Overview

As a member-owned co-operative we make every effort to treat our members fairly and
responsibly.

Any data is held solely in the legitimate interests of providing service to our members.
We respect your rights to privacy and do not share your data with any third parties, aside
from those who are directly involved in providing the savings and loan service to you – when
processing bank payments for example.  Your details will never be given or sold to third
parties for their own marketing purposes.

As owners of the business, members will be contacted with updates about our service and
progress throughout the year.

These updates should not become intrusive or excessive. If at any time you no longer wish
to be kept informed about the status of your account and the credit union service you can let
us know. We will make it as clear and easy as possible for members to do this.

Keep Credit Union (KCU) holds the following details about you:

• personal information, such as your name, address and date of birth, including
  personal information you provided to us when you applied to KCU for a product or
  service.
• details of the accounts and products you hold and previously held with KCU
• details of products with other providers that you have told us about
• details of when you contact us and when we contact you

When you provide us with your personal information, we will keep the information for as long
as is necessary to comply with any statutory or legal obligations or for audit purposes.

Sensitive personal data

Keep Credit Union does not collect and record data which the Data Protection Act defines as
“sensitive” (such as criminal convictions or health information).

In rare circumstances you may choose to provide us with sensitive personal data to enable
us to help you access and manage your accounts either permanently or temporarily. If you
write to us or send a secure message we will assume you are happy for us to record the
information unless you tell us not to. Such data will always be processed and stored
securely.

Central customer database

We hold customer information on a central customer database which is also the register of
our members. Individual account statements and communications will always be sent to the
address (postal and / or email) of the named account holder associated with the account in
question and to the most recently updated address.

Use of your personal information

Checking identity

We are required by law to check the identity of new customers and our existing customers
from time to time. This makes it more difficult for criminals to use financial systems, or to use
false names and addresses, or to steal the identities of innocent people. Checking identity is
an important way of fighting money laundering and other criminal activities.

To enable us to meet this obligation we may access databases including those held by credit
reference agencies and the electoral roll in order to validate your name and address. This
process involves checking the details you provide against those databases to confirm your
identity. We may ask you to provide certain documents to confirm your name and address.
In addition to this, as part of our ongoing requirement to verify the identity of existing
customers, you may be asked to provide certain documents to confirm your name and/or
address even though you may not be applying for new products or services.

Managing your accounts

Keep Credit Union uses your personal information to consider your application to open,
maintain and manage your accounts and policies and to deal with enquiries you may make
or authorise. We collect this information from you directly, from a third party authorised to act
on your behalf, or from other organisations such as credit reference agencies. When we ask
you for information, we will explain to you why we need it and how we plan to use it.

Marketing

Your details are used to help us to identify products and services that we believe may be of
interest to you, which may be based on products you hold with us or on transactions carried
out on your account(s).

If you provide us with information about accounts you hold with other financial providers, we
will record these details. Unless you object, this information will be used to help us improve
our products, services and marketing communications.

If you do not wish to receive information on products and services by letter, telephone or e-
mail, or any combination of these, you can write at any time. From time to time during your
membership we may invite you to review that decision.

Using your personal information to contact you about products and services

Personal contact is an important part of the service and member services may contact you
personally by mail, telephone, email or text message to inform you about products and
services offered by KCU that might be relevant to you, based on our understanding of your
financial needs.

We will only contact you if we think a product or service could be appropriate and relevant to
you. This contact may continue after your relationship with us ends. You may opt out of
receiving this information at any time by contacting the credit union or by unsubscribing from
e-mails using the relevant link.

We are under no obligation to inform or update you in relation to all or any of the products or
services which may be appropriate and relevant to you available from or through us.

Pre-filling forms

If you are an existing customer applying for a new KCU product, in order to improve our
service to you and speed up the account opening process, we may pre-fill the application
forms using the information we already hold about you.

Processing information outside of the UK

We (and our service providers) may process personal information outside of the UK for the
purposes described in this policy, and we will ensure that it is secure and protected from
unauthorised access. Where personal information is processed in countries that do not have
the same level of legislation protecting information as the UK, such as the USA or India, we
will endeavour to ensure your information is protected to the same level as the UK.

Sharing your details

Within KCU

Information about you and any products you hold with us may be used within KCU for all
purposes necessary for performing our contract with you and for:

• assisting in verifying your identity
• assessing risks
• understanding your requirements
• developing, testing, researching and improving products and services
• training and business analysis
• legal and regulatory compliance
• making lending decisions
• tracing debtors and collecting debts
• preventing or detecting financial crime
• sharing your details with other organisations relevant to providing our service

KCU does not share or give any information to external companies for their own marketing
purposes.

KCU may disclose your personal information to other people or organisations if any of the
following applies:

• we have your consent; or
• for the purposes of them providing products, services or research in association with
  or on behalf of KCU; or
• for the purpose of them providing administrative, processing, analytical or other
  similar services to KCU to assist KCU in the provision of products and services to
  our customers; or
• for the purpose of verifying information you have given us for example verifying your
  income when assessing you for credit; or
• for the purposes of improving our products, services and marketing communications,
  with specialist market research organisations who may contact you on our behalf
  and invite you to take part in market research, but who will not be allowed to use
  your information for anything else; or
• where we have sold their service or product to you; or
• where we may transfer rights and obligations under any contract with you; or
• where you have opened an account or policy with another organisation, introduced to
  you by KCU, and you notify us of amendments to your personal details. You will
  also need to contact the other organisation to confirm the changes; or
• where we are required or permitted to do so by law or regulation.
• for risk assessment
• for the purpose of credit checking and fraud prevention:

When you apply for a new account or facility or an increased facility, or where we believe
there may have been a change in your circumstances, we may use the information you give
us to assess any business risk by obtaining credit references from credit reference agencies,
and undertaking credit scoring and/or underwriting assessment of your application/account.

Credit scoring

Credit scoring and underwriting are automated techniques, which base decisions on the
information you have provided directly to us, any information we may hold about you and
any information we may obtain from credit reference agencies or other organisations. Where
we use information from other organisations, we will tell you who they are. This process also
helps us to determine the facilities that we are able to offer you, so it is very important that
the information you give us is accurate.

Credit reference agencies

We will record details at the credit reference agencies of your agreement with us, the
payments you make under it and any default or failure to keep to its terms.

These records will be shared with other organisations and used by us and them to:

i. help make decisions about credit and credit related services such as insurance,
for you and members of your household
ii. trace debtors, recover debt, prevent money laundering and fraud.

The credit reference agencies may use your information for statistical analysis.

When considering your application for a loan, or any other form of credit, or where we
believe there may have been a change in your circumstances, we search credit reference
agency files and the electoral roll to verify the identity of all applicants in order to protect you
and KCU. The agencies we use will add to your record details of our search which will
include any previous and subsequent names, and your application, whether or not your
application proceeds. These details will be seen by other organisations that make searches.
If your application is declined, this will not be disclosed to the credit reference agency.

Please be aware that multiple credit searches may affect your ability to obtain credit
elsewhere.

Prevention of financial crime

We may carry out additional fraud prevention checks using fraud prevention databases. If
false or inaccurate information is provided, and fraud is identified, details will be passed to
fraud prevention agencies. Law enforcement agencies and government agencies may
access and use this information.

We and other organisations may also access and use this information to prevent fraud and
money laundering, for example, when:

• checking details on applications for credit and credit related or other facilities, such
  as additional loans or overdrafts
• managing credit and credit related accounts or facilities
• recovering debt
• checking details on proposals and claims for all types of insurance
• checking details of job applicants and employees.

Details of the fraud prevention databases that we use are listed in the ‘Further Information’
section.

We and other organisations may access and use from other countries the information
recorded by fraud prevention agencies.

Debt recovery process

If you default on your repayments and we fail to reach an agreement to repay the debt, we
will give you 28 days’ notice before recording a default with the credit reference agencies.
The default will remain on the credit reference agency records for a period of 6 years.

In addition we may authorise a third party such as a debt collection agent or a solicitor to act
on our behalf in the recovery of the debt.

If we are unable to locate you to discuss the situation, we may pass your details to a tracing
agency.

Security

We may record telephone calls for security and training purposes and operate CCTV
throughout the KCU premises.

We will not send confidential information by email without your consent or unless you have
chosen to communicate with us by email.

If you change your name, address, telephone number or email address it is important that
you notify us immediately.

Social networking sites

We may monitor and respond to comments or opinions on social networking sites for
example Facebook/Twitter.

Access to your details and correction of details

You have the right to have any inaccurate information corrected. To request an amendment
to your details please contact us in writing to our office address.

How to request your details

You have the right to see and receive a copy of any personal information we may hold on
you.

To request a copy of the personal information we hold on you, please write to us.  Please
specify in your letter the details of the information you require.