contract, so that you can continue with your contract;

           • third party insurance providers;

           • debt collection agencies; and

           • the courts in connection with court proceedings.

We will take reasonable steps to make sure that whoever we share your personal data with protects it as well as we do.

Credit Reference Agencies 

If you submit your details to get pre-approval for motor finance, we’ll supply your Personal Data to credit reference agencies (CRAs) and carry out what’s called a ‘soft credit search’ to get a view of your credit rating.

The CRAs will record our search but other lenders won’t be able to see it and it won’t affect your credit score.

When we perform a soft search on you, this will also include a soft credit search of any person that you share financial ties with (a joint current account or a joint mortgage, for example); this person is known as a ‘financial associate’. Beyond using your financial associate’s data for decisioning purposes, we will not use their data for any other purpose. However, it will leave a soft search on their credit file, so you should make them aware before submitting your details to get pre-approval for motor finance.

CRAs link your records together and these links will remain on your and their files until such time as you or your financial associate successfully files a request with the CRAs to break that link.

The above soft search will give us an overall view of your financial health (including your credit score) but not your full credit report. This will help us determine whether a full application is likely to be successful and the interest rate we might charge.

It’s only when you proceed to complete a full application and we fund the agreement that we perform a full search of your credit report which can be visible by other lenders.

CRAs will supply to us public information (including from the electoral register), credit, financial situation and financial history information; in addition to financial crime prevention information about you.

We will use your credit file information to:

           • Assess your creditworthiness and whether you can afford payments for the motor finance you want.

           • Verify the accuracy of the information you have provided us.

           • Prevent criminal activity, fraud and money laundering.

           • Manage your account if you take out motor finance with us.

           • Trace and recover debts if you take out credit finance with us.

           • Ensure any offers provided to you are appropriate to your circumstances.

We’ll go on sharing your Personal Data with CRAs for as long as you are a customer. We will also inform CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. They may also provide this information to other organisations including financial institutions who offer similar products to Oodle.

In order to understand more about CRAs, you can read their Credit Reference Agency Information Notice (CRAIN) which will tell you more about how they process personal data.

You can access the CRAIN for each of the CRAs we use here:

           • TransUnion 

           • Equifax 

           • Experian 

Credit Reference Agencies 

If you submit your details to get pre-approval for motor finance, we’ll supply your Personal Data to credit reference agencies (CRAs) and carry out what’s called a ‘soft credit search’ to get a view of your credit rating.

The CRAs will record our search but other lenders won’t be able to see it and it won’t affect your credit score.

When we perform a soft search on you, this will also include a soft credit search of any person that you share financial ties with (a joint current account or a joint mortgage, for example); this person is known as a ‘financial associate’. Beyond using your financial associate’s data for decisioning purposes, we will not use their data for any other purpose. However, it will leave a soft search on their credit file, so you should make them aware before submitting your details to get pre-approval for motor finance.

CRAs link your records together and these links will remain on your and their files until such time as you or your financial associate successfully files a request with the CRAs to break that link.

The above soft search will give us an overall view of your financial health (including your credit score) but not your full credit report. This will help us determine whether a full application is likely to be successful and the interest rate we might charge.

It’s only when you proceed to complete a full application and we fund the agreement that we perform a full search of your credit report which can be visible by other lenders.

CRAs will supply to us public information (including from the electoral register), credit, financial situation and financial history information; in addition to financial crime prevention information about you.

We will use your credit file information to:

           • Assess your creditworthiness and whether you can afford payments for the motor finance you want.

           • Verify the accuracy of the information you have provided us.

           • Prevent criminal activity, fraud and money laundering.

           • Manage your account if you take out motor finance with us.

           • Trace and recover debts if you take out credit finance with us.

           • Ensure any offers provided to you are appropriate to your circumstances.

We’ll go on sharing your Personal Data with CRAs for as long as you are a customer. We will also inform CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. They may also provide this information to other organisations including financial institutions who offer similar products to Oodle.

In order to understand more about CRAs, you can read their Credit Reference Agency Information Notice (CRAIN) which will tell you more about how they process personal data.

You can access the CRAIN for each of the CRAs we use here:

           • TransUnion 

           • Equifax 

           • Experian 

Credit Reference Agencies 

If you submit your details to get pre-approval for motor finance, we’ll supply your Personal Data to credit reference agencies (CRAs) and carry out what’s called a ‘soft credit search’ to get a view of your credit rating.

The CRAs will record our search but other lenders won’t be able to see it and it won’t affect your credit score.

When we perform a soft search on you, this will also include a soft credit search of any person that you share financial ties with (a joint current account or a joint mortgage, for example); this person is known as a ‘financial associate’. Beyond using your financial associate’s data for decisioning purposes, we will not use their data for any other purpose. However, it will leave a soft search on their credit file, so you should make them aware before submitting your details to get pre-approval for motor finance.

CRAs link your records together and these links will remain on your and their files until such time as you or your financial associate successfully files a request with the CRAs to break that link.

The above soft search will give us an overall view of your financial health (including your credit score) but not your full credit report. This will help us determine whether a full application is likely to be successful and the interest rate we might charge.

It’s only when you proceed to complete a full application and we fund the agreement that we perform a full search of your credit report which can be visible by other lenders.

CRAs will supply to us public information (including from the electoral register), credit, financial situation and financial history information; in addition to financial crime prevention information about you.

We will use your credit file information to:

           • Assess your creditworthiness and whether you can afford payments for the motor finance you want.

           • Verify the accuracy of the information you have provided us.

           • Prevent criminal activity, fraud and money laundering.

           • Manage your account if you take out motor finance with us.

           • Trace and recover debts if you take out credit finance with us.

           • Ensure any offers provided to you are appropriate to your circumstances.

We’ll go on sharing your Personal Data with CRAs for as long as you are a customer. We will also inform CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. They may also provide this information to other organisations including financial institutions who offer similar products to Oodle.

In order to understand more about CRAs, you can read their Credit Reference Agency Information Notice (CRAIN) which will tell you more about how they process personal data.

You can access the CRAIN for each of the CRAs we use here:

           • TransUnion 

           • Equifax 

           • Experian 

Financial crime prevention agencies

As a regulated financial services business, we are committed to preventing financial crime which includes fraud, money laundering, tax evasion or terrorist financing.

When you register or apply to use our services, we will share your personal data with financial crime prevention agencies such as CIFAS. This is because we have a legitimate interest in preventing financial crime and we are required to verify your identity in order to protect our business and to comply with laws that apply to us.

If you give us false or inaccurate information, or if we suspect or identify fraud, money laundering, tax evasion or terrorist financing, we may record this and pass this information to financial crime prevention agencies and other relevant organisations, including law enforcement agencies. We and other organisations may access and use this information to prevent fraud, money laundering or other criminal activity.

As part of the processing of your personal data, decisions may be made by automated means (further information below). This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity.

If we, or a financial crime prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

Financial crime prevention agencies may hold your information for different periods of time, and if you’re considered to be a fraud or money laundering risk, your information may be held for up to six years. It may also result in us and others refusing to provide services, financing or employment to you.

 

We use Cifas to help prevent fraud, money laundering and to verify your identity. Further information about how Cifas process your data can be found on their Fair Processing Notice.

Financial crime prevention agencies

As a regulated financial services business, we are committed to preventing financial crime which includes fraud, money laundering, tax evasion or terrorist financing.

When you register or apply to use our services, we will share your personal data with financial crime prevention agencies such as CIFAS. This is because we have a legitimate interest in preventing financial crime and we are required to verify your identity in order to protect our business and to comply with laws that apply to us.

If you give us false or inaccurate information, or if we suspect or identify fraud, money laundering, tax evasion or terrorist financing, we may record this and pass this information to financial crime prevention agencies and other relevant organisations, including law enforcement agencies. We and other organisations may access and use this information to prevent fraud, money laundering or other criminal activity.

As part of the processing of your personal data, decisions may be made by automated means (further information below). This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity.

If we, or a financial crime prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

Financial crime prevention agencies may hold your information for different periods of time, and if you’re considered to be a fraud or money laundering risk, your information may be held for up to six years. It may also result in us and others refusing to provide services, financing or employment to you.

 

We use Cifas to help prevent fraud, money laundering and to verify your identity. Further information about how Cifas process your data can be found on their Fair Processing Notice.

Financial crime prevention agencies

As a regulated financial services business, we are committed to preventing financial crime which includes fraud, money laundering, tax evasion or terrorist financing.

When you register or apply to use our services, we will share your personal data with financial crime prevention agencies such as CIFAS. This is because we have a legitimate interest in preventing financial crime and we are required to verify your identity in order to protect our business and to comply with laws that apply to us.

If you give us false or inaccurate information, or if we suspect or identify fraud, money laundering, tax evasion or terrorist financing, we may record this and pass this information to financial crime prevention agencies and other relevant organisations, including law enforcement agencies. We and other organisations may access and use this information to prevent fraud, money laundering or other criminal activity.

As part of the processing of your personal data, decisions may be made by automated means (further information below). This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity.

If we, or a financial crime prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

Financial crime prevention agencies may hold your information for different periods of time, and if you’re considered to be a fraud or money laundering risk, your information may be held for up to six years. It may also result in us and others refusing to provide services, financing or employment to you.

 

We use Cifas to help prevent fraud, money laundering and to verify your identity. Further information about how Cifas process your data can be found on their Fair Processing Notice.

Open Banking

We may use Open Banking to communicate with your financial services providers to easily verify your income and other financial information. We may also use Open Banking if you have motor finance with us but you experience financial difficulties, so we can easily check your financial position and consider the best ways to support you.
The Open Banking platform we use is Consents Online Limited. Their privacy policy can be accessed via https://consents.online/Privacy. We will only use your Open Banking data with your informed consent, which will be sought from you via a link sent to your mobile phone. If you provide consent, we will have access to the transaction information from your bank account for the last 12 months. Unless your bank has allowed access for a longer period (which is usually for up to 90 days after you have consented), we will usually receive a one-off snapshot of 12 months of transaction history, which will be held on your file.

We will not give your Open Banking data to any third parties, unless we have a lawful basis to do so in accordance with this privacy notice.

Open Banking

We may use Open Banking to communicate with your financial services providers to easily verify your income and other financial information. We may also use Open Banking if you have motor finance with us but you experience financial difficulties, so we can easily check your financial position and consider the best ways to support you.
The Open Banking platform we use is Consents Online Limited. Their privacy policy can be accessed via https://consents.online/Privacy. We will only use your Open Banking data with your informed consent, which will be sought from you via a link sent to your mobile phone. If you provide consent, we will have access to the transaction information from your bank account for the last 12 months. Unless your bank has allowed access for a longer period (which is usually for up to 90 days after you have consented), we will usually receive a one-off snapshot of 12 months of transaction history, which will be held on your file.

We will not give your Open Banking data to any third parties, unless we have a lawful basis to do so in accordance with this privacy notice.

Open Banking

We may use Open Banking to communicate with your financial services providers to easily verify your income and other financial information. We may also use Open Banking if you have motor finance with us but you experience financial difficulties, so we can easily check your financial position and consider the best ways to support you.
The Open Banking platform we use is Consents Online Limited. Their privacy policy can be accessed via https://consents.online/Privacy. We will only use your Open Banking data with your informed consent, which will be sought from you via a link sent to your mobile phone. If you provide consent, we will have access to the transaction information from your bank account for the last 12 months. Unless your bank has allowed access for a longer period (which is usually for up to 90 days after you have consented), we will usually receive a one-off snapshot of 12 months of transaction history, which will be held on your file.

We will not give your Open Banking data to any third parties, unless we have a lawful basis to do so in accordance with this privacy notice.

Automated Decisions and Profiling

In some instances, we may use your personal data to make automated decisions. This helps us to make sure our decisions are quick, fair, efficient and correct, based on what we know about you.

 

When you apply for a product or service, we make the following decisions electronically based on the personal data we know about you:

 

           • deciding whether the product or service is relevant for you; and

           • checking whether you meet the conditions to enter into the contract, which may include checking information such as your age, residency or nationality, as well as carrying out a credit check with credit reference agencies (see the section headed “Credit reference agencies” for more information about how this works).

 

These decisions are necessary to allow us to decide whether to enter into a contract with you. We have to make them electronically to make sure that the decision is made quickly enough and is correct.

When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision (further information below).

Automated Decisions and Profiling

In some instances, we may use your personal data to make automated decisions. This helps us to make sure our decisions are quick, fair, efficient and correct, based on what we know about you.

 

When you apply for a product or service, we make the following decisions electronically based on the personal data we know about you:

 

           • deciding whether the product or service is relevant for you; and

           • checking whether you meet the conditions to enter into the contract, which may include checking information such as your age, residency or nationality, as well as carrying out a credit check with credit reference agencies (see the section headed “Credit reference agencies” for more information about how this works).

 

These decisions are necessary to allow us to decide whether to enter into a contract with you. We have to make them electronically to make sure that the decision is made quickly enough and is correct.

When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision (further information below).

Automated Decisions and Profiling

In some instances, we may use your personal data to make automated decisions. This helps us to make sure our decisions are quick, fair, efficient and correct, based on what we know about you.

 

When you apply for a product or service, we make the following decisions electronically based on the personal data we know about you:

 

           • deciding whether the product or service is relevant for you; and

           • checking whether you meet the conditions to enter into the contract, which may include checking information such as your age, residency or nationality, as well as carrying out a credit check with credit reference agencies (see the section headed “Credit reference agencies” for more information about how this works).

 

These decisions are necessary to allow us to decide whether to enter into a contract with you. We have to make them electronically to make sure that the decision is made quickly enough and is correct.

When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision (further information below).

How long we keep your information

We only retain your personal data for as long as necessary for the purposes described in this privacy notice. For example, we retain personal data we collect from you where we have an ongoing legitimate need to do so i.e. to provide you with our services, or to comply with applicable legal obligations e.g. tax or accounting requirements.

In the event that you make an application to use our services, we will store your personal data whilst you continue to use our services and for a period of up to 7 years thereafter (or such longer period as is necessary for the proper performance of our regulatory obligations to you).

If you apply for finance and we decide not to lend to you or your finance application is accepted but you do not proceed, we will keep your information for 6 years from the end of your relationship with us. Oodle does this for several reasons, including to provide information to regulators on our lending practices. However, we may extend the retention period for the finance application e.g. if there is an ongoing dispute or complaint.

How long we keep your information

We only retain your personal data for as long as necessary for the purposes described in this privacy notice. For example, we retain personal data we collect from you where we have an ongoing legitimate need to do so i.e. to provide you with our services, or to comply with applicable legal obligations e.g. tax or accounting requirements.

In the event that you make an application to use our services, we will store your personal data whilst you continue to use our services and for a period of up to 7 years thereafter (or such longer period as is necessary for the proper performance of our regulatory obligations to you).

If you apply for finance and we decide not to lend to you or your finance application is accepted but you do not proceed, we will keep your information for 6 years from the end of your relationship with us. Oodle does this for several reasons, including to provide information to regulators on our lending practices. However, we may extend the retention period for the finance application e.g. if there is an ongoing dispute or complaint.

How long we keep your information

We only retain your personal data for as long as necessary for the purposes described in this privacy notice. For example, we retain personal data we collect from you where we have an ongoing legitimate need to do so i.e. to provide you with our services, or to comply with applicable legal obligations e.g. tax or accounting requirements.

In the event that you make an application to use our services, we will store your personal data whilst you continue to use our services and for a period of up to 7 years thereafter (or such longer period as is necessary for the proper performance of our regulatory obligations to you).

If you apply for finance and we decide not to lend to you or your finance application is accepted but you do not proceed, we will keep your information for 6 years from the end of your relationship with us. Oodle does this for several reasons, including to provide information to regulators on our lending practices. However, we may extend the retention period for the finance application e.g. if there is an ongoing dispute or complaint.

How and where we store your information

When we have no ongoing legitimate need to process your personal data, we will either delete or anonymise it, where possible.

All information you provide to us is stored on our secure servers which are located in England. Some of our service providers and other organisations that we work with may be located outside of the UK in countries that do not have the same standards of protection for personal data as the UK. We will, however, always use every reasonable effort to ensure sufficient protections are in place to safeguard your personal data.

We carry out due diligence on all suppliers we appoint to check where they send personal data and, if personal data is transferred outside the UK, to make sure that appropriate protections are in place.

Those protections could be:

           • making sure the country your data is sent to is designated as an “adequate” country by the UK government. This means that the government has reviewed that country’s data protection laws and decided that it provides an equivalent level of protection of personal data to the UK; or

           • if the transfer of personal data is between group companies, making sure that there are “binding corporate rules” in place. These are sets of policies and rules between group companies that ensure that companies in other countries protect personal data in the same way that it is protected in the UK; or

           • making sure that there is an “international data transfer agreement” in place to cover the transfer. This is an agreement that places the duty on the recipient of the personal data outside the UK to protect personal data as would be required by UK data protection laws.

How and where we store your information

When we have no ongoing legitimate need to process your personal data, we will either delete or anonymise it, where possible.

All information you provide to us is stored on our secure servers which are located in England. Some of our service providers and other organisations that we work with may be located outside of the UK in countries that do not have the same standards of protection for personal data as the UK. We will, however, always use every reasonable effort to ensure sufficient protections are in place to safeguard your personal data.

We carry out due diligence on all suppliers we appoint to check where they send personal data and, if personal data is transferred outside the UK, to make sure that appropriate protections are in place.

Those protections could be:

           • making sure the country your data is sent to is designated as an “adequate” country by the UK government. This means that the government has reviewed that country’s data protection laws and decided that it provides an equivalent level of protection of personal data to the UK; or

           • if the transfer of personal data is between group companies, making sure that there are “binding corporate rules” in place. These are sets of policies and rules between group companies that ensure that companies in other countries protect personal data in the same way that it is protected in the UK; or

           • making sure that there is an “international data transfer agreement” in place to cover the transfer. This is an agreement that places the duty on the recipient of the personal data outside the UK to protect personal data as would be required by UK data protection laws.

How and where we store your information

When we have no ongoing legitimate need to process your personal data, we will either delete or anonymise it, where possible.

All information you provide to us is stored on our secure servers which are located in England. Some of our service providers and other organisations that we work with may be located outside of the UK in countries that do not have the same standards of protection for personal data as the UK. We will, however, always use every reasonable effort to ensure sufficient protections are in place to safeguard your personal data.

We carry out due diligence on all suppliers we appoint to check where they send personal data and, if personal data is transferred outside the UK, to make sure that appropriate protections are in place.

Those protections could be:

           • making sure the country your data is sent to is designated as an “adequate” country by the UK government. This means that the government has reviewed that country’s data protection laws and decided that it provides an equivalent level of protection of personal data to the UK; or

           • if the transfer of personal data is between group companies, making sure that there are “binding corporate rules” in place. These are sets of policies and rules between group companies that ensure that companies in other countries protect personal data in the same way that it is protected in the UK; or

           • making sure that there is an “international data transfer agreement” in place to cover the transfer. This is an agreement that places the duty on the recipient of the personal data outside the UK to protect personal data as would be required by UK data protection laws.

Your rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. You can ask to exercise these rights by contacting us at dataprotectionofficer@oodlefinance.com. There are some circumstances in which we do not need to comply with all or part of your request. If this is the case, we will explain this to you.

Right to access personal data:
You can ask us to send you a copy of the personal data we hold about you, also known as making a data subject access request “DSAR”.

If you would like to request your personal data, please write to us on DSAR@oodlefinance.com, telephone us on 01865 477826 or contact us via post at the address below (addressed to “DSAR Team”)

Right to correct inaccurate personal data

You can ask us to correct, clarify or amend your personal data if it is inaccurate, incomplete or otherwise out of date. We may need to ask for further information from you to correct or update your information.

Right of erasure

You can ask us to delete your personal data in certain circumstances, for example if we no longer need it or if we have collected it unlawfully

Right to restrict use of your personal data

You can ask us to limit how we use your personal data in certain circumstances. For example, if you think your personal data is inaccurate but we disagree, you can ask us to stop using it to make decisions until we can verify if it is accurate or not.

Right to data portability

Where you have given us personal data that is necessary for a contract, or where we collected it based on your consent, you can ask us to move, copy or transfer it to another provider in a common electronic format

Right to object

Where the use of personal data is necessary for our legitimate interests, you can ask us to stop using it for those purposes. We can continue to use it if we can show that we have a compelling, legitimate reason to do so.

Right to opt out of direct marketing

You can always ask us not to continue to send direct marketing to you. You can do this by clicking on the “unsubscribe” link in marketing emails or contacting us using the details above.

Please note we may ask you to provide identification verification before we can review any requests made by you, or on your behalf by a third party, in relation to your rights.

You are not required to pay any charge for exercising your rights.

We have one calendar month to respond to you to confirm the action taken, which can be extended to three months for complex or numerous requests.

Your rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. You can ask to exercise these rights by contacting us at dataprotectionofficer@oodlefinance.com. There are some circumstances in which we do not need to comply with all or part of your request. If this is the case, we will explain this to you.

Right to access personal data:
You can ask us to send you a copy of the personal data we hold about you, also known as making a data subject access request “DSAR”.

If you would like to request your personal data, please write to us on DSAR@oodlefinance.com, telephone us on 01865 477826 or contact us via post at the address below (addressed to “DSAR Team”)

Right to correct inaccurate personal data

You can ask us to correct, clarify or amend your personal data if it is inaccurate, incomplete or otherwise out of date. We may need to ask for further information from you to correct or update your information.

Right of erasure

You can ask us to delete your personal data in certain circumstances, for example if we no longer need it or if we have collected it unlawfully

Right to restrict use of your personal data

You can ask us to limit how we use your personal data in certain circumstances. For example, if you think your personal data is inaccurate but we disagree, you can ask us to stop using it to make decisions until we can verify if it is accurate or not.

Right to data portability

Where you have given us personal data that is necessary for a contract, or where we collected it based on your consent, you can ask us to move, copy or transfer it to another provider in a common electronic format

Right to object

Where the use of personal data is necessary for our legitimate interests, you can ask us to stop using it for those purposes. We can continue to use it if we can show that we have a compelling, legitimate reason to do so.

Right to opt out of direct marketing

You can always ask us not to continue to send direct marketing to you. You can do this by clicking on the “unsubscribe” link in marketing emails or contacting us using the details above.

Please note we may ask you to provide identification verification before we can review any requests made by you, or on your behalf by a third party, in relation to your rights.

You are not required to pay any charge for exercising your rights.

We have one calendar month to respond to you to confirm the action taken, which can be extended to three months for complex or numerous requests.

Your rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. You can ask to exercise these rights by contacting us at dataprotectionofficer@oodlefinance.com. There are some circumstances in which we do not need to comply with all or part of your request. If this is the case, we will explain this to you.

Right to access personal data:
You can ask us to send you a copy of the personal data we hold about you, also known as making a data subject access request “DSAR”.

If you would like to request your personal data, please write to us on DSAR@oodlefinance.com, telephone us on 01865 477826 or contact us via post at the address below (addressed to “DSAR Team”)

Right to correct inaccurate personal data

You can ask us to correct, clarify or amend your personal data if it is inaccurate, incomplete or otherwise out of date. We may need to ask for further information from you to correct or update your information.

Right of erasure

You can ask us to delete your personal data in certain circumstances, for example if we no longer need it or if we have collected it unlawfully

Right to restrict use of your personal data

You can ask us to limit how we use your personal data in certain circumstances. For example, if you think your personal data is inaccurate but we disagree, you can ask us to stop using it to make decisions until we can verify if it is accurate or not.

Right to data portability

Where you have given us personal data that is necessary for a contract, or where we collected it based on your consent, you can ask us to move, copy or transfer it to another provider in a common electronic format

Right to object

Where the use of personal data is necessary for our legitimate interests, you can ask us to stop using it for those purposes. We can continue to use it if we can show that we have a compelling, legitimate reason to do so.

Right to opt out of direct marketing

You can always ask us not to continue to send direct marketing to you. You can do this by clicking on the “unsubscribe” link in marketing emails or contacting us using the details above.

Please note we may ask you to provide identification verification before we can review any requests made by you, or on your behalf by a third party, in relation to your rights.

You are not required to pay any charge for exercising your rights.

We have one calendar month to respond to you to confirm the action taken, which can be extended to three months for complex or numerous requests.

Who can I contact if I have further questions or wish to make a complaint?


For any questions, please contact us however you prefer:

For any questions, please contact us however you prefer:

For any questions, please contact us however you prefer:

Post
Post

Data Protection Officer (DPO)

Oodle

Fletcher House
Heatley Road
Oxford Science Park
Oxford
Oxfordshire OX4 4GE

Data Protection Officer (DPO)

Oodle

Fletcher House
Heatley Road
Oxford Science Park
Oxford
Oxfordshire OX4 4GE

Live chat
Live chat

Via Oodle website

Via Oodle website

Email
Email

dataprotectionofficer@oodlefinance.com

dataprotectionofficer@oodlefinance.com

Who can I contact if I have further concerns?


If you remain dissatisfied you can refer your concerns to the Information Commissioner’s Office (ICO), the body that regulates the handling of personal data in the UK at: 

If you remain dissatisfied you can refer your concerns to the Information Commissioner’s Office (ICO), the body that regulates the handling of personal data in the UK at: 

If you remain dissatisfied you can refer your concerns to the Information Commissioner’s Office (ICO), the body that regulates the handling of personal data in the UK at: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Tel: 0303 123 1113 

Tel: 0303 123 1113 

Website: www.ico.org.uk 

Website: www.ico.org.uk 

Glossary

For the words in bold throughout:

For the words in bold throughout:

For the words in bold throughout:

Anonymise
Anonymise

Anonymising personal data means that we continue to hold information but in a form that no longer allows us to identify you. 

Anonymising personal data means that we continue to hold information but in a form that no longer allows us to identify you. 

Automated decisions
Automated decisions

This means decisions that are made solely on the basis of electronic processing of personal data. These decisions are made by a computer, without input from a human. 

This means decisions that are made solely on the basis of electronic processing of personal data. These decisions are made by a computer, without input from a human. 

Biometric data
Biometric data

This means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics, which allow or confirm the unique identification of you, such as facial images.

This means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics, which allow or confirm the unique identification of you, such as facial images.

Data controller
Data controller

This means the company that is legally responsible for making sure your personal data is protected in accordance with legal requirements.   

This means the company that is legally responsible for making sure your personal data is protected in accordance with legal requirements.   

Data processor
Data processor

This means an organisation that processes personal data on our behalf. Data processors only use personal data in ways that we tell them to (on our instructions). We have a contract with all suppliers that tells them how they have to use and protect your personal data. 

This means an organisation that processes personal data on our behalf. Data processors only use personal data in ways that we tell them to (on our instructions). We have a contract with all suppliers that tells them how they have to use and protect your personal data. 

Lawful basis
Lawful basis

Data protection law sets out certain legal grounds which allow us to use personal data. These include where using personal data is necessary to fulfil a contract or to comply with laws, where we have your consent, or where we have a legitimate interest in using your personal data. We refer to the following lawful bases in our privacy notice:  


Necessary for a contract - this means that we need to process your personal data either to:

  • Decide whether to enter into a contract with you (e.g. whether to offer you a product); or

  • Fulfil our obligations under a contract with you (e.g. provide our products and services to you and manage these).


Necessary for our legitimate interests - this means that we need to use your personal data for our business interests, or for the interests of another person (including you). We make sure that we balance those interests with your own rights, and we only use personal data if your rights and freedoms don’t outweigh our interests. We only use personal data in ways that you would reasonably expect to fulfil those interests.


Necessary for vital interests - this means that we need to use your personal data because it is in either your, or someone else’s, vital interests. This could be where there is a threat to your, or someone else’s, life or health and we need to act to prevent or mitigate that threat.


Necessary to comply with the law -  this means that we need to use your personal data to comply with legal obligations that we have. For example, we have legal obligations to take certain steps to prevent money laundering, which requires us to verify your identity. 


Consent - this means you have given us express permission to use your personal data for a particular purpose.  

Data protection law sets out certain legal grounds which allow us to use personal data. These include where using personal data is necessary to fulfil a contract or to comply with laws, where we have your consent, or where we have a legitimate interest in using your personal data. We refer to the following lawful bases in our privacy notice:  


Necessary for a contract - this means that we need to process your personal data either to:

  • Decide whether to enter into a contract with you (e.g. whether to offer you a product); or

  • Fulfil our obligations under a contract with you (e.g. provide our products and services to you and manage these).


Necessary for our legitimate interests - this means that we need to use your personal data for our business interests, or for the interests of another person (including you). We make sure that we balance those interests with your own rights, and we only use personal data if your rights and freedoms don’t outweigh our interests. We only use personal data in ways that you would reasonably expect to fulfil those interests.


Necessary for vital interests - this means that we need to use your personal data because it is in either your, or someone else’s, vital interests. This could be where there is a threat to your, or someone else’s, life or health and we need to act to prevent or mitigate that threat.


Necessary to comply with the law -  this means that we need to use your personal data to comply with legal obligations that we have. For example, we have legal obligations to take certain steps to prevent money laundering, which requires us to verify your identity. 


Consent - this means you have given us express permission to use your personal data for a particular purpose.  

Personal data
Personal data

This means information about you, like your name, contact details, financial information, identity documents and details of your employment. 

This means information about you, like your name, contact details, financial information, identity documents and details of your employment. 

Special category data
Special category data

Some personal data is classified as “special categories” of personal data. This means information about: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation. It also includes genetic data and biometric data used to identify someone. 

Some personal data is classified as “special categories” of personal data. This means information about: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation. It also includes genetic data and biometric data used to identify someone. 

We may modify this Privacy Notice from time to time, so please review it regularly. Any material changes we make to our privacy notice in the future will be posted on this page and, if significant, will be sent to you by email. 

This Privacy Notice was last updated on 2 October 2024. 

We may modify this Privacy Notice from time to time, so please review it regularly. Any material changes we make to our privacy notice in the future will be posted on this page and, if significant, will be sent to you by email. 

This Privacy Notice was last updated on 2 October 2024. 

We may modify this Privacy Notice from time to time, so please review it regularly. Any material changes we make to our privacy notice in the future will be posted on this page and, if significant, will be sent to you by email. 

This Privacy Notice was last updated on 2 October 2024.