Complaints Procedure

As an organisation, we strive to ensure that we deliver the best levels of customer service. However, if you are not happy with the service you have received, you should contact us immediately so that we can investigate your concerns. Our Complaints Procedure is designed to be quick, simple and
fair.

HOW TO MAKE A COMPLAINT

If you are unhappy with the service you have received from a team within TransUnion Information Group, you can register a complaint directly with our Customer Relations team for investigation, either verbally or in writing.

INFORMATION TO PROVIDE

It is important that you provide us with as much information as possible. In your complaint to us, please include the following:

• Full Name
• Full Address
• Date of Birth
• Email Address
• A clear description of your complaint
• Any documentary evidence to support your complaint
• What outcome you require
• Any relevant reference numbers

HOW WE DEAL WITH YOUR COMPLAINT

We will investigate your complaint in accordance with our internal complaints procedure:

• Whether your complaint is made verbally or in writing, you will be contacted via email or letter to confirm we have received your complaint and that it is under investigation.
• You may also be contacted if we require further information.
• On completion of the investigation into your complaint we will write to you and set out the findings of the investigation which has been carried out, whether your complaint has been upheld or rejected and the reasons for that.
• Once we have issued our final response, we will not enter into any further correspondence regarding your complaint unless asked to do so by the regulator.
• We publish complaints data in accordance with our responsibilities under the regulation of the Financial Conduct Authority. Our most recent complaints data can be found at: Consumer Complaints Data

OUR CONTACT DETAILS

Email: ukcustomerrelations@transunion.com

Address:
Customer Relations
TransUnion Information Group
One Park Lane
LEEDS
LS3 1EP

EXTERNAL APPEALS PROCESS

If you are unhappy with our final response you can contact one of the following organisations dependent on the nature of your complaint:

Financial Ombudsman Service
Exchange Tower
LONDON
E14 9SR

Telephone: 0300 123 9 123

Email: complaint.info@financial-ombudsman.org.uk

Information Commissioner’s Office
Wycliffe House
Water Lane
WILMSLOW
SK9 5AF

Telephone: 0303 123 1113

You also have the right to seek recourse through the courts.

RESPONSE TIMES

We will look to deal with your complaint as soon as possible and respond to you in a timely manner. As a minimum:

• We will acknowledge any written complaint within 5 days.
• For all cases, either verbal or written, will aim to provide a final response within 8 weeks.
• If we are not able to provide a final response within 8 weeks we will explain why and indicate when we will be able to provide a final response.

Complaints Procedure – Payment Services

As an organisation, we strive to ensure that we deliver the best levels of customer service. However, if you are not happy with the service you have received, you should contact us immediately so that we can investigate your concerns. Our Complaints Procedure is designed to be quick, simple and fair.

HOW TO MAKE A COMPLAINT

If you are unhappy with the service you have received in relation to our Account Information Service provision you can register a complaint directly with our Customer Relations team for investigation, either verbally or in writing.

INFORMATION TO PROVIDE

It is important that you provide us with as much information as possible. In your complaint to us, please include the following:

• Full Name
• Date of Birth
• Email Address
• A clear description of your complaint about our payment services
• Any documentary evidence to support your complaint
• What outcome you require
• Any relevant reference numbers

HOW WE DEAL WITH YOUR COMPLAINT

We will investigate your complaint in accordance with our internal complaints procedure:

• Whether your complaint is made verbally or in writing, you will be contacted via email or letter to confirm we have received your complaint and that it is under investigation.
• You may also be contacted if we require further information.
• On completion of the investigation into your complaint we will write to you and set out the findings of the investigation which has been carried out, whether your complaint has been upheld or rejected and the reasons for that.
• Once we have issued our final response, we will not enter into any further correspondence regarding your complaint unless asked to do so by the regulator.
• We publish complaints data in accordance with our responsibilities under the regulation of the Financial Conduct Authority (FCA). Our most recent complaints data can be found at: Consumer Complaints Data

OUR CONTACT DETAILS

Email:
ukcustomerrelations@transunion.com

Address:
Customer Relations Team
TransUnion Information Group
One Park Lane
LEEDS
LS3 1EP

EXTERNAL APPEALS PROCESS

If you are unhappy with our final response you can contact the following organisation within 6 months of our final response letter, who will be able to assist you further:

Financial Ombudsman Service
Exchange Tower
LONDON
E14 9SR

Telephone: 0300 123 9 123
Email: complaint.info@financial-ombudsman.org.uk

Please note that only complainants who are defined as eligible by the FCA, can access the Financial Ombudsman Service for support.

Eligible complainants as defined by the FCA are as follows:

• Consumers
• Micro Enterprises *
• Charities and trusts with an annual income of less than £1 million

* A Micro Enterprise is a business which both: (a) employs fewer than 10 people, (b) has a turnover or annual balance sheet that does not exceed €2 million.

Please note that TransUnion does not use an alternative dispute resolution service other than the Financial Ombudsman Service.

You also have the right to seek recourse through the courts.

RESPONSE TIMES

Under the Payment Services Regulations we must look to deal with your complaint as soon as possible and respond to you in a timely manner.

As a minimum:

• We will acknowledge any written complaint within 5 days.
• For all cases, either verbal or written, will aim to provide a final response at the end of 15 business days after the day on which we received the complaint.
• In exceptional circumstances, for reasons beyond our control, where we cannot send a final response within this period we will tell you indicating the reasons for the delay and specifying the deadline by which we will send the final response. If this is the case, we will issue a final response by the end of 35 business days after the day on which we received the complaint, in any event.

Customer Charter

The TransUnion Customer Charter sets out how we will serve and support our customers, as well as outlining what we expect in return to help support you.

What we will do for you:

• We will identify your needs and offer our assistance
• We will explain what information we need, what support we can provide, and the associated timeframes involved
• We will keep you updated on the progress of your case, where appropriate to do so
• If we cannot support you, we will tell you as quickly as we can and the reasons why

What you can expect from us:

• To be friendly, polite and professional and to always act with integrity
• To be approachable, empathetic and keen to hear and respond to your needs
• To be reliable, fair and respect confidentiality
• To communicate our processes clearly

In turn we expect you to:

• Provide the information we need to assist you
• Let us know if the situation changes
• Treat our staff with courtesy and respect

We recognise the importance of exceptional customer service, and we are committed to meeting your individual needs in a professional manner.

What is a pre-authorisation?

A pre-authorisation is the practice within the payment card industry of temporarily reserving funds on a credit or debit card.

Why might TransUnion (formerly Callcredit) perform a pre-authorisation on my payment card?

TransUnion provide a wide range of identity and payment verification services to businesses. This allows banks, lenders, retailers and a wide range of other companies to protect both themselves and consumers against fraud. A pre-authorisation for a small amount may be used as part of these services to verify payment card details.

If you have recently provided your card details as part of an application or payment process, TransUnion may perform a pre-authorisation on behalf of the company as part of their fraud checks which may be shown temporarily on your card statement.

Funds are only temporarily reserved on your card and TransUnion will never take payment as part of this process.

What should I do if I haven't used my card details recently?

If a pre-authorisation has been performed on your card and you have not recently provided your card details, or given permission for another person to use your card details, as part of an application or payment process, it may be that your card has been compromised. If you suspect that your card details have been compromised, contact your card issuer immediately.

TransUnion offer a range of solutions to help consumers protect their identity and manage their finances. If you would like more information on these services, please visit (/consumer-solutions).

TransUnion Information Group Cookie Notice

This document provides information about how we use cookies on our website at www.transunion.co.uk.

1. WHO ARE WE?

This website is operated by TransUnion Information Group Limited, which is a company registered in England and Wales with company number 04968328. Its registered office is at One Park Lane, Leeds, West Yorkshire LS3 1EP.

2. WHAT ARE COOKIES?

A cookie is a small file of letters and numbers that we put on your device when you browse our website.

3. WHAT DO WE USE COOKIES FOR?

We use cookies and similar technologies to distinguish you from other users of the website. This helps us to provide you with a good experience when you browse the website and also allows us to personalise and improve the website.

Our cookies are not used to collect information which (by itself) allows us to identify who you are. But if you separately tell us who you are, we may link your identity to the cookies we put on your device so that we can see how you are using the website. We use that information in accordance with the privacy notice that we give you when you tell us who you are.

4. WHAT COOKIES DO WE USE?

We use the following kinds of cookie:

• Strictly necessary cookies. These are cookies that are required for the operation of the website. They include, for example, cookies that enable you to log into secure areas of the website.
• Analytical/performance cookies. These cookies allow us to recognise and count the number of visitors and to see how visitors move around the website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. They also allow us to tell if you have reached our website from one of our advertising partners so that we can meet our contractual commitments to that partner.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences.
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

You can find more information about the individual cookies we use and the purposes for which we use them in the table below.

5. HOW TO CONTROL COOKIES

Strictly necessary cookies are always on when you visit us. On your first visit to us, we’ll ask you to choose which cookies we can use. You can always change your mind by going to your settings.

You can block cookies using your browser settings that allow you to refuse all or some cookies. However, if you use your browser settings to block all cookies (including strictly necessary cookies) you may not be able to access parts of our website or use some of its features.

For more information about this, and about cookies in general, you may wish to visit https://www.aboutcookies.org.uk/.

Accessibility

TransUnion Information Group is committed to ensuring our website is accessible to as many visitors as possible, regardless of physical abilities or software. We have taken the following steps to achieve this goal:

Standards

• This site is built using XHTML 1.0 Strict. (Our mobile site is built using HTML5 and CSS3)
• The site uses valid CSS 2.1 for visual layout and styling.
• The site uses structured semantic markup. For example, table markup is used for data tables, lists are marked up using lists elements, headers are marked up as headers and so on.
• All links can be followed in any browser, even if scripting is turned off in the visitor's browser.

Images

• Content images on the site use descriptive ALT attributes.
• Purely decorative graphics include null ALT attributes.

Visual Design

• All text is sized using relative sizes to allow it to be resized by users of any browser.
• All main content is structured so as to be readable in any browser, regardless of whether it supports images, stylesheets, scripting or plugins.

Copyright Notice

The copyright in the design and content of this website are owned by TransUnion Information Group Limited. © TransUnion Information Group Limited 2019. All rights reserved.

Your Data Rights

Here at TransUnion we handle lots of different kinds of data. Where we hold personal data about you, we want to ensure that you can exercise your rights over that data as easily as possible. We’ve put this page together to help you do that.

WHAT DATA CAN I EXERCISE MY RIGHTS OVER?

You can exercise your rights in relation to any personal data that we hold about you.

The kinds of personal data that you may be interested in exercising your rights over include:

• consumer credit reference data
• consumer anti-fraud, mobile phone and product data (for example if you have an Immobilise account)
• consumer marketing data
• your employment file if you are a past or present TransUnion employee
• data we hold if you are a business contact at one of our clients, potential clients or suppliers
• data relating to the staff of our clients who use our products and services
• your correspondence with us (such as queries or complaints that you have raised)

If you just want to know what kinds of data we hold and how we use and share it, please refer to our Privacy Centre or the separate privacy notices for any services you may have signed up for (such as Immobilise).

Sometimes we hold personal data on behalf of other organisations but don’t make decisions about how or why that data will be used. In these cases, you’ll need to contact the relevant organisation directly if you want to exercise your rights over that data.

WHAT RIGHTS DO I HAVE?

You have the following rights over the personal data that we handle.

Access

You have the right to know what data we hold about you, what we use it for, where we got it from, the kinds of organisations that we share it with and how long we keep it for.

At TransUnion there are two kinds of access request you can make:

• Limited subject access request – provides you with a copy of your credit file.
• Full subject access request – provides you with any other of your personal data that you specify.

If you’re just interested in seeing what’s on your credit file, you can do this online.

Rectification

If you believe that the data we hold about you is incorrect, inaccurate or needs to be brought up date, you can ask us to correct it.

Special rules apply where you ask us to correct something on your credit file. This is because of some separate legislation known as the Consumer Credit Act 1974. In these cases:

• The first step is to request a copy of your credit file.
• You can then let us know which entries on your file need to be corrected.
• We will mark the data as being under dispute and will investigate whether or not it’s correct. This will usually involve contacting the organisation that supplied the information to us.
• When we finish our investigation we will let you know the outcome. We have a 28 day deadline for doing this.
• If you’re not happy with the outcome you have a right to add an explanatory notice of up to 200 words onto your credit file.

Erasure (also known as the right to be forgotten)

This is a right to request that we delete some or all of the personal data that we hold about you.

It’s important to appreciate that this is not an absolute right. It only applies in certain situations and is subject to certain caveats. The circumstances in which it applies are explained on the Information Commissioner’s website, here.

We usually rely on the “legitimate interests” basis for processing your data. This is where it’s necessary for us to use your data in order to achieve certain aims that we and other organisations are pursuing, provided that those aims aren’t outweighed by the impact on your rights. In these cases, if you want us to erase your data you’ll normally need to object to us using it (see below) and give us information about how our use of your data is affecting you. Then we’ll weigh up the importance of the aims we are pursuing against the effect that we’re having on you. If your rights outweigh the need for us to use the data then we will erase it; otherwise, we’ll be entitled to keep it.

If you’re asking us to erase your credit file, you need to bear in mind that accurate credit reporting is extremely important to the UK financial services industry and the wider economy. That means that it’s relatively rare that we will find that a person’s rights and interests override those aims.

You should also bear in mind that if you are successful in having your credit history erased, this could well make it harder for you to obtain credit in the future.

Please note that we are entitled to keep a copy of data for certain specified purposes, such as enforcing or defending legal claims.

Restriction

In some circumstances you can ask us to put restrictions on the ways in which we use and share your personal data.

This only applies in limited circumstances, such as where you’re disputing the accuracy of the data. And it normally only lasts for a limited amount of time, such as however long it takes for us to verify the accuracy of the data.

When data is restricted we can only use it in ways that you agree we can, or for the purposes of legal claims, in order to protect the rights of another person or for reasons of important public interest.

If you dispute the accuracy of something on your credit file, we’ll mark it as under dispute but will normally still share it with other organisations (with the dispute marker attached). It’s important that we do this because otherwise individuals could (for example) hide adverse information such as loan defaults, CCJs and bankruptcies from their credit files. Continuing to share disputed data is our way of protecting the rights of:

• lenders (who need to be able to make appropriate lending decisions), and
• other consumers (who would have to bear the increased borrowing costs that would otherwise result).

Portability

This is a right to have personal data supplied to you in a machine-readable format so that you can more easily re-use it in other services. This right only applies to TransUnion in very limited circumstances. Please ask us if you need your data supplied in this way.

Withdrawal of consent / objection

Where we’re relying on your consent in order to use your personal data you have an absolute right to withdraw that consent at any time. This will mean that we’ll need to stop using your data unless we have some other legitimate basis for continuing to use it.

In most other situations, you can object to us using your personal data; this will mean that we need to assess whether we have compelling reasons to continue using it despite your objection.

You also have a right to object to us using your data for direct marketing purposes. If you do this we’ll stop using your data for those purposes as soon as possible.

ARE THERE ANY EXCEPTIONS FROM THESE RIGHTS?

Yes.

Some of the rights are inherently limited in scope. For example, the erasure and restriction rights only apply in specific circumstances and are subject to some exceptions – please see what we say above about these.

There are also some more general exemptions. For example, if you make a subject access request we’re generally not required to provide you with information about other people. This means that you’ll often see other people’s names and job titles redacted from the material we send you. We’re also allowed to withhold information that is protected by legal privilege (such as our internal legal advice), which may happen if we are in a dispute with you.

We are also not required to provide you with information which would reveal our trade secrets, such as details of how our algorithms work. For example, we will not provide specific details about how we calculate credit scores, although we can provide you with general information about factors that will often affect your credit score.

HOW DO I EXERCISE THESE RIGHTS?

If you just want to see your credit report, you can do this online.

Some of our online products provide allow you to exercise your rights through a preference centre. For example, for Immobilise you can view and change the details we hold about you by logging in to your account. You can also make contact with us through those websites if you wish.

For any other requests about your personal data, please contact our Consumer Services Team.

HOW LONG WILL IT TAKE?

Normally we should be able to get back to you with the outcome of your request within one month. If we aren’t able to do that then we’ll explain why.

Requests to correct information on your credit file have a shorter timescale of 28 days.

Credit Reference Agency Information Notice (CRAIN)

Version: 1.1 Adopted: 26 March 2020

---

IN BRIEF

We are credit reference agencies and we play a key role in the UK’s financial ecosystem. This document explains how we obtain, process and share personal data about consumers and businesses.

This section briefly summarises the key processing activities common to the credit reference agencies. For more detail, please refer to the rest of this document. In addition, we recommend reviewing each credit reference agency’s own information notices, which explain the specific processing activities of that credit reference agency. Links to these documents can be found in section 14.

• Credit reference agencies collect information about consumers and businesses from various sources and build databases that hold all of this data.
• The sources of that information include public records, such as court judgments (CCJs) and electoral register information, and financial information from lenders, utilities suppliers and telecoms businesses.
• Lenders and other organisations carry out searches against that information with one or more credit reference agencies.
• Organisations can carry out searches for several reasons. These include assessing creditworthiness and ability to afford financial products, checking the accuracy of other information, preventing and detecting crime (such as fraud or money laundering), checking identity, tracing individuals (for example to recover debts that they owe), calculating how much their insurance premiums should be, and assessing their suitability for a job or a tenancy.
• When an organisation carries out a search of someone’s information, we will record details of that search. This is known as a search footprint.
• Credit reference agencies also use consumer data for marketing-related purposes, such as helping organisations to better direct their marketing, including by screening individuals out of advertising for credit products so that those products are not offered to people who would not be eligible for them. They may also use the data to build insight to predict information or characteristics about the population, to help organisations identify who they want to market their products and services to.
• Credit reference agencies also use the data in their databases for other activities. These include analytics and profiling, such as helping lenders build scorecards to use in assessing credit applications.
• Because not every lender supplies data to every credit reference agency, your credit reference information held at each credit reference agency might be different.
• Credit reference agencies carry out several types of data processing to help achieve the aims described above. These include loading data, matching and linking data together as well as testing, developing and building our products and services.
• Consumers have certain rights that they can seek to exercise in relation to the personal data held by credit reference agencies. For example, they have rights to obtain a copy of the data, to ask the credit reference agency to correct it if it is inaccurate, and to object to the processing of the data.

Please note:

• This document describes how the credit reference agencies use and distribute the personal data described in section 4. This data is referred to as “credit reference data”.
• The credit reference agencies are independent businesses. Not all of the products and services described in this document are provided by all three of the credit reference agencies, or in the same way, and not all of the data is used by each of them.
• This document does not cover all personal data that the credit reference agencies use and distribute; for example, this document does not cover processing of personal data in relation to credit reference agency services you sign up to directly, such as services which allow you to view your own credit report and score. Section 2 and section 14 below provide links to where information can be found about each credit reference agency’s other products and services (including marketing services) and how they use and share other kinds of personal data.
• Consumers can obtain a copy of the information that each credit reference agency holds about them. Section 9 explains how this can be done.

CONTENTS

This document answers these questions:

1. 1. Who are the credit reference agencies and how can they be contacted?
2. 2. What do credit reference agencies use credit reference data for?
3. 3. What are the credit reference agencies’ legal grounds for handling credit reference data?
4. 4. What kinds of personal data do credit reference agencies use, and where do they get it from?
5. 5. Who do credit reference agencies share credit reference data with?
6. 6. Where is credit reference data stored and sent?
7. 7. For how long is credit reference data retained?
8. 8. Do the credit reference agencies make decisions about consumers or profile them?
9. 9. How can a consumer see what data the credit reference agencies hold about them? Do consumers have a ‘data portability’ right in connection with their credit reference data?
10. 10. What can a consumer do if their credit reference data is wrong?
11. 11. Can a consumer object to the use of their credit reference data and have it deleted?
12. 12. Can a consumer restrict what the credit reference agencies do with their credit reference data?
13. 13. Who can a consumer complain to if they are unhappy about the use of their credit reference data?
14. 14. Where can consumers find out more?

---

1. WHO ARE THE CREDIT REFERENCE AGENCIES AND HOW CAN THEY BE CONTACTED?

There are three main credit reference agencies in the UK.

Each is regulated by the Financial Conduct Authority (“FCA”) and authorised to conduct business as a credit reference agency. The full names and contact details for each are set out below.

In this information notice, these three companies are referred to as Equifax, Experian and TransUnion respectively. Together they are referred to as credit reference agencies.

Controllers

Each credit reference agency is a controller of the credit reference data that it holds. This means that it has certain responsibilities under data protection law to make sure that the data is used fairly and lawfully.

Where a credit reference agency operates as part of a group of companies, it may share joint responsibility with the other members of that group when sharing data with them. You can contact the relevant credit reference agency using the details above if you want to enquire about any of those group companies or exercise any of your rights in respect of your personal data.

2. WHAT DO CREDIT REFERENCE AGENCIES USE CREDIT REFERENCE DATA FOR?

Credit reference agencies use credit reference data in products and services that they offer to their clients. The purposes for which those products and services are used are described below, but please note that different clients may use the products and services in different ways. Consumers should check the privacy policies of the organisations that they deal with for details about how they use any products and services provided by the credit reference agencies.

(a) Credit reporting and affordability checks

Each credit reference agency uses credit reference data to provide credit reporting services and affordability checks to its clients.

Credit reporting

Organisations use credit reporting services to see how people and businesses are managing payments in respect of their credit arrangements and how they have done so in the past. For example, if a person applies for a bank loan to buy a car, the bank may use credit reporting services to check whether that person has defaulted on any previous credit agreements. It will then use this information, together with information from other sources, to assess the risk of offering the loan.

Affordability checks

Organisations use affordability checks to help understand whether people or businesses applying for credit are likely to be able to afford the repayments. The information provided as part of the affordability checks may affect a person’s or business’s ability to obtain credit.

These activities help promote responsible lending, prevent people and businesses from getting into more debt than they can afford, and reduce the amount of unrecoverable debt and insolvencies.

(b) Checks to validate and verify data, and help prevent and detect fraud, money laundering and other criminal activity

The credit reference agencies use credit reference data to provide validation and verification services and other services to help prevent fraud, money laundering and other criminal activity.

Some examples of how credit reference agency clients use these services are as follows:

• When a person applies to an organisation for a product or service, the organisation might ask that person to answer questions about themselves, and then check the answers against the data held by the credit reference agencies to see if they match. For example, they may ask “What is your current address?” If the address provided does not exist on the credit reference agencies’ records (for example, because it is a fictitious address) or does not match the data held by the credit reference agencies (for example, there is no record of the person at the address provided), then this may be an indicator of a mistake or fraud.
• Where some products and services are only available to people of a certain age, organisations may check whether the person they are dealing with is eligible by looking at data held by the credit reference agencies. For example, if a person is signing up to join a gambling website which is only for people who are at least 18 years old, the organisation may check to see if the age provided by the person matches that held by the credit reference agencies.
• Government and quasi-government bodies may use credit reference agency services to check whether people are entitled to certain benefits and to help recover unpaid taxes, overpaid benefits and similar debts. For example, if a person is claiming single person discount for council tax, a local authority may check with the credit reference agencies to see if any other adults are living at the same address.
• The police may use data held by credit reference agencies to help in their investigations into criminal activity.

An indication of invalid or unverified information, fraud, money laundering or other criminal activity may affect the outcome of an application for (amongst other things) a product or service, a tenancy agreement or employment. If clients using the services identify potentially fraudulent activity they may also pass the applicant’s details to a fraud prevention agency such as Cifas and/or to the police.

(c) Customer management

Credit reference agencies use credit reference data to provide products and services for organisations to use for customer management purposes. Customer management is the ongoing maintenance of an organisation’s relationship with its customers. This could include activities designed to support:

• data accuracy: for example, to correct or update data held on the organisation’s records, such as correcting spelling mistakes or adding missing fields;
• ongoing relationship and account management activities: for example, to help organisations make decisions relating to credit limit adjustments, transaction authorisations, card reissue, inbound lending requests, and to identify and manage the accounts of customers including those at risk, in early stress, in arrears, or going through a debt collection process.

(d) Tracing and debt recovery

Credit reference agencies use credit reference data to provide products and services that allow organisations to trace people. This is typically needed where a person has moved address or changed their telephone number and has not provided their new contact details. The credit reference agencies help organisations locate customers they have lost contact with by providing them with updated addresses and other contact details.

The products and services are used to support organisations’ debt recovery and debtor tracing activity. For example, if a person owes money to an organisation and moves to a new house without telling the organisation where they have moved to, the organisation may use these services to help find that person to recover the money that is owed to them.

These products and services are also used to find people in order to let them know about assets that they may have forgotten about or not be aware of, such as old dormant savings accounts or pension funds, or to find people to let them know about assets of a deceased person which they have an interest in, such as administrators or beneficiaries of a deceased person’s estate.

Please also see section 2(h) below which describes how some of the credit reference agencies provide tracing services for marketing purposes.

(e) Tenant vetting

Credit reference agencies use credit reference data to provide products and services that allow landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. Landlords can use this information to help decide whether to agree to the tenancy, or how much of a deposit they should ask for.

(f) Staff and job candidate vetting

Credit reference agencies use credit reference data to provide products and services that allow organisations to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can be used to help them decide whether the person would be or will continue to be a suitable member of staff.

(g) Insurance risk assessments and pricing

Credit reference agencies use credit reference data to provide products and services for organisations to use to assess insurance risk. For example, an insurer may find that a person’s financial standing and history can be used to help predict how likely that person is to make a claim on an insurance policy, or how large that claim might be. This can help the insurer to decide (i) whether to provide insurance to a person, and (ii) how much the insurance premium should be, and (iii) whether to allow payment for insurance on a credit instalment basis.

(h) Marketing and marketing-related services

Overview

Each credit reference agency offers its clients marketing services. Some of these marketing services use credit reference data and some do not. For details about the marketing services offered and the personal data used by the credit reference agencies, please see the following links:

Experian: https://www.experian.co.uk/privacy/consumer-information-portal

Equifax: https://www.equifax.co.uk/ein.html

TransUnion: https://www.transunion.co.uk/legal/privacy-centre?#pc-marketing-services

As well as other rights, consumers have the right to object to the processing of their credit reference data for direct marketing purposes, including any profiling that is related to direct marketing. Section 11 sets out more details on how this right can be exercised.

If a credit reference agency provides marketing services, then they may use an individual’s title, name (including aliases), address, date of birth, gender and address links information (see section 4 for more detail), as well as limited information relating to their financial standing.

Screening out

Credit reference agencies use credit reference data to provide screening services to their clients. This means that they identify people who clients may wish to screen out of marketing lists. Screening is used to help ensure that individuals do not receive irrelevant or inappropriate marketing information.

For example, a client may want to screen out from its marketing list someone who is deceased, or who is under 18, or does not reside at the address they hold, or who may not be interested in a product or service or is unlikely to be accepted for it.

Other marketing-related activities

In addition, credit reference agencies may use credit reference data to offer some or all of the following marketing services:

• They may supply the open version of the electoral register (where people have not opted out from their electoral register data being used for marketing and other purposes) to organisations for marketing purposes. This can include identifying new potential customers, verifying that names, addresses and dates of birth collected from other sources are accurate and complete, and informing customers of any errors.
• They may identify when someone has moved away from an address so that marketing is not sent to them at that old address.
• They may help build insight using profiling techniques which will be used by organisations to help them identify people that they want to communicate with about particular products and services. This insight might predict, for example, age, marital status, household composition, length of residency at an address and gender. It can help give organisations insight into the likely characteristics of the UK population at an individual, household and postcode level. Credit reference data also helps credit reference agencies to validate the insight being created.
• In certain circumstances, insight might also be used to help clients predict the financial profile of a person so that they can personalise their interactions with them and make communications more relevant and suitable. For example, they could use the insight to select products or offers that they believe would be relevant to that person.
• Models and insight created by the credit reference agencies can be matched to clients’ own contact lists so that they can make better informed decisions about how they interact with individuals.
• They may confirm whether individuals are resident at the address that the credit reference agencies or their clients hold for them. This can be done by checking the credit reference data to see if there are any open credit accounts at an address and whether the accounts have recent activity, such as where a recent payment has been made. If they do, then it is likely that they have the correct address details. This will help ensure that an individual does not receive marketing for someone else and the credit reference agencies’ clients do not send marketing to the wrong address.
• They may trace individuals to a new address so that their marketing preferences (both opt-ins and opt-outs) collected at a previous address can continue to apply at their new address and so that marketing is not sent to them at their old address.
• The credit reference agencies may also use credit reference data to help keep their own marketing suppression lists (or those of their group companies) accurate and up to date. For example, if you have previously asked to be excluded from marketing activity and your credit reference data indicates that you have since moved or changed your name, that information can be used to make sure that you continue to be excluded from marketing activity at your new address or under your new name.

(i) Profiling, statistical analysis and anonymisation

Credit reference agencies use, and allow their clients to use, credit reference data to carry out profiling of consumers through statistical analysis. This includes the creation, validation and use of scorecards, models, and attributes in connection with the assessment of risks relating to credit, fraud, affordability and debt collection. It is also used in verifying identities, to monitor and predict market trends and to enable clients to refine lending and fraud strategies, and loss forecasting.

These practices profile consumers to help determine the likelihood that a consumer with certain characteristics will act in a way that will produce certain outcomes; for example, to repay credit, to be able to afford credit, to claim on an insurance policy, to commit fraud, to respond to certain collection strategies or to become insolvent.

The credit reference agencies may also convert personal data into statistical or aggregated form so that individuals are not identified or identifiable (thereby creating anonymized data). Anonymized data is not personal data and the credit reference agencies may use such data to conduct research and analysis, including to produce statistical research and reports or for any other purposes.

(j) Data management activities

Credit reference agencies use credit reference data to carry out certain processing activities to support their own business operations. This includes supporting the effectiveness, efficiency and security of their databases, products and services, both in the context of their credit reference activities and more widely. For example:

• Data loading: credit reference data is checked for integrity, validity, consistency, quality and age to help make sure it is accurate. These checks pick up issues such as irregular dates of birth, names, addresses, account start and default dates, and gaps in status history.
• Data matching: credit reference data is matched to the credit reference agencies’ existing databases to help make sure it is assigned to the right person, even when there are discrepancies like spelling mistakes or previous names or different versions of a person’s name. Credit reference agencies use credit reference data to create and confirm identities, which they use to underpin the services that they provide.
• Data linking: when credit reference agencies compile data into their databases, they create links between different pieces of data. For example, people who appear financially associated with each other may be linked together and a person can be linked with their previous and current addresses. Also, where someone has an alias, such as a maiden name and married name, these names will be linked.
• System maintenance and testing: credit reference data may be used when carrying out system maintenance, repair and testing, and security activity.

Each credit reference agency has its own processes and standards for data management activity.

(k) New development and testing

The credit reference agencies use credit reference data to help develop new products, services and technologies and to test them. Typically, credit reference agencies will anonymise credit reference data before it is used for these purposes.

(l) Compliance with laws

The credit reference agencies use and disclose credit reference data where required by law. For example, this can happen in response to a court order or a request from a regulator, or in order to comply with a request from a person (or by a third party acting on their behalf), to exercise their legal rights in respect of the credit reference data, such as by requesting a copy of it.

3. WHAT ARE THE CREDIT REFERENCE AGENCIES’ LEGAL GROUNDS FOR HANDLING CREDIT REFERENCE DATA?

Data protection law requires the credit reference agencies to always have what is referred to as a “lawful basis” (i.e. a reason or justification) for processing personal data. There are a number of lawful bases available, but the majority of credit reference agencies’ activity is on the basis that:

• the processing is necessary to pursue the legitimate interests of the credit reference agencies and third parties (such as their clients), and those interests do not unduly prejudice the rights and freedoms of individuals; or
• the processing is necessary to comply with a legal obligation binding on the credit reference agencies.

For information about any other lawful basis relied on by each credit reference agency, please review their individual information notices (see section 14).

Legitimate interests

The credit reference agencies use credit reference data to pursue their legitimate interests, those of their clients and those of individuals. The following table explains these legitimate interests. The credit reference agencies have carried out assessments and have concluded that these interests are not overridden by the interests or fundamental rights and freedoms of individuals.

The credit reference agencies’ use of credit reference data is subject to an extensive framework of safeguards that balance the legitimate interests set out above with the fundamental rights and freedoms of the people whose data the credit reference agencies use and share. The framework includes information given to people about how their personal data will be used and how they can exercise their rights to obtain their personal data, have it corrected, erased or restricted, object to it being processed, and complain if they are dissatisfied. It also includes extensive due diligence checks on clients, robust contractual arrangements and internal data management processes that the credit reference agencies have in place. These safeguards help sustain a fair and appropriate balance and to protect the rights and freedoms of individuals.

Legal obligations

In some circumstances the credit reference agencies are required by law to use or share personal data in particular ways. This happens, for example, when a court, law enforcement agency or regulator makes a legally binding request or order for disclosure of personal data. It also happens when individual consumers exercise their rights, for example by requesting a copy of their own personal data from a credit reference agency.

4. WHAT KINDS OF PERSONAL DATA DO CREDIT REFERENCE AGENCIES USE, AND WHERE DO THEY GET IT FROM?

Each credit reference agency obtains and uses personal data from different sources, so they often hold information that is different to some degree from that held by the others. However, most of the personal data they hold falls into the categories outlined below from the sources described.

5. WHO DO CREDIT REFERENCE AGENCIES SHARE CREDIT REFERENCE DATA WITH?

This section describes the types of organisation credit reference agencies share data with. Before sharing data with any third party each credit reference agency will, where appropriate, complete its own due diligence checks to ensure that the organisation is a real business and has applicable regulatory authorisations in place.

Clients

Credit reference agencies supply their products and services to clients in various sectors, such as banks, building societies, other credit providers, utility companies, mobile phone companies, insurance companies, credit report providers, retailers, gaming organisations, tenant and employee vetting firms, professional services organisations (such as firms of solicitors and accountants), estate agents, landlords, marketing companies, charities and public bodies such as the police, central and local government and regulators.

Certain organisations that share financial data with the credit reference agencies are members of closed user groups which entitle them to receive similar kinds of financial data contributed by other organisations in the group. These organisations are typically banks, building societies, and other lenders, as well as other credit providers like utilities companies and mobile phone networks.

Resellers, distributors and agents

Credit reference agencies sometimes use other organisations to help provide their products and services to clients. To do this, they may provide credit reference data to them so that they can provide the services.

Service providers

The credit reference agencies may use other external organisations and other members of their own groups of companies to perform tasks on their behalf (for example, IT service providers, call centre providers and security service providers). To do this, they may provide or make available credit reference data to them so that they can perform the tasks.

Fraud prevention agencies

Each credit reference agency is a member of Cifas, a not-for-profit fraud prevention service. Where a credit reference agency believes that you may have been a victim of fraud, it may share that information with Cifas so that other Cifas members can access it. This enables them to perform additional checks when (for example) a credit application is made in your name. Please refer to the Cifas privacy notice at https://www.cifas.org.uk/fpn for more details.

Regulators

Regulators can sometimes require credit reference agencies to supply them with personal data. This can be for a range of purposes such investigating complaints or assessing how well a particular industry sector is working.

Individuals

People are entitled to obtain copies of the personal data the credit reference agencies hold about them. Details on how to do this are set out in section 9 below.

6. WHERE IS CREDIT REFERENCE DATA STORED AND SENT?

The three credit reference agencies are all based in the UK and keep their main databases there. They may also have operations and service providers elsewhere inside and outside the UK and the European Economic Area, and credit reference data may be accessed from those locations too. Regardless of where the credit reference data is processed, the credit reference agencies ensure that it is always, protected by applicable UK and European data protection standards.

While the UK and countries in the European Economic Area all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection when it comes to personal data. As a result, when a credit reference agency sends credit reference data overseas it makes sure suitable safeguards are in place in accordance with applicable UK and European data protection requirements, to protect the data. For example, these safeguards might include:

• Sending the data to a country that has been approved by the European authorities as having a suitably high standard of data protection law. Examples include the Isle of Man, Switzerland and Canada.
• Putting in place a contract with the receiving organisation containing terms approved by the European authorities as providing a suitable level of protection.
• Sending the data to an organisation which is a member of a scheme that has been approved by the European authorities as providing a suitable level of protection. One example is the Privacy Shield scheme agreed between the European and US authorities.

More information about the safeguards used by each credit reference agency can be obtained by contacting them at the contact details in Section 1 above.

7. FOR HOW LONG IS CREDIT REFERENCE DATA RETAINED?

Each credit reference agency may retain credit reference data for different periods of time. Information about each credit reference agency’s retention periods can be found at the following locations:

• https://www.equifax.co.uk/crain/retention
• https://www.experian.co.uk/legal/crain/data-retention
• https://www.transunion.co.uk/legal/crain-retention

These periods are subject to regular review and may change from time to time.

8. DO THE CREDIT REFERENCE AGENCIES MAKE DECISIONS ABOUT CONSUMERS OR PROFILE THEM?

Decisions about consumers

Credit reference agencies generally do not make decisions about consumers or tell organisations what decisions to make about consumers – this is for each organisation to decide. For example, credit reference agencies do not tell lenders whether to offer credit to consumers; they just provide services that help those lenders make decisions about consumers. An organisation’s own data, knowledge, processes and practices will also play a significant role in those decisions.

Credit reference agencies may provide similar services to their respective clients, but these services may lead to different decisions because (i) each credit reference agency may hold different information from the others, (ii) each client may place differing importance on some information compared to others, and (iii) each client may take into account information available to it from other sources. These are some of the reasons why a person may receive a “yes” from one lender but a “no” from another.

Scores and ratings

When requested, credit reference agencies use the data they obtain to produce credit, risk, fraud, identity, affordability, screening, collection and insolvency scores and ratings; these are explained in section 4 above.

9. HOW CAN A CONSUMER SEE WHAT DATA THE CREDIT REFERENCE AGENCIES HOLD ABOUT THEM? DO CONSUMERS HAVE A ‘DATA PORTABILITY’ RIGHT IN CONNECTION WITH THEIR CREDIT REFERENCE DATA?

Data access right

Consumers have the right to find out what personal data the credit reference agencies hold about them. Each credit reference agency provides more information about access rights on their websites.

Data portability right

Data protection legislation also contains a right to data portability. Where it applies, the right to data portability gives consumers a right to receive their personal data in a standard format. However, this right only applies when personal data is processed on certain grounds, such as consent. This right does not apply to credit reference data because it is processed on the grounds of “legitimate interests”. To find out more about legitimate interests please go to section 3 above.

10. WHAT CAN A CONSUMER DO IF THEIR CREDIT REFERENCE DATA IS WRONG?

When the credit reference agencies receive personal data, they perform lots of checks on it to try and detect any defects or mistakes. Ultimately, though, the credit reference agencies rely on the suppliers to provide accurate data.

If a consumer thinks that any personal data a credit reference agency holds about them is wrong or incomplete, the consumer has the right to challenge it. The credit reference agency will need to take reasonable steps to check the data, such as asking the organisation that supplied it to check and confirm its accuracy.

If the data turns out to be wrong, the credit reference agency will update its records accordingly. If the credit reference agency still believes that the data is correct after completing their checks, they will continue to hold and use it. Where the data is part of the consumer’s credit report, they can ask the credit reference agency to add a supplementary statement of up to 200 words explaining their views about the information. This statement will be supplied to organisations who subsequently access the information that the consumer has disputed.

To do this, consumers should contact the relevant credit reference agency using the contact details in section 1 above.

11. CAN A CONSUMER OBJECT TO THE USE OF THEIR CREDIT REFERENCE DATA AND HAVE IT DELETED?

This section helps consumers understand how to exercise their data protection rights to object to credit reference data being used by the credit reference agencies and how to ask for it to be deleted. To understand these rights and how they apply to the processing of credit reference data, it is important to know that the credit reference agencies hold and process personal information in credit reference data under the “legitimate interests” basis for processing (see section 3 above for more information about this), and do not rely on consent.

Consumers have the right to object to the processing of credit reference data by a credit reference agency. This can be done by contacting the relevant credit reference agency using the contact details in section 1 above.

Although consumers have complete freedom to contact a credit reference agency with objections at any time, under data protection law, a consumer’s right to object does not automatically lead to a requirement for processing to stop, or for personal data to be deleted.

Because of the importance of the credit referencing industry to the UK’s financial system, and the important purposes for which the credit reference data is needed (such as supporting responsible lending, and preventing over-indebtedness, fraud and money laundering) it will be rare that the credit reference agencies do not have compelling, overriding grounds to carry on using the personal data following an objection. In many cases, it will not be appropriate for the credit reference agencies to restrict or to stop processing or delete credit reference data, for example, where the result would be to hide a poor credit history that could enable a person or organisation to get credit they otherwise would not be eligible for.

However, as an exception from the general rule described above, all consumers have an absolute right to object to their personal data being used for direct marketing purposes. If you object to a credit reference agency using your personal data for those purposes, you can get them to stop by contacting them using the details in section 1.

12. CAN A CONSUMER RESTRICT WHAT THE CREDIT REFERENCE AGENCIES DO WITH THEIR CREDIT REFERENCE DATA?

In some circumstances, consumers can ask credit reference agencies to restrict how they use their credit reference data. Contact details for each credit reference agency are in section 1 above.

This is not an absolute right and processing will only be restricted if certain conditions are met (for example, if the processing is unlawful or the personal data is no longer required by the credit reference agencies for the purposes for which it was obtained).

Even where a restriction condition is met, a consumer’s personal data may still be processed (and shared) by the credit reference agencies where certain grounds exist. These are:

• with the consumer’s consent
• for the establishment, exercise, or defence of legal claims
• for the protection of the rights of another natural or legal person
• for reasons of important public interest

The credit reference agencies will consider and respond to requests they receive, and will assess whether any of the restriction conditions apply and, if they do, whether there are any grounds that permit the continued processing of the personal data.

Given the importance of complete and accurate credit reference data, for purposes including for example for responsible lending and preventing over-indebtedness, fraud and money laundering, it will usually be appropriate for the credit reference agencies to continue processing credit reference data on the basis of protecting the rights of another natural or legal person or for reasons of important public interest.

13. WHO CAN A CONSUMER COMPLAIN TO IF THEY ARE UNHAPPY ABOUT THE USE OF THEIR CREDIT REFERENCE DATA?

The credit reference agency

Each credit reference agency tries to ensure that it delivers the best outcomes for its clients and for consumers. If a consumer wants to make a complaint to a credit reference agency they can do so by contacting it at the following addresses.

Each credit reference agency also has a data protection officer who can be contacted about matters relating to the protection of personal data at the relevant credit reference agency. The contact details for each credit reference agency’s data protection officer are:

• Equifax: UKDPO@equifax.com
• Experian: uk.dpo@experian.com
• TransUnion: dpo@transunion.co.uk

The Information Commissioner’s Office

If a consumer is not satisfied with how a credit reference agency has investigated a complaint, the consumer can refer their concerns to the Information Commissioner’s Office which is the body that regulates the handling of personal data in the UK. The contact details are:

• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF
• Website: www.ico.org.uk

The Financial Ombudsman Service

Where the complaint relates to an activity which is regulated by the Financial Conduct Authority (such as credit reporting and affordability checks), consumers also have the right to refer the matter to the Financial Ombudsman Service (Ombudsman) for free. The Ombudsman is an independent public body that aims to resolve disputes between consumers and businesses like credit reference agencies. The contact details are:

• Phone: 0300 123 9 123 (or, from outside the UK, +44 20 7964 1000)
• Email: complaint.info@financial-ombudsman.org.uk
• Post: Financial Ombudsman Service, Exchange Tower London E14 9SR
• Website: https://www.financial-ombudsman.org.uk

14. WHERE CAN CONSUMERS FIND OUT MORE?

• Equifax: https://www.equifax.co.uk/ein.html
• Experian: https://www.experian.co.uk
• TransUnion: https://www.transunion.co.uk/privacy

The Information Commissioner’s Office also publishes advice and information for consumers in its Credit Explained leaflet, available at https://ico.org.uk/media/for-thepublic/documents/1282/credit-explained-dp-guidance.pdf.