We may collect certain personal data which (either on its own or when combined with other information we hold about you) allows us to identify you as an individual and which is about you. You can see details of the types of personal data we may collect about you in our full privacy policy.

We will generally collect your personal data directly from you, or via third parties such as brokers or intermediaries. However, we may also collect data from and/or combine your personal data with information from other sources such as Credit Reference Agencies (CRAs) or fraud prevention agencies, and publically available sources such as social media and Companies House. You can see details of such other sources in our full privacy policy.

We process your data to provide you with the product or service you are using, in accordance with our contract, or to take steps to enter into a contract in respect of a product or service you have requested. We may also use your personal data to comply with our legal obligations, such as detecting and monitoring fraud and other financial crime, and complying with our regulatory obligations.

Some of our processing of your personal data is done on the basis that it is necessary for our legitimate interests in running an efficient and effective bank, including administration, records keeping and governance, improving our products and services and for marketing research and developing statistics, as well as some profiling and automated decision making. We also process your personal data for matters of substantial public interest, such as protecting vulnerable customers or detecting and preventing fraud.

These activities may include sharing your personal data with third party service suppliers such as payment service providers. Other uses of personal data will be to ensure that we can meet our legal and regulatory obligations (and the regulator’s expectations) such as meeting audit requirements. We share your information within the Aldermore Bank Group and our contracted third parties who either provide a service to us or you.

We may also, from time to time, ask you for your consent for other purposes, which we will explain to you at the time. Much of what we do with your personal data is not based on your consent and is instead based on other legal grounds. However, for processing that is based on your consent, you have the right to revoke that at any time.

More details about why we use your personal data, who we share it with and how and when you can withdraw your consent can also be found in our full privacy policy.

We may also collect personal information about other individuals who you have a financial link with. This may include people who you have joint accounts or policies with such as your partner/spouse, dependents, beneficiaries, guarantors or people you have commercial links to, for example beneficial owners, directors, shareholders, employees and officers of your company.

We will collect this information to assess any applications, provide the services requested and to carry out Anti - Money Laundering and fraud prevention checks. You can find out more about how we process personal information about individuals with whom you have a financial link in our full privacy policy.

We will only send your data outside of the European Economic Area (EEA) to follow your instructions, comply with a legal duty or work with our agents and advisers who we use to help run your accounts and services. Safeguards that we put in place include contractual obligations imposed on the recipients of your personal data to require them to protect your personal data to the standard required in the EEA. More information on this can be found in our full privacy policy.

In order to process your application, we will supply your personal information to CRAs including how you use our products and services, and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity.

We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time, information on funds going into the account, the balance on the account and, if you borrow, details of your repayments or whether you repaid on time. CRAs will share your information with other organisations, for example other organisations that you ask to provide you with products and services. Your data will also be linked to the data of any joint applicants or other financial associates as explained above. You can find out more about the identities of the CRAs, and the ways in which they use and share personal information here:

• experian.co.uk/crain/index.html
• https://www.experian.co.uk/privacy/consumer-information-portal/
• https://www.transunion.co.uk/legal/privacy-centre
• https://www.equifax.co.uk/About-us/Privacy_policy.html

The personal information we have collected from you and anyone you have a financial link with may be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your information will be used by us and these fraud prevention agencies can be found in our full privacy policy.

Fraud Prevention Agencies and CRAs will use your personal data to perform their services or functions as data controllers in their own right. These notices are separate to our own. Additionally, where a broker or other intermediary processes your personal data as a data controller in its own right, its own privacy notice will apply and you should ask them for a copy if you have not received one by the time you are introduced to us.

You have a number of rights in relation to your personal data. You can find more information in our full privacy policy or by contacting us if you wish to exercise any of the following rights.

• to request access to your personal data and to obtain information about how we process it
• to object to the processing of your personal data
• to restrict processing of your personal data
• to have your personal data erased
• to have your personal data corrected if it is inaccurate and to have incomplete data completed
• to move, copy or transfer your personal data
• rights in relation to automated decision making including profiling
• the right to complain to the Information Commissioner’s Office who regulates the processing of personal data in the UK.

We will keep you informed about our products and services similar to those you already have, although you can opt out of receiving this at any time by logging on to your account where online access is provided, writing to us or emailing us at any of the contacts published on our website.