Version: 1.2 • Adopted: 2 December 2024 • Download PDF copy
We (Equifax, Experian and TransUnion, collectively referred to as “we” and “us” throughout this privacy notice) are credit reference agencies and we play an important role in the UK’s financial ecosystem. This Credit Reference Agency Information Notice (referred to as “this privacy notice”) explains how we collect, process and share personal data about consumers and businesses (referred to as “you”).
This section briefly summarises the key processing activities common to all of us. For more detail, please refer to the rest of this document. We recommend reviewing each credit reference agency’s own privacy notices, which explain the specific processing activities of that credit reference agency. Links to these documents can be found in Section 14.
Throughout this privacy notice, where we use “data” we mean the data types as described in Section 4.
This document answers these questions:
There are three main credit reference agencies in the UK.
Each is regulated by the Financial Conduct Authority (“FCA”) and authorised to conduct business as a credit reference agency. The full names and contact details for each are set out below.
Credit reference agency | Contact details |
---|---|
Equifax Limited | Post: Equifax Limited, Customer Service Centre PO Box 10036, Leicester, LE3 4FS Web address: https://www.equifax.co.uk/Contact-us/Contact_Us_Personal_Solutions.html Email: UKDPO@equifax.com Phone: 0333 321 4043 or 0800 014 2955 |
Experian Limited | Post: Experian, PO BOX 9000, Nottingham, NG80 7WP Web address: https://ins.experian.co.uk/contact |
TransUnion International UK Limited | Post: TransUnion, Consumer Services Team, PO Box 647, Unit 4, Hull HU9 9QZ Web address: https://www.transunion.co.uk/consumer/consumer-enquiries Phone: 0330 024 7574 |
In this privacy notice, these three companies are referred to as Equifax, Experian and TransUnion respectively, and collectively referred to as "we" and "us" throughout.
Each of us is a controller of the data that we hold. This means that we have certain responsibilities under data protection law to make sure that the data is used fairly and lawfully.
Where we operate as part of a group of companies, we may share joint responsibility with the other members of that group when sharing data with them. You can contact the relevant credit reference agency using the details above if you want to enquire about any of those group companies or exercise any of your rights in respect of your personal data.
We use data in products and services that we offer to our clients. The purposes for which those products and services are used are described below, but please note that different clients may use the products and services in different ways. Consumers should check the privacy policies of the organisations that they deal with for details about how they use any products and services provided by us.
Each of us use data to provide credit reporting services, financial vulnerability and affordability checks to our clients.
Organisations use credit reporting services to see how people and businesses are managing payments in respect of their credit commitments and how they have done so in the past. For example, if a person applies for a bank loan to buy a car, the bank may use credit reporting services to check whether that person has kept up with their repayments on any previous credit agreements. It will then use this information, together with information from other sources, to assess the risk of offering the loan, including identifying any financial vulnerabilities.
A financial account provider may also take into account the creditworthiness of a director or business owner as part of its assessment, when considering whether to agree to lend to a business associated with such individuals.
It is important to note that once a search has been undertaken with one of us, it is for the credit provider to decide whether or not to accept that person’s application for credit. While we may help clients to analyse the data or create application models, we are not the decision maker.
Organisations use affordability checks made available by us to help understand whether people or businesses are likely to be able to afford to make payments, and to highlight financial vulnerabilities. For example, when you apply for a loan, the lender will check whether you have previously suffered a CCJ or missed credit payments, which might impact your ability to afford the repayment instalments.
Organisations might also check your affordability by reviewing the transaction data or the level of income and expenditure in relation to your payment account. This could include the use of open banking or current account turnover data provided by Current Account providers (“Current Account” refers to bank accounts designed to manage your income and day-to-day spending).
The information provided as part of the affordability checks may affect a person’s or business’s ability to obtain credit or other services. For example, where an individual has their own business, a lender may take into consideration the personal credit commitments of that individual, as well as how the business is maintaining its financial commitments, prior to granting credit.
Affordability checks are also used by organisations in the gambling sector to help identify and protect potentially vulnerable people from the impacts of problem gambling by helping organisations set appropriate spending limits and implement appropriate engagement strategies. These checks are used to support gambling organisations comply with their regulatory obligations.
These activities help promote responsible lending, prevent people and businesses from getting into more debt than they can afford, and reduce the amount of unrecoverable debt and insolvencies.
We use data to provide validation and verification services to clients. For example:
Where some products and services are only available to people of a certain age, organisations may check whether the person they are dealing with is eligible by looking at data held by us. For example, if a person is signing up to join a gambling website for people who are at least 18 years old, the organisation may check to see if the age or date of birth provided by the person matches the data held by us.
We also use data to help prevent and detect fraud, money laundering and other criminal activity, and apprehend and prosecute offenders.
An indication of invalid or unverified information, fraud, money laundering or other criminal activity may affect (amongst other things) the outcome of an application for a product or service, a tenancy agreement or employment. If clients using the services identify potentially fraudulent activity, they may also pass the applicant’s details to a fraud prevention agency such as Cifas and/or to the police.
For more details about the fraud prevention services offered and the personal data used by each of us please refer to Section 14.
We use data to provide products and services for organisations to use for customer management purposes. Customer management is the ongoing maintenance of an organisation’s relationship with its customers. This could include activities designed to support:
We use data to provide products and services that allow organisations to trace people. This is typically needed where a person has moved address or changed their telephone number and has not provided their new contact details. We help organisations locate customers they have lost contact with by providing them with updated addresses and other contact details.
The products and services are used to support organisations’ debt recovery and debtor tracing activity. For example, if a person owes money to an organisation and moves to a new house without telling the organisation where they have moved to, the organisation may use these services to help find that person to recover the money that is owed to them.
We also assist debt collectors in predicting, analysing and evaluating the costs of debt recovery to enable them to determine appropriate collections strategies.
These products and services are also used to find people to let them know about assets that they may have forgotten about or not be aware of, such as old dormant savings accounts or pension funds, or to find people to let them know about assets of a deceased person which they have an interest in, such as administrators or beneficiaries of a deceased person’s estate.
Please also see Section 2(h) below which describes how we may provide tracing services for marketing purposes.
We use data to provide products and services that allow landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. Landlords can use this information to help decide whether to agree to the tenancy, or how much of a deposit they should ask for.
We use data to provide products and services that allow organisations to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can be used to help them decide whether the person would be or will continue to be a suitable member of staff.
We use data to provide products and services for organisations to use to assess insurance risk. For example, an insurer may find that a person’s financial standing and history can be used to help predict how likely that person is to make a claim on an insurance policy, or how large that claim might be. This can help the insurer to decide (i) whether to provide insurance to a person, (ii) how much the insurance premium should be, and (iii) whether to allow payment for insurance on a credit instalment basis.
We offer our clients marketing services. Some of these marketing services use data and some do not, and some impact consumers while others affect directors and/or business owners. For details about the marketing services offered and the personal data used by us for these services, please see the following links:
As well as other rights, consumers have the right to object to the processing of their personal data for direct marketing purposes, including any profiling that is related to direct marketing. Section 11 sets out more details on how this right can be exercised.
If we provide marketing services, we may use an individual’s title, name (including aliases), address, date of birth, gender and address links information (see Section 4 for more detail), as well as limited information relating to their financial standing.
We use data to provide screening services to our clients. This means that we identify people who clients may wish to screen out of marketing lists. Screening is used to help ensure that individuals do not receive irrelevant or inappropriate marketing information. These individuals will most often be consumers, but we also provide screening services which impact on company directors and/or business owners for our clients who carry out business-to-business marketing activities.
For example, a client may want to screen out from its marketing list someone who is deceased, or who is under 18, or does not reside at the address they hold, or who may not be interested in a product or service or is unlikely to be accepted for it.
In addition, we may use data to offer some or all of the following marketing services:
We use, and allow our clients to use, data to carry out profiling of consumers through statistical analysis. This includes the creation, validation and use of scorecards, models, and attributes in connection with the assessment of risks relating to credit, fraud, affordability, financial vulnerability and debt collection. It is also used in verifying identities, to monitor and predict market trends and to enable clients to refine lending and fraud strategies, and loss forecasting. This can include drawing inferences about individuals on the basis of the data available, such as inferences about whether a credit application they have made has been accepted or declined.
These practices profile consumers (typically a client’s own customers or previous applicants) to help determine the likelihood that a consumer with certain characteristics will act in a way that will produce certain outcomes; for example, to repay credit, to be able to afford credit, to claim on an insurance policy, to commit fraud, to respond to certain collection strategies or to become insolvent.
We may also convert personal data into statistical or aggregated form so that individuals are not identified or identifiable (thereby creating anonymised data). Anonymised data is not personal data, and we may use such data to conduct research and analysis, including to produce statistical research and reports or for any other purposes.
We may share this anonymised data with organisations, such as those identified in Section 5. For example, this non personal data may be shared with government and public sector organisations to help them: assess the impact of changes to the financial economy on consumers and businesses; to inform policy setting and monitor the effectiveness of policy implementation; or to enable tailored economic support and other key resources to be directed to the groups that need it the most.
We use data to carry out certain processing activities to support our own business operations. This includes supporting the effectiveness, efficiency and security of our databases, products and services, both in the context of our credit reference activities and more widely. For example:
Each of us have our own processes and standards for data management activity.
We use data to help develop new products, services and technologies and to test them. This may include the controlled use of artificial intelligence or machine learning techniques. We may combine data with information from other parts of our businesses and use data to develop products, services and technologies in other parts of our businesses. Where appropriate, we will anonymise data before it is used for these purposes.
We use and disclose data where required by law. For example, this can happen in response to a court order or a request from a regulator, or in order to comply with a request from a person (or by a third party acting on their behalf), to exercise their legal rights in respect of any personal data, such as by requesting a copy of it.
We may provide data to government and public sector organisations. For example, their uses of this data could include:
Data protection law requires us to always have what is referred to as a “lawful basis” (i.e. a reason or justification) for processing personal data. There are a number of lawful bases available, but the majority of our data processing activity is on the basis that:
For information about any other lawful basis relied on by each of us, please review our individual privacy notices (see Section 14).
We use data to pursue our legitimate interests, those of our clients and those of individuals. The following table explains these legitimate interests. We have carried out assessments and concluded that these interests are not overridden by the interests or fundamental rights and freedoms of individuals.
Interest | Explanation |
---|---|
Promoting responsible lending and helping to prevent over-indebtedness | Responsible lending means that lenders only sell products that are affordable and suitable for the borrowers’ circumstances. This is in the interests of borrowers so that they do not become burdened with debt that they cannot afford to repay, and the stress associated with that. It is also in the interests of lenders in that it reduces bad debt and collections activity. We facilitate responsible lending by providing services that allow lenders to access information about a person (and anyone they have a financial association with, such as a joint account holder), including how they are managing current debt, have managed debt in the past and whether they have sufficient income to repay the debt. |
Helping prevent and detect fraud, money laundering and validate and verify identity | We provide identity, anti-fraud and anti-money laundering services to help clients meet legal and regulatory obligations. These services benefit individuals by facilitating prompt access to services through identity verification, and helping to protect them against fraud, and other criminal activity. Prevention and detection of fraud, money laundering and other criminal activity is in our legitimate interest and that of our clients. It is also to the benefit of wider society and therefore in the public interest. |
Customer and data management activities for the benefit of consumers and businesses | We provide services which help businesses maintain the quality of their own customer data they hold and to make informed decisions about how they engage with their customers. It is in our legitimate interests to offer these services to our clients, but it is also in the legitimate interests of both the consumer and businesses by helping ensure that the information held about them is accurate, comprehensive and up-to-date and that informed and responsible decisions can be made, particularly in the context of lending decisions. |
Supporting tracing and debt recovery | We provide services that support tracing and collections where the client has a legitimate interest in conducting activity to find its customers and to recover debt, or to reunite, or confirm that an asset relates to the right person. |
Enabling landlords to check the suitability of their prospective tenants | We enable landlords to verify some of the information provided by their prospective tenants, as well as confirming that they are who they say they are and that they are likely to be willing and able to pay their rent on time. This helps the landlord to decide whether to agree to the tenancy, or how much of a deposit they should ask for; and it reduces the risk that the tenancy relationship will subsequently break down. It also helps tenants to avoid getting into legal difficulties where they have agreed to pay rent that they cannot afford. |
Enabling employers to check the suitability of their current and prospective staff | We enable employers to verify some of the information provided by their staff and job candidates and confirm that they are who they say they are. They also enable employers to assess whether the staff member or candidate has a history of managing their own financial commitments well, or whether they are financially compromised. This can help reduce the risk of fraud and can help the employer to decide whether the person is or would be a suitable member of its staff. All of which is in the legitimate interest of those employers. |
Enabling insurers to calculate and price risk more accurately | We enable insurers to consider certain kinds of data when they are assessing risk. This data can help the insurer decide whether to provide cover to a person, and how much the insurance premium should be. This enables them to better forecast their future liability and to price their insurance products more accurately and competitively. For consumers, it means that insurance policies are priced more fairly, with the lowest-risk individuals paying less for their insurance. |
Supporting government and public sector organisations in the performance of their duties | We enable government and public sector organisations to consider certain kinds of data to help them in the performance of their duties. For example, this could include the assessment or collection of taxes; benefits eligibility assessment and monitoring; and the detection, prevention and recovery of improper payments or overpayments from public funds. This enables them to protect public money and ensure it is used effectively. This is in the public interest. For consumers, it means that their tax contributions are utilised efficiently and effectively and that the right benefits and entitlements are granted to them. |
Supporting compliance with legal and regulatory requirements | Our services may be used by our clients to help them comply with their own regulatory obligations, for example, complying with anti-money laundering obligations and regulations set by the Financial Conduct Authority (‘FCA’) which require lenders to assess the creditworthiness of individuals who apply for loans. This is in the legitimate interest of clients. Our services are also regulated and may use data to ensure our own legal and regulatory compliance. As part of this compliance, regulators may also ask us to provide information to assist them. For example, the FCA may ask for data to help inform them of areas of potential harm to allow them to identify areas where they should focus their resources. Further, these regulatory obligations are in place in the interests of wider society, so facilitating compliance with them indirectly benefits society as a whole, which is in the public interest. |
Promoting responsible, efficient and informed marketing activities for the benefit of consumers and businesses | Credit reference agencies provide services to support organisations in ensuring that their marketing strategies are responsible, informed and efficient. This helps them to reduce waste (driving costs down and increasing competition) and avoid sending communications to individuals who are less likely to be interested in receiving them or who should not receive them. |
Commercial interests | It is in each of our legitimate interests to provide the services described above to our clients to generate sales revenues. |
Enabling gambling organisations to meet their obligations to protect individuals from the impacts of problem gambling | Our services may be used by organisations to help protect individuals from the impacts associated with problem gambling and gambling related harms. Excessive spending on gambling at the expense of payment of priority household debts (such as mortgage or rent payments) could have a significant financial impact on the individual and family unit. This is in the legitimate interests of gambling organisations and supports them to comply with their regulatory obligations, whilst also being in the legitimate interests of individuals. There are wider societal benefits, including reducing the burden on public health services and impacts on the economy. |
Our use of data is subject to an extensive framework of safeguards that balance the legitimate interests set out above with the fundamental rights and freedoms of the people whose data we use and share. The framework includes information given to people about how their data will be used and how they can exercise their rights to obtain their personal data, have it corrected, erased, or restricted, object to it being processed, and complain if they are dissatisfied. It also includes extensive due diligence checks on clients, robust contractual arrangements, and internal data management processes that we have in place. These safeguards help sustain a fair and appropriate balance and to protect the rights and freedoms of individuals.
In some circumstances we are required by law to use or share data in particular ways. This happens, for example, when a court, law enforcement agency or regulator makes a legally binding request or order for disclosure of data. It also happens when individual consumers exercise their rights, for example by requesting a copy of their own personal data from us.
Each of us obtains and uses data (including your personal data) from different sources, so we often hold information that is different to some degree from that held by the others.
However, most of the personal data we each hold falls into the categories outlined below from the sources described (please note that some of this data may relate to individuals from the Crown Dependencies as well as from the UK). The Crown Dependencies are the Bailiwick of Jersey, the Bailiwick of Guernsey (which in cludes the jurisdictions of Guernsey, Alderney and Sark) and the Isle of Man.
Information type | Description | Source |
---|---|---|
Identifiers | We hold personal data that can be used to identify people, such as name, date of birth, and current and previous addresses. We may also hold business data including name, address and details of company shareholders and directors. | This data is part of some of the other data sources mentioned below in this table. Data about postal addresses is obtained from commercial sources such as Royal Mail. Data about businesses may also be sourced from public websites, including Companies House and companies’ own websites. |
Electoral register data | We hold information from the electoral register (also known as the ‘Electoral Roll’). There are two versions of this. One is known as the open register (also known as the ‘Edited Electoral Roll’ or ‘EER’) and can be used for a variety of purposes including marketing. The other is the full register which we can only use for limited purposes. | This data is supplied by local authorities. |
Credit account performance data | We receive personal data about how people are managing to repay their credit commitments. The data includes the name of the lending organisation, the date the account was opened, the account number, the amount of debt outstanding (if any), any credit available (including overdraft limits) and the repayment history on the account, including late and missing payments. This may also include transactions that have been made on a buy now pay later basis. | This data is provided from banks, building societies and other financial services providers such as credit card companies, credit suppliers, credit unions, hire purchase companies and buy now pay later organisations. It is also provided by utilities companies, mobile phone networks, retail and mail order companies and insurance companies. |
Rental related data | Some of us receive personal data about whether people are managing to pay their rent on time. The data includes tenancy reference, start date, end date, rental amount, arrangement amount and outstanding balance. | This data is provided by social housing providers and private landlords. You can also sign up to certain services which identify your rent payments from your bank account transactions and report them to us. |
Current account turnover data | This data includes the name of the organisation providing current accounts, current account numbers, sort codes, the number of account holders, the current balance, a figure for credits on each current account and sometimes a figure for debits. | This data is provided from organisations who offer people Current Accounts, such as banks and building societies and e-money institutions. |
Application salary data | This data consists of the salary declared by a person when they are applying for credit. It also includes whether that figure is net or gross, and whether the salary has been verified (e.g. with copies of salary slips). This data also includes the date that an application was made. | This data is provided to us by organisations who collect declared income from individuals when they apply for credit. This information is provided as a separate file of data, although declared income can sometimes be provided together with other data (see search footprints below). |
Open Banking data | This data includes details of the financial transactions within your account(s) accessed via Open Banking (including details of payment amounts, dates, payees and payers). | This data is made available by your account provider, where access to the account has been specifically authorised by you. For example, this may be to help support a credit application you are making to a lender or as proof of your income. We are only permitted to obtain this data through being FCA registered Account Information Service Providers or though working with firms that hold this FCA permission. For more details of how each credit reference agency provides open banking services, please see the privacy notices of each credit reference agency, a link to which is provided in Section 14. |
Judgment data | We obtain data about court judgments and decrees. This may include, for example, the name of the court, the nature of the judgment, how much money was owed, and whether the judgment has been satisfied. | The government makes court judgments and other decrees and administrative orders publicly available through statutory public registers. These are maintained by Registry Trust Limited, which supplies the data on the registers to us. |
Insolvency data | We obtain data about insolvency-related events. This includes data about bankruptcies, administration orders, individual voluntary arrangements, debt relief orders, sequestrations, trust deeds and debt arrangement schemes. This data includes the start and end dates of the relevant insolvency or arrangement. | This data is obtained from The Insolvency Service, the Accountant in Bankruptcy, The Stationary Office and Northern Ireland’s Department for the Economy – Insolvency Service, the London, Belfast and Edinburgh Gazettes and Registry Trust Limited. Business insolvency data is obtained from the London, Belfast and Edinburgh Gazettes. |
Fraud prevention indicators | This data consists of information which indicates that an individual has demonstrated behaviour that appears to be consistent with that of known fraudulent conduct. It also consists of information where an individual has been a victim of identity fraud or feels that his or her personal data is vulnerable due to a data breach. | This data is generated internally by us and also obtained from third parties such as Cifas, a not-for-profit fraud prevention membership organisation. |
Search footprints | When an organisation uses us to make enquiries about a person, we keep a record of that enquiry. This is known as a ‘search footprint’. This includes the name of the organisation, the date, and the purpose for which the enquiry was made. We may also receive additional data that was provided as part of the search, such as employment status, disclosed income (income sometimes provided separately as application salary data) and contact information. Some footprints are visible only to us and the individual about whom they are made. Other searches are also visible to other organisations, and in some cases can therefore affect credit decisions (e.g. where an organisation draws a negative inference from a debt collection search). | We generate search footprints automatically when enquiries are made about a person. Each credit reference agency only creates search footprints for searches against its own records. |
Scores | We and our clients use data to produce scores including in relation to credit, affordability, fraud, identity, collections and insolvency. | We use algorithms known as ‘scorecards’ to produce scores. Similarly, other organisations create their own scores from data obtained from us as well as other sources. |
Other third-party data | This data includes phone numbers and email addresses, data concerning politically exposed persons (PEPs) and people on sanctions lists as well as mortality data. | We receive this data from reputable commercial sources under contracts agreed from time to time. |
Other data we create (not already referred to in this table) | We derive certain additional information from the data. For example: Summarised and aggregated data: we can summarise data, for example by providing a count of the total number of accounts or judgments a person has, or the total amount of debt. We can also aggregate data about different consumers together, for example to provide an overview of the financial status of particular postcodes and other geographical areas. This may then be anonymised data. Address links: when we detect that a person has moved to a new house, we may create and store a link between the old and new address. Aliases: when we believe that a person has changed their name, we may record the old name alongside the new one. Financial associations and linked people: when we believe that two or more people are financially linked with each other (for example, because they have a joint account, apply for credit together, such as a mortgage or loan, or get a joint County Court Judgment), we may record that fact. Just sharing an address with someone or even being married to them (but not having any joint credit) does not make them a financial associate. Your financial associates can impact your ability to get credit. They appear on your credit report, and companies may check their credit history when deciding whether to approve you. This is because your financial associates may affect your ability to repay debt. For example, if your partner has been made bankrupt, companies may be concerned that you will need to help them repay their debts before you can repay your own. Credit scores you receive through services you sign-up for may reflect and explain the impact of a financial associate on your ability to get credit. Flags and triggers: we may create flags and triggers that we use in our systems to highlight that certain data exists or to summarise that data. For example, if we hold fraud data from the fraud organisation known as Cifas, we may create a flag indicating this fact. This flag would highlight to clients that the data is available and give them the opportunity to ask for more details. | We generate this additional information from the data sources already available to us. |
Data provided by individuals themselves | People sometimes provide data about themselves directly to us. For example, individuals have the right to ask us to add a short statement that will be displayed when an organisation sees data about them. This statement is known as a ‘notice of correction’ and can be used to allow the person to explain the reason for an entry. The right to do this is explained in Section 10 below). If a person exercises any of their other legal rights, we will retain data relating to these activities, for example, records will be kept of all actions and correspondence relating to managing complaints. | This data is provided directly by individuals themselves. |
This section describes the types of organisations we share data with. Before sharing data with any third party we will, where appropriate, complete our own due diligence checks to ensure that the organisation is a real business and has applicable regulatory authorisations in place.
We supply our products and services to clients in various sectors, such as banks, building societies, other credit providers, buy now-pay later providers, utility companies, mobile phone companies, insurance companies, employers, credit report providers, retailers, gambling organisations, tenant and employee vetting firms, professional services organisations (such as firms of solicitors and accountants), estate agents, landlords, marketing companies, charities and public bodies such as the police, central and local government and regulators.
Certain organisations that share financial data with us are members of closed user groups which entitle them to receive similar kinds of financial data contributed by other organisations in the group. These organisations are typically banks, building societies, and other lenders, as well as other credit providers like utilities companies, mobile phone networks and other organisations like gambling firms.
We sometimes use or partner up with other third party organisations to provide combined products or products which combine our data with other information to help provide our products and services to clients and to help us improve our own products and services. To do this, we may provide data to third parties so that they can provide the services.
We may use other external organisations and other members of our own groups of companies to perform tasks on their behalf (for example, IT service providers, call centre providers and security service providers). To do this, we may provide or make available data to them so that they can perform the tasks.
Each of us is a member of Cifas, a not-for-profit fraud prevention service. Where we believe that you may have been a victim of fraud, we may share that information with Cifas so that other Cifas members can access it. This enables other Cifas members to check when (for example) a credit application is made in your name. Please refer to the Cifas’ privacy notice for more details.
We may share information with government and other public sector organisations, including the following bodies: ministerial government departments, such as the Department of Work and Pensions, HM Revenue & Customs, HM Treasury, the Cabinet Office; publicly owned corporations and other arm’s length bodies such as the Public Sector Fraud Authority) and private sector organisations providing services on behalf of a public sector organisations, such as a housing association acting on behalf of a local authority.
Regulators, such as the Financial Conduct Authority, Competition & Markets Authority, Information Commissioner’s Office, Ofgem and Ofwat, can sometimes request or require us to supply them with personal data. This can be for a range of purposes such as investigating complaints or in response to legal obligations. The regulators may also need data insights from us when assessing how well a particular industry sector is working.
This includes police forces, security services and border control.
People are entitled to obtain copies of the personal data we hold about them. Details on how to do this are set out in Section 9 below.
All three of us are based in the UK and keep our main databases there. We may also have operations and service providers elsewhere inside and outside the UK and the European Economic Area, and data may be accessed from those locations too. Regardless of where the data is processed, we ensure that it is always protected by applicable UK and European data protection standards.
While the UK and countries in the European Economic Area all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection when it comes to personal data. As a result, when we send data overseas we make sure suitable safeguards are in place in accordance with applicable UK and European data protection requirements, to protect the data. For example, these safeguards might include:
Overseas recipients of data include our group companies, clients, resellers and service providers. Please see Section 5 for more information about recipients of data.
More information about the safeguards we each use can be obtained by contacting us at the contact details in Section 1 above.
Each of us may retain data for different periods of time. Information about our respective retention periods can be found at the following locations:
These periods are subject to regular review and may change from time to time.
We do not tell organisations what decisions to make about consumers. Our role is primarily to provide information to other organisations which supports them in making their own decisions as this is for each organisation to decide. For example, we do not tell lenders whether to offer credit to consumers; we just provide services that help those lenders make decisions about consumers. An organisation’s own data, knowledge, processes and practices will also play a significant role in those decisions.
We may provide similar services to our respective clients, but these services may lead to different decisions because (i) each credit reference agency may hold different information from the others, (ii) each client may place differing importance on some information compared to others, and (iii) each client may take into account information available to it from other sources. These are some of the reasons why a person may receive a “yes” from one lender but a “no” from another.
When requested, we use the data we obtain to produce credit, risk, fraud, identity, affordability, screening, collection and insolvency scores and ratings; these are explained in Section 4 above. In providing these scores and ratings to our clients, we are not making decisions about consumers or telling organisations what decisions to make about consumers – this is for each organisation to decide on the basis of their own criteria.
Consumers have the right to find out what personal data we hold about them. Each of us provides more information about access rights on our websites.
Credit reference agency | How to access your data |
---|---|
Equifax | To get your credit report: https://www.equifax.co.uk/Products/credit/statutory-report.html To get other information about how to access your personal data: https://www.equifax.co.uk/privacy-hub To make a request by post: Equifax Limited, Customer Service Centre, PO Box 10036, Leicester, LE3 4FS. |
Experian | To get your credit report: https://www.experian.co.uk/consumer/statutory-report.html To get other information about how to access your personal data: https://ins.experian.co.uk/contact To make a request by post: Customer Support Centre, Experian Ltd, PO BOX 8000, Nottingham, NG80 7WF |
TransUnion | To get your credit report: https://www.transunion.co.uk/consumer/get-your-credit-report To get other information about how to access your personal data: https://www.transunion.co.uk/legal/privacy-centre/your-data-rights To make a request by post: TransUnion Consumer Services Team, PO Box 647, Unit 4, Hull HU9 9QZ |
Data protection legislation also contains a right to data portability. Where it applies, the right to data portability gives consumers a right to receive their personal data in a standard format. However, this right only applies when personal data is processed on certain lawful grounds, such as consent. This right does not apply to our data because it is processed on the grounds of “legitimate interests”. To find out more about legitimate interests please go to Section 3 above.
When the credit reference agencies receive personal data, they perform lots of checks on it to try and detect any defects or mistakes. Ultimately, though, the credit reference agencies rely on their suppliers to provide accurate data.
If a consumer thinks that any personal data a credit reference agency holds about them is wrong or incomplete, the consumer has the right to challenge it. If challenged, the credit reference agency will need to take reasonable steps to check the data, such as asking the organisation that supplied it to check and confirm its accuracy.
If the data turns out to be wrong, the credit reference agency will update its records accordingly. If the credit reference agency still believes that the data is correct after completing their checks, they will continue to hold and use it. Where the data is part of the consumer’s credit report, they can ask the credit reference agency to add a supplementary statement of up to 200 words explaining their views about the information. This statement will be supplied to organisations who subsequently access the information that the consumer has disputed.
To do this, consumers should contact the relevant credit reference agency using the contact details in Section 1 above. Where more than one credit reference agency holds incorrect information, it may be necessary to contact them separately.
This section helps consumers understand how to exercise their data protection rights to object to data being used by us and how to ask for it to be deleted. To understand these rights and how they apply to the processing of data, it is important to know that we hold and process personal data under the “legitimate interests” basis for processing (see Section 3 above for more information about this), and do not rely on consent.
Consumers have the right to object to the processing of personal data by us. This can be done by contacting the relevant credit reference agency using the contact details in Section 1 above.
Although consumers have complete freedom to contact us with objections at any time, under data protection law, a consumer’s right to object does not automatically lead to a requirement for processing to stop, or for personal data to be deleted.
Because of the importance of the credit referencing industry to the UK’s financial system, and the important purposes for which the data is needed (such as supporting responsible lending, and preventing over-indebtedness, fraud and money laundering) we will normally have compelling, overriding grounds to carry on using the personal data following an objection. In many cases, it will not be appropriate for us to restrict or to stop processing or delete data, for example, where the result would be to hide a poor credit history that could enable a person or organisation to get credit they otherwise would not be eligible for.
However, as an exception from the general rule described above, all consumers have an absolute right to object to their personal data being used for direct marketing purposes. If you object to us using your personal data for those purposes, you can get us to stop by contacting us using the details in Section 1 or specifically, in the case of Experian, through the online service at https://www.experianmarketingservices.digital/OptOut.
In some circumstances, consumers can ask us to restrict how we use their data. Contact details for each credit reference agency are in Section 1 above.
This is not an absolute right and processing will only be restricted if certain conditions are met (for example, if the processing is unlawful or the personal data is no longer required by us for the purposes for which it was obtained).
Even where a restriction condition is met, a consumer’s personal data may still be processed (and shared) by us where certain grounds exist. These are:
We will consider and respond to requests we receive and will assess whether any of the restriction conditions apply and, if they do, whether there are any grounds that permit the continued processing of the personal data.
Given the importance of complete and accurate data, for purposes including, for example, for responsible lending and preventing over-indebtedness, fraud and money laundering, it will usually be appropriate for us to continue processing data on the basis of protecting the rights of another natural or legal person or for reasons of important public interest. Consumers can contact us to ask about this processing of their personal data so that they can understand how their data will be used.
Each credit reference agency tries to ensure that it delivers the best outcomes for its clients and for consumers. If a consumer wants to make a complaint to us, they can do so by contacting us at the following addresses.
Credit reference agency | Contact details |
---|---|
Equifax | Post: Equifax Limited, PO Box 10036, Leicester LE3 4FS Email: complaints@equifax.com Phone: 0333 321 4043 or 0800 014 2955 |
Experian | Post: Experian, PO BOX 8000, Nottingham NG80 7WF Email: complaints@uk.experian.com Experian Complaints Handling Procedure |
TransUnion | Post: TransUnion Customer Relations Team, PO Box 647, Unit 4, Hull HU9 9QZ Email: ukcustomerrelations@transunion.com Phone: 0330 024 7574 |
Each of us also has a data protection officer who can be contacted about matters relating to the protection of personal data at the relevant credit reference agency. The contact details for each of our data protection officers are:
If a consumer is not satisfied with how we have investigated a complaint, the consumer can refer their concerns to the Information Commissioner’s Office which is the body that regulates the handling of personal data in the UK. The contact details are:
You may also have the right to raise questions or complaints to the relevant supervisory authority or other data protection regulator in the jurisdiction where you are resident. If you are resident in the Isle of Man or the Channel Islands, the relevant data protection regulator’s details are:
Isle of Man | Jersey | Guernsey |
---|---|---|
Isle of Man Information Commissioner
| Jersey Office of the Information Commissioner
| The Office of the Data Protection Authority
|
Where the complaint relates to an activity which is regulated by the Financial Conduct Authority (such as credit reporting and affordability checks), consumers also have the right to refer the matter to the Financial Ombudsman Service (FOS) for free. The FOS is an independent public body that aims to resolve disputes between consumers and businesses like credit reference agencies.
If you live in the Isle of Man or the Channel Islands, this service is also available to you because we are UK based businesses.
The contact details are:
The work we do is very complex, and this document is intended to provide only a concise overview of the key points. More information about each credit reference agency and what it does with personal data is available at the following locations:
Credit reference agency | Further information |
---|---|
Equifax | Information about other products and services (including marketing services and the use of the legitimate interests relied on for their marketing services): |
Experian | Information about other products and services (including marketing services and the use of the legitimate interests relied on for their marketing services):
Information about fraud prevention services: |
TransUnion | Other TransUnion privacy notices, including those covering TransUnion’s marketing services and open banking services, are available at TransUnion | Privacy Centre | UK |
The Information Commissioner's Office also publishes advice and information for consumers in its Credit Explained leaflet.