Privacy Notice | Perenna

1 December 2022

This privacy notice sets out who we are and how and why we collect, store, use and share your personal information. It also explains your rights in relation to your personal information and how to contact us or supervisory authorities if you have a complaint.

Who we are

We are Perenna Bank PLC (“Perenna”). We are a mortgage bank with a difference. We offer long-term fixed rate mortgage products.

Information collection and use

When you join our waitlist

When you sign up to the waitlist through the website we ask for your contact details and information about your mortgage circumstances and finances. We use this information to help us understand the range of people interested in our mortgage product.

We also ask you if you want to opt into marketing communications. This can include informative content about our business or the industry, reports we publish and new products we launch.

You can unsubscribe from these marketing communications at any time using the link in the email.

When you are a mortgage customer

If you apply for our mortgage product, your broker will provide you with notices of how they and we will process your personal information.

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take banking services from us we may also make periodic searches at CRAs to manage your account with us.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:
· Assess your creditworthiness and whether you can afford to take the product;
· Verify the accuracy of the data you have provided to us;
· Prevent criminal activity, fraud and money laundering;
· Manage your account(s);
· Trace and recover debts; and
· Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organizations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.experian.co.uk/crain. CRAIN is also accessible from each of the three CRAs – clicking on any of these three links will also take you to the same CRAIN document: CallCredit; Equifax; Experian.

If we subsequently offer you our mortgage product and you become our customer, we will process your information as set out in the next section.

If we do not select you to be one of our customers, we will keep your information for 5 years and we may contact you again in that time in relation to your user account on the portal and to tell you about our current offerings.

We also ask you if you want to opt into marketing communications. This can include informative content about our business or the industry, reports we publish and new products we launch.

You can unsubscribe from these marketing communications at any time using the link in the email.

When you are a mortgage customer

We collect, use and keep your information to provide you with our product and service your account.

We have to carry out certain customer checks, including knowledge-based authentication, KYC, credit checks and fraud checks. Please see the ‘Information sharing’ section for more information.

We may contact you for research purposes, such as to understand your customer experience or to ask for suggestions for improvements. You can opt out of this.

We will keep your information for as long as you have the mortgage plus an additional period of 5 years.

When you visit our website

We collect information about when you view and interact with the website or our advertisements.

This includes information about your operating system, browser version, domain name and IP address, and the details of any website you were on before coming to our site.

We use a cookie management tool which allows you to control the cookies we use. You can find information about these cookies as well as accessing the cookie management tool here: https://perenna.com/cookie-declaration.

We use this information to monitor, improve and administer the website and the services we provide, and to measure and manage our marketing efforts.

Where we provide links to websites of other organisations, this privacy policy does not cover how that organisation processes personal information. We encourage you to read the privacy policies on the other websites you visit.

When you contact us

When you contact us we will keep records of your interactions and we may record phone conversations either because we are required to do so under regulation, or for training purposes so that we can improve our services.

Information sharing

We will only share your personal information in the following circumstances.

Service providers

We use a variety of service providers to help run our business and provide our mortgage product. We have agreements with all providers that contain obligations on the other organisation to safeguard your information and to only use your information to provide their service. For more information on the service providers we use, please review the mortgage documentation and the declaration which forms part of the application process. If you use a broker, they will highlight this section to you before submitting your application.

Customer checks

We carry out a range of checks with third parties as set out above.

One of these is Cifas who require members to report any fraud. If, after investigation, we determine that there has been fraud that meets the criteria for reporting, we will file a fraud report. Cifas keeps fraud reports for six years. Other Cifas members may use the information we report to refuse to provide you with services, financing or employment. You can find the Cifas privacy information here: https://www.cifas.org.uk/fpn

We also carry out identity checks with a range of providers. In some cases this will show as a soft search on your credit file. These searches do not affect your credit score. We will need to carry out a credit check at the mortgage application stage.

Advertising

We work with a variety of third-party advertising networks, such as LinkedIn, Facebook, Twitter and Instagram, as well as a PR agency, to deliver targeted ads to our customers through social media. We may share some information such as email and phone number to deliver ads to specific users or to people who are similar to our customers.

Legal requirement

We may disclose your personal information if we, in good faith, believe that we are required to do so by law, regulation or the order of court or other legitimate government body or arbitration panel. This includes any personal information that may be requested by HMRC, the PRA or the Financial Conduct Authority.

If we sell our assets

We may have to share personal information with any person or legal entity to whom we sell or transfer (or initiate discussions with to sell or transfer) our business or any part of it, or any of our rights or obligations under any agreement we may have with you.

Your rights and choices

You have rights with regard to your personal information. Some rights only apply in certain circumstances or to certain information. There are also exemptions from some rights in some circumstances. If you want to make a rights request, please contact: Dataprotection@perenna.co.uk You can manage your data and make certain choices through the Perenna web app.

Access

You are entitled to know what personal information we hold about you and to receive a copy of it.

Correction

You are entitled to correct personal information we hold about you that is inaccurate.

You will need to provide us with evidence of the correct information.

Deletion

In certain circumstances you are entitled to ask us to delete the personal information we hold about you.
We will not be able to delete certain information, such as where we are legally obliged to keep it or where we need to keep it for legitimate business reasons such as accounts and records.

Objection

In certain circumstances you are entitled to object to us processing your personal information.
If you want to object to marketing please use the unsubscribe link in emails, text STOP to any text message, or contact us to opt out of phone and postal marketing. To make sure we respect your request we have to keep your contact details on a suppression list.

Restriction

In certain circumstances you are entitled to ask us to restrict our processing of your personal information.

You can ask us to do this if:

you dispute the accuracy of your personal information;
our processing is unlawful but you prefer restriction to deletion;
we no longer need the information but you need it for legal reasons; or
you have objected to our processing and we are still dealing with this objection.

Portability

In certain circumstances you are entitled to receive the personal information you have provided us in a structured, commonly used and machine-readable format.

How to complain

Please contact our Data Protection Officer first to resolve any query or concern you may have about our use of your personal information. Dataprotection@perenna.co.uk You also have the right to complain to the data protection regulator. The UK regulator is the Information Commissioner’s Office. You can contact them here: https://ico.org.uk/global/contact-us/ or phone: 0303 123 1113.

Security and data location

We endeavour to take all reasonable steps to protect your personal information, including encryption. We require all our staff to have data protection training.
Our service providers are based in different locations, which may be outside the UK. If those countries are in the European Union, Switzerland, Iceland, Liechtenstein and Norway, or countries with an EU adequacy decision, there are equivalent laws on handling personal information and so your information is protected in the same way as it is in the UK.
We make sure that any transfer is protected by an appropriate legal safeguard, which in most cases will be standard contractual clauses.

GDPR lawful bases

UK data protection law requires us to have a lawful basis for our personal information collection and use, and there are several lawful bases available.

Lawful basis	Examples of when we use it
Performance of a contract	To provide our mortgage product and maintain your account. To respond to your queries, requests for information and support.
Legal obligation	As a regulated financial institution we are legally obliged to carry out certain activities, such as identity checks, and to keep certain data for a specified time. To make sure you are not sent marketing if you unsubscribe.
Legitimate interests	Some personal data collection and use is in our legitimate business interests. To use this lawful basis we assess both our interests and yours, to make sure that what we’re doing does not cause any unjustified privacy intrusion. Marketing campaign records: we keep information so we know who was sent what marketing information and when.
Consent	To send you marketing.