Volvo Car Financial Services UK Limited, trading as Polestar Finance and Santander Consumer (UK) Plc (referred to as “SCUK” in this statement) are joint data controllers of your personal data. This means that Polestar Finance and SCUK jointly decide the purposes and means of the processing of your information. References to “we”, “our” and “us” in this statement are references to Polestar Finance and SCUK as joint data controllers, unless the context otherwise permits. If you have any queries about our handling of your information, you can contact Polestar Finance’ Data Protection Officer by writing to DPO@polestar-finance.com or Scandinavia House, Norreys Drive, Maidenhead SL6 4FL. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate.
This data protection statement explains how we will use the personal data that you provide to us via your intermediary or via an online application or that we have obtained about you through our use of the personal data you have provided (referred to in this policy as your “information”) when you make an application for finance. Please read this statement carefully.
Where we refer to “intermediary” in this statement, this means the dealership or finance broker (as applicable) that has contacted us on your behalf regarding your application for vehicle finance.
Information we collect about you
Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process your information. The categories of information that we may collect about you are as follows: name, address, e-mail address, telephone number, address history, residential status, date of birth, marital status, nationality, dual nationality, driving licence number, bank details, employer’s name and address, occupation, time in employment and any ID documents required to be provided by you (such as Passport, ID Card, driving licence, credit / debit card, proof of disability, proof of home ownership, P60, Wage Slip, Pension Statement, Ltd Company Accounts, council/ housing association tenancy agreement, bank statement, council tax bill, utility bills). If you fail to provide us with the mandatory information that we request from you, we will not be able to proceed with the credit reference and fraud prevention checks described below and, subsequently, we will not be able to consider your application for finance nor propose a finance offer to you.
In addition to the information that you provide in your application for finance to us, we will also collect information about you from enquiries we make about you with credit reference and fraud prevention agencies.
Use of your information
The purposes for which we use your information and the legal bases under data protection laws on which we rely to do this are as follows (as relevant):
- It is necessary for the performance of the contract with you or to take steps to enter into it. This includes verifying your identity, administering the agreement between us (including tracing your whereabouts to contact you and recover debt) and to provide you with the service under that agreement (i.e. managing your account, communicating with you, providing updates on the status of your account, mid and end agreement reviews, dealing with any complaints and notifying you of any changes to this statement).
- It is necessary for our legitimate interests or that of a third party. This includes:
- assessing lending and insurance risks;
- to understand your needs and provide a better service to you, and to help us develop and improve our products and services;
- preventing fraud and money laundering, and to verify your identity, in order to protect our business and to comply with laws that apply to us;
- monitoring communications between us (calls, letters, emails and texts) to prevent and detect crime, to protect the security of our communications, systems and procedures, and for quality control and training purposes;
- contacting you to ask you to participate in customer satisfaction surveys and market research (by email, letter, SMS or phone) and to undertake and analyse those surveys and research, this is to allow us to benchmark our services and evaluate new and existing products and services;
- for management and audit of our business operations including statistical analysis and accounting and system testing in order to protect our business;
- creating a profile of you to enable us to identify and personalise what products and services to offer to you for marketing purposes;
- conducting a propensity to renew analysis and evaluating those results to enable us to provide relevant and timely renewal communication activities;
- use by your intermediary for the reasons described under ‘Disclosure to and use by third parties’.
- It is necessary for compliance with a legal obligation. This includes when you exercise your legal rights under data protection law, to verify your identity, for the establishment and defence of our legal rights, for activities relating to the prevention, detection and investigation of crime, to conduct credit, fraud prevention and anti-money laundering checks and for compliance with our legal and regulatory responsibilities. This may also include processing special categories of data about you, for example for our compliance with our legal obligations relating to vulnerable people or if you go into arrears with your payments due to a health-related reason.
- You have given us your consent to use it for direct marketing communications (by us and the third parties referred to on the proposal document). You can withdraw your consent to marketing at any time by following the unsubscribe instructions in the relevant communication, contacting our customer services department on 0330 678 1548 or write to us at email@example.com, or 86 Station Road, Redhill, RH1 1SR.
Disclosure to and use by third parties
As Polestar Finance and SCUK are joint data controllers of your information, certain information is shared between us. Polestar Finance uses your information to administer your finance application and the finance agreement. SCUK uses your information to undertake the underwriting process (for example, to conduct credit and fraud prevention checks and generally assessing lending risks) and to contact you about arrears and to recover monies owed to us, where applicable.
We disclose your information to the following third parties:
- Your intermediary to assist us with administering your application.
- Credit reference agencies (including Experian, TransUnion, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0330 678 1548.
- Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies).
- Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services.
- Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
- If we or the Santander group undergoes a group reorganisation or is sold to a third party, your personal information provided to us may be transferred to that reorganised entity or third party and used for the purposes highlighted in this data protection statement.
Use by credit reference and fraud prevention agencies
In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (CRAs). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
We will use this information to:
- Assess your creditworthiness and whether you can afford to take the product you have applied for;
- Verify the accuracy of the data you have provided to us;
- Prevent criminal activity, fraud and money laundering;
- Manage your account(s);
- Trace and recover debts; and
- Ensure any offers provided to you are appropriate to your circumstances.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before making an application to us. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.experian.co.uk/crain (please note that the Credit Reference Agency Information Notice is the same for each of the CRAs).
Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process your information. If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.
Automated decisions and profiling
As part of the processing of your information, decisions may be made by automated means.
Your information will be used to assess your credit risk using an automated decision-making technique called ‘credit scoring’. Various factors help us to assess the risk; a score is given to each factor and a total credit score obtained, which will be assessed against a confidential pre-set pass score.
In regard to fraud prevention checks, this means that we may automatically decide that you pose a fraud or money
laundering risk if:
- Our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions; or
- You appear to have deliberately hidden your true identity.
You have rights in relation to automated decision making: if you want to know more please contact us using the details above.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.
Data anonymisation and use of aggregated information
Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies*, your intermediary and Polestar Automotive UK Limited.
Retention of your information
If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have.
Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed (please see ‘Use by credit reference agencies’ for more information about the information that we give to them).
Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years.
We may hold your information for a longer or shorter period from that described above where:
- the law requires us to hold your personal information for a longer period, or delete it sooner;
- you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and
- in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.
Transfers to third countries/ where we store your information
We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law.
You have the following rights (which may not always apply or be subject to certain circumstances):
• to be informed about the processing of your information (this is what this statement sets out to do);
• to have your information corrected if it’s inaccurate and to have incomplete information completed;
• to object to processing of your information;
• to restrict processing of your information;
• to have your information erased;
• to request access to your information and information about how we process it;
• to move, copy or transfer your information (“data portability”); and
• rights relating to automated decision making, including profiling.
More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at www.polestar-finance.co.uk or by requesting a copy via email from firstname.lastname@example.org or calling our customer services team on 0330 678 1548. If you would like to discuss or exercise any of these rights, please contact us by writing to 86 Station Road, Redhill, RH1 1SR or using the above contact information.
We may update the data protection statement from time to time. When we change the data protection statement in a material way, a notice will be displayed on our website along with the updated data protection statement.
We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns by writing to DPO@polestar-finance.com or Scandinavia House, Norreys Drive, Maidenhead SL6 4FL. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.
The Santander group of companies includes but is not limited to Banco Santander S.A.; SCF Madrid, S.A.; Santander UK Group Holdings
plc, Santander UK plc, Santander UK, Santander Consumer (UK) plc trading as Santander Consumer Finance ; Santander Insurance
Services UK Ltd.