Privacy Policy

Introduction

The following Privacy Statement applies to all subsidiary companies within our group.

This Privacy Statement will help you understand what data we collect from you, why we collect it and what we do with it. This policy explains how we store and use your personal information when you use or interact with our website, or where we otherwise obtain or collect your personal information. This Privacy Statement applies to all services offered by us, except where otherwise noted.

This statement also explains how we protect any personal data we obtain directly or passively from you or which we obtain indirectly from other sources.
We have done our best to present the information in this policy in clear and plain language, and we have structured it in a way to allow you to quickly find the information that is most important to you.

We reserve the right to change our privacy statement from time to time. We will update the Privacy Statement page content and last modified data on our website. This privacy statement was last modified 8th June 2020.

Download: Privacy Statement

Privacy Statement

We are committed to keeping your personal data safe and to ensuring the integrity and security of any personal data we may process.
You should read this privacy notice very carefully as it contains important information on the way in which we will process your personal data, in particular:

The personal information we collect about you
Our legal bases for processing your personal information
What we do with your personal information
Who your personal information may be shared with
Your rights as a data subject under the Data Protection Regulation

If you have any questions about this Privacy Notice, please contact the Data Champion from the subsidiary company that you are dealing with for further information.

Who we are

1pm plc is a company incorporated and registered in England with company number 05845866. 1pm plc is the controller of personal data relating to individuals within its client firms and prospective client firms for the purposes of providing products and services, relationship management, marketing and business development.

What personal data do we collect about you?

We collect personal data about you when you apply to buy our goods and/or services. This data will relate to personal identifiable information (such as name, date of birth), contact information (such as telephone number, address, email), and financial information (salary, bank statements, financial accounts and credit referencing information). We may also process special categories of personal data (sensitive data) such as data about your health or medical conditions. Prior to processing special category data, we will gain your informed and explicit consent. For more information on consent click here.

Our legal basis for processing your personal data

We may rely on a number of legal basis for collecting and further processing your personal data, which are:

Contractual Necessity
Legal Obligation
Legitimate Interest
Consent

FOR MORE INFORMATION ON OUR LEGAL BASIS FOR PROCESSING CLICK HERE

Contractual Necessity

We collect personal information about you when you request our products or services. We will ask you to provide some information about yourself.

We will also collect personal data for the purposes of the performance of a contract with you, such as:

Providing you with our products
Providing you with access and use of our services
Administering your account with us
Communicating with you about our products and services
Communicating with you about your account with us (including call recording/monitoring)

Legal Obligation

We may also process your personal information to allow us to comply with certain legal obligations to which we are subject. We will also work co-operatively with the national data protection authority, the ICO, in relation to any data protection matters. Where we are subject to regulation or national law enforcement we may process your data to meet our legal and regulatory requirements.

Legitimate Interest

We may use your personal data for our legitimate business interests, whilst carefully considering and balancing any potential impact on you and your rights as a data subject under the relevant data protection regulation.

This may include processing your personal data to allow us to provide the best services and customer experience and to ensure our service remains relevant and tailored to your needs.

We will always ensure that our legitimate interests will never override your rights and freedoms under the data protection regulation.

As an example, we may rely on our legitimate interest to process your personal data for the following purposes:

Where your vehicle finance application is not successful through Academy Leasing Limited, we may share your application data (including credit reference data) with another firm in our group called Car Finance 2U Limited who may be able to seek finance through an alternative lender.
For Direct Marketing, relating to products and services that are compatible with the original purpose for which we originally gained the information
To communicate with you, including newsletters and marketing materials
To communicate important updates about our products or services, which we think may be of interest to you
For evidential purposes to effectively manage and maintain records of our relationships/communications with you
For business development related activity such as contacting you by telephone or email to arrange meetings with our experts in relation to work or knowledge sharing
To enhance, modify, personalise or otherwise improve our services and communications for the benefit of you
To determine the effectiveness of promotional campaigns to inform marketing strategy

In addition, we may use legitimate interests to perform statistical and other analysis on the personal data we collect, to help us understand and improve how people use our products or services.

Please note, you have the right to object to the processing for which we rely on legitimate interest as the legal basis. You can do so and update your marketing preferences by opting out of future marketing materials as they arrive or by contacting the Data Champion from the subsidiary company that you are dealing with.

Consent

We are required to gain your explicit consent prior to processing your data for any other purpose other than the original purpose for which it was gained.
Where we require such consent, we will provide you with sufficient information to allow you to make an informed decision. We will ensure that we only gain consent via a clear and affirmative act, freely given by you that indicates your consent to specific purposes.
You have the right to withdraw your consent at any time and can do so by opting out of future marketing materials as they arrive or by contacting the Data Champion from the subsidiary company that you are dealing with.

Your rights as a data subject

As a data subject you can exercise certain rights in relation to the processing of your personal data, under the relevant data protection regulation. These are:

The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to object
The right to data portability
The right to lodge a complaint with the ICO
The Right to Understand the Source of data gained indirectly
The Right to be advised of any Automated Decision-making

If you want more information about your rights, you can find it here

DATA SUBJECT RIGHTS - MORE INFORMATION

Your Rights	What this means	How you can exercise this right
The Right of Access	You have the right to confirmation on whether or not we are processing your personal data and, where that is the case, access to that data, including the following information: The purpose of the processing The recipients or categories of recipient to whom the personal data have been or will be disclosed. The envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period We shall provide a copy of the personal data being processed free of charge. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed.	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to Rectification	You shall have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed.	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to Erasure	In some circumstances you have the right to have your personal data erased and no longer processed where: The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; You withdraw consent on which the processing is based, and where there is no other legal ground for the processing; You object to the processing and there are no overriding legitimate grounds for the processing The personal data has been unlawfully processed The personal data must be erased for compliance with a legal obligation. We shall provide a copy of the personal data being processed free of charge. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed.	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to Restrict Processing	You have the right to obtain the restriction of processing where one of the following applies: The accuracy of the personal data is contested, for a period enabling the verification of the accuracy of the personal data; The processing is unlawful and you object to the erasure of the personal data and request the restriction of the use instead; We no longer need the personal data for the purposes of the processing, but are required by you for the establishment, exercise or defence of legal claims You have objected to processing pending verification of whether our legitimate grounds override yours Where you have obtained restriction of processing you have the right to be informed by us before the restriction of processing is lifted. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed.	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to Object	You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interest. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. You also have the right to object to processing for direct marketing purposes. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.	To object to us processing your personal data for all other legitimate interest purposes please contacting the Data Champion from the subsidiary company that you are dealing with. To object to us processing your personal data for direct marketing purposes please unsubscribe from direct future communications by selecting the opt out button. This may take a maximum of two business days.
The Right to Data Portability	You have the right to receive the personal data concerning you, which you have provided to us and have the right to transmit those data to another controller without hindrance from us to which the personal data have been provided, where: The processing is based on consent or on a contract and The processing is carried out by automated means. Where feasibly possible, you also have the right to have the personal data transmitted directly to another controller. We will respond to your request within one month of your request	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to Lodge a Complaint with the ICO	You have the right to lodge a complaint with the Information Commissioner’s Office (ICO)	The contact details of the ICO are: Website: ico.org.uk Helpline: 0303 123 1113
The Right to Understand the Source of Data Gained Indirectly	You have the right to be informed of the source of any personal data that are not collected directly from you	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with
The Right to be Advised of Appropriate Safeguards for the Transfer of Personal Data to a Third Country	Where personal data is transferred to a third country (outside of the EU) or to an international organisation, you shall have the right to be informed of the appropriate safeguards relating to the transfer.	We will advise you of this prior to any such processing taking place.
The Right to be advised of any Automated Decision-making	Unless the information is necessary for entering into a contract with us, or you have given your explicit consent, you shall have the right not to be subject to a decision based solely on automated processing, which produces legal effects that affect you.	You can request this information at no charge from us by contacting the Data Champion from the subsidiary company that you are dealing with

How will we use your personal data?

We will only process your data where we have a legal basis to do so. We use data collected to communicate with you and to offer you our products or services. We may use your data to improve or maintain the services we offer to you. We will never share your data with any other third party, other than those stated in this policy, nor use your data for any other purpose, unless we firstly gain your explicit consent to do so.
You have the right to restrict the processing of your personal data. For more information click here. You can choose which promotional communications you wish to receive and how you would like to receive them.

Who we share your data with

We share your data with approved third-party providers that have adequate data protection measures in place that align with the requirements of the data protection regulation, such as:

Third-party provider	Legal Basis
Systems/CRM providers	Performance of a Contract
Auditors	Performance of a Contract
Funders	Performance of a Contract
Insurance Firms	Performance of a Contract
Collections Agents	Performance of a Contract
Solicitors	Performance of a Contract
Credit Reference Agencies	Performance of a Contract
Insolvency Practitioners	Legal Obligation

We also share your personal data across the subsidiary companies within 1pm plc when you apply to buy any of their goods and/or services. We have a legal obligation for our regulated customers, under the Financial Conduct Authority regulation, to create a single view of your financial situation and to mitigate any potential risk of you becoming over indebted as a result of any additional lending. For all customers, including unregulated customers, sharing of your personal data in this way also allows 1pm plc to monitor and manage any concentration risk or credit risk exposure to its business. The firms we will share your data with are:

1pm (UK) Limited (t/a Onepm Finance)
Academy Leasing Limited
Bell Finance Limited
Bradgate Business Finance Limited
Car Finance 2U Limited
Gener8 Finance Limited
Intelligent Financing Limited
Positive Cashflow Finance Limited
Sterling Asset Finance (UK) Limited

We do not share information outside the EU.

Credit Reference Agencies (CRAs)

To process your application, we will perform credit referencing and identity checks on you using one or more CRAs. If you are accepted for one of our products, we will also make periodic searches to enable us to manage your account with us. To do this, we will share your personal information with CRAs, and they will give us information about you. This will include:

Identity and contact data
Information from your credit application
Information about your financial situation and financial history
Public information (including electoral register)
Shared credit details
Fraud prevention information

We will use this information to:

Assess your creditworthiness and whether you can afford to take the product we are offering
Verify the accuracy of the data you have provided to us
Prevent criminal activity, fraud and money laundering
Manage your account with us
Trace and recover debts
Ensure any offers provided to you are appropriate to your circumstances

We will continue to share information about you with CRAs while you hold a relationship with us. We will also inform the CRAs when you settle an account or if you fail to repay an account in full or on time. This information may also be supplied to other organisations by CRAs. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the CRA information notice (CRAIN) which is accessible via: https://www.experian.co.uk/legal/crain/.

Retention period

We will only keep personal data for as long as necessary for the purposes for which it was gained and only where we continue to have a legal basis for doing so. We will review the personal data we hold on you in line with our retention policy, to check for accuracy and relevancy and to ensure we continue to have a legal basis for processing. If the personal data is no longer necessary, or where we no longer have the legal basis for processing we will delete or fully anonymise the data we hold on you, in line with our Data Protection Policy. If your data becomes inaccurate, we will update it accordingly. Otherwise, we will retain your personal data for the following periods:

Firm Name	Retention Period
1pm plc 1pm (UK) Limited Academy Leasing Limited Bell Finance Limited Bradgate Business Finance Limited Gener8 Finance Limited Positive Cashflow Finance Limited	6 years from the termination of the contract to which you are party
Intelligent Financing Limited Car Finance 2U Limited Sterling Asset Finance (UK) Limited	6 years from the formation of the contract, to which you are party
1pm plc 1pm (UK) Limited Academy Leasing Limited Bell Finance Limited Bradgate Business Finance Limited Gener8 Finance Limited Positive Cashflow Finance Limited Intelligent Financing Limited Sterling Asset Finance (UK) Limited	All declined applications – Retention period of 1 year from date at which you are informed of our decision to decline the application
1pm plc 1pm (UK) Limited Academy Leasing Limited Bell Finance Limited Bradgate Business Finance Limited Gener8 Finance Limited Positive Cashflow Finance Limited Intelligent Financing Limited Sterling Asset Finance (UK) Limited	All approved applications that have not progressed to contract – Retention period of 1 year from date at which you are informed of our decision to approve the application

Security and Confidentiality

We are committed to transparency, ensuring that your privacy is protected and that your data is used and retained fairly, transparently and in compliance with the data protection regulation. We will make sure that we have appropriate technical and organisational measures in place to keep your personal data secure and to protect against accidental or unlawful destruction, loss, alteration, disclosure or access. We will provide a level of security appropriate to the risk presented by the nature of the processing we do.

Help keep your personal data accurate and up-to-date

This privacy statement details the standards that 1pm plc will apply when processing your personal information. In return, it is important that you help keep your information, accurate, reliable and up-to-date. Any changes to your personal data, such as a new address can be notified to the Data Champion as detailed in the section below.

Data Champion

Our Data Champion contact details are:

Firm Name	Data Champion Details
1pm (UK) Limited (t/a Onepm Finance)	Name: Charlotte Mathieson Email: datachampion@onepmfinance.co.uk Phone: 01225 474230
Academy Leasing Limited	Name: Kate Manning Email: datachampion@academy-leasing.co.uk Phone: 01942 408520
Bell Finance Limited	Name: Kate Manning Email: datachampion@bradgatefinance.co.uk Phone: 01942 408520
Bradgate Business Finance Limited	Name: Kate Manning Email: datachampion@bradgatefinance.co.uk Phone: 01942 408520
Car Finance 2U Limited	Name: Dan Marsh Email: datachampion@carfinance2u.co.uk Phone: 0151 625 4777
Gener8 Finance Limited	Name: Kirsty Ibbotson Email: datachampion@carfinance2u.co.uk Phone: 0333 121 8888
Intelligent Financing Limited Limited	Name: Nadia Hall Email: datachampion@intelligent-loans.co.uk Phone: 02920 433922
Positive Cashflow Finance Limited	Name: Tom Cook Email: datachampion@positivecash.co.uk Phone: 0161 828 8100
Sterling Asset Finance (UK) Limited	Name: Charlotte Mathieson Email: charlotte.mathieson@1pm.co.uk Phone: 01225 474230

If you have any queries or requests concerning this privacy notice or your personal information or how we process it, please contact us via the relevant Data Champion as detailed above, or at:

*Name: Head of Governance and Compliance
Address: 2nd Floor, The Square, Lower Bristol Road, Bath, BA2 3BH
Phone: 01225 474230
Email: compliance@1pm.co.uk

Complaints

We will be more than happy to help should you have any complaints about the processing of your personal data. You have the right to lodge a complaint with the Supervisory Authority, the Information Commissioner Officer (ICO), who are the national authority responsible for the protection of personal data.
A complaint can be made to the ICO via their website or through their helpline (0303 123 1113).

Intelligent Loans - Specialist Lending Packager