At Mendip Community Credit Union (MCCU) we are committed to protecting and respecting your privacy, and we take the protection of your personal information seriously.
Our Privacy Statement explains our approach to collecting, storing and processing your personal information, your rights and how to get in touch with us if you have any further questions.
What information do we collect about you?
We collect and process:
- information you give us when you open an account with us or apply for one of our products or services. This will be the name, address, telephone numbers, date of birth, personal address and email address, National Insurance Number, employer and next of kin for all people who are named on the account;
- information you provide voluntarily during conversations in person, by text, e-mail or phone;
- correspondence you may have with us (including recordings of calls left on our answerphone service) and any complaints you have raised to our attention;
- specific information you give us when you apply for a loan. This will include details of your income and expenditure, household composition, information about current and previous debts
- information we obtain if you default on your loan to enable us to collect debts e.g. new addresses or phone numbers provided by tracing agents.
How will we use the information about you?
We use personal information to provide you with our Services, updates concerning our Services, and to send administrative information to you including Newsletters, account balances, statements, loan documentation and to respond to your queries. We also need to use your personal information to ensure the security of our Services, as well as for the purposes of preventing or detecting fraud.
This means that the legal basis for us processing your personal information described above will typically be the following:
- because it is necessary to fulfil a contract that we have in place with you;
- where the processing is necessary for compliance with our legal obligations; or
- for our legitimate business interests.
We use and keep call recordings (made to our answerphone service) to ensure that we are handling your query correctly.
How we store your personal information and how long we store it for
We and companies storing your data on our behalf, store paper data in the UK and digital data within countries adhering to the GDPR.
We will only retain your personal information for the following periods:
- Your Account Details, Correspondence and Compliance Information – 7 years after you have closed your account with us;
- Other information that you have provided voluntarily – 7 years after this data was initially captured, except where this is relevant to recovery of an outstanding loan.
Where we have collected the personal information based on your consent and we have no other lawful basis to continue with that processing, if you subsequently withdraw your consent then we will stop processing that personal information and delete it. This will not affect the lawfulness of processing based on consent before its withdrawal.
If we have anonymised your personal information or aggregated your personal information in a way that you can no longer be identified from it, then we will continue to keep and use this anonymised information.
Who we share your personal information with
We cannot run our business or provide some of our services without involving other businesses and sometimes we pass your information to these other people and businesses as set out below. We only share your information where we can do so in accordance with our legal data protection and privacy obligations. We may share your personal information with:
- payment service providers who provide services for sending and receiving payments;
- debt collection services including DWP’s Eligible Loan Deduction Service (only in relation to loans which are in default);
- professional advisers who need it to provide advice to us and to audit us;
- compliance and regulatory bodies: police, local authorities, HM Revenue & Customs (HMRC), the Financial Conduct Authority, the Prudential Regulation Authority, the courts and any other central or local government bodies where they request it and we may lawfully disclose it, for example for the prevention and detection of crime;
- other people who make a subject access request to us, where we are allowed to do so by law.
We also share the information we process where we are legally obliged to do so, for example, to comply with a court order.
We will never sell or disclose your personal information to third parties for marketing activities.
You have certain rights in relation to your personal information. These include:
- (where we rely on your consent to process your personal information) the right to withdraw consent to the processing of your personal information,
- the right to request access to your personal information (a “subject access request”);
- to correct any mistakes on our records;
- to erase or restrict your personal information where it is no longer needed for the purpose for which they were obtained or used;
- the right to object to our use of your personal information based on legitimate business interests; and
- the right, in certain circumstances, to receive a machine-readable copy of, the personal information you provided to us.
You will not normally need to pay to access your personal data (or to exercise any of the other rights) although we reserve the right to charge an administrative fee for vexatious requests. We will handle any request to exercise your rights in accordance with applicable law.
If you wish to exercise any of these rights please write to us using the contact details set out in the “Contacting Us” section below with the subject line ‘Personal information request’. In your request, please supply the following details:
- First name(s) & surname
- Address & postcode
- Details of the type of information you are seeking
- Proof of Identity – copy of a document which contains your signature, such as a passport.
In your request, please make clear what right you would like to exercise. Providing us with this information will help us to quickly identify and deal with your request.
Write to us at: MCCU, Unit 7 Abbey Mews Arcade, 56-58 High Street, Glastonbury, BA6 9DY