Privacy Policy

Account Opening Privacy Notice of Portadown Credit Union Limited

A credit union is a member-owned financial cooperative, democratically controlled by its members, and operated for the purpose of promoting thrift, providing credit at competitive rates, and providing other financial services to its members. Data collection, processing and use are conducted solely for the purpose of carrying out the abovementioned objectives.

This Privacy Notice is to provide you with information regarding the processing of information about you for account related purposes and other general purposes. If you apply for a loan with us, you will be provided with our Lending Privacy Notice to take account of further processing that may be necessary.

Our contact details are:

Address: 26 Market Street, Portadown, BT62 3LD

Phone: 028 38335104

Email: info@portadowncu.com

Data Protection Representative

Phone: 028 38335104

Email: info@portadowncu.com

Portadown Credit Union is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal data about you during and after your relationship with us.

What personal data do we use?

We may collect, store, and use the following categories of personal data about you:

Your name, address, date of birth, email, telephone, financial data, status and history, transaction data; contract data, details of the credit union products you hold with us and have held with us, signatures, identification documents, salary, occupation, source of funds, Politically Exposed Status, accommodation status, mortgage details, previous addresses, spouse, partners, nominations, Tax Identification Numbers (TIN)/National Insurance numbers, tax residency, passport details, driver licence, interactions with credit union staff and officers on the premises, by phone, or email, current or past complaints and CCTV footage.

We need all the categories of information in the list above to allow us to; identify you, contact you, comply with our legal obligations and in order that we perform our contract with you.

Purpose for which we process your personal data

To open and maintain an account for you
To meet our obligations to you under the Credit Union’s Standard Rules
To contact you in respect of your account and any product or service you avail of
To comply with our legal obligations for example anti-money laundering, to identify connected borrowers

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

We may also collect, store and use the following “special categories” of more sensitive personal information:

Information about your health, including any medical condition and sickness (See Insurance for further details)

How we use particularly sensitive personal data

”Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal data in the following circumstances:

In limited circumstances, with your explicit written consent.
Where we need to carry out our legal obligations and in line with our data protection policy.
Where it is needed in the public interest, and in line with our data protection policy.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

How secure is my information with third-party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes unless they are deemed to be controllers in their own right*. We only permit them to process your personal data for specified purposes and in accordance with our instructions. Usually, information will be anonymised but this may not always be possible. The recipient of the information will also be bound by confidentiality obligations.

*As a data controller, the organisations will be required to have provided you with a separate privacy notice setting out what it does with its data.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you or we may be prevented from complying with our legal obligations.

Change of purpose

You can be assured that we will only use your data for the purpose it was provided and in ways compatible with that stated purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Profiling

We sometimes use systems to make decisions based on personal data we have (or are allowed to collect from others) about you. This information is used for loan assessment and anti-money laundering purposes and compliance with our legal duties. We may also carry out profiling in order to tailor our marketing to you using our systems, we may send you information on products and services that may be of interest to you, if you have consented for us to do so.

Data Retention Periods

We will only retain your personal data for as long as necessary to fulfil the purpose(s) for which it was obtained, taking into account any legal/contractual obligation to keep it. Where possible we record how long we will keep your data, where that is not possible, we will explain the criteria for the retention period. This information is documented in our Retention Policy.

Once the retention period has expired, the respective data will be permanently deleted. If you require further information please contact us. Please see our data retention periods below.

Once the retention period has expired, the respective data will be permanently deleted. Please see our retention periods below.

CCTV footage which is used in the normal course of business (i.e. for security purposes) for 90 days. (Unless required for compliance with a legal obligation).
Evidence of identity checks are maintained for five years after an individual ceases to be a member of the credit union;
Details of member transactions are maintained for a period of 10 years from the date of transaction;
Loan application information is maintained for a period of six years from the discharge, final repayment or transfer of the loan and 12 years where the document is under seal;
Forms and records will be retained in individual member files for six years after the relationship with the member has ended

Planned data transmission to third countries

Data may be transferred from us to the Republic of Ireland, Belgium and the Netherlands (see below: sharing of your information). The data is transferred on the basis of an adequacy decision by the UK in respect of the EU.

We may transfer the personal data we collect about you to the following country outside the UK- the United States of America, in order to perform our contract with you. There is not an adequacy decision by the UK in respect of that country. This means that the country to which we transfer your data is not deemed to provide an adequate level of protection for your personal data. However, to ensure that your personal data does receive an adequate level of protection we have put in place the following appropriate measure[s] to ensure that your personal data is treated by those third parties in a way that is consistent with and which respects the UK laws on data protection: DocuSign has completed the approval process from the EU Data Protection Authorities (DPA) for Binding Corporate Rules (BCRs) both as a data processor and as a data controller. If you require further information about this protective measure, it is available in Article 47 of the General Data Protection Regulation- www.gdpr-info.eu/art-47-gdpr/

Updates to this notice

We will make changes to this notice from time to time, particularly when we change how we use your information, and change our technology and products. You can always find an up-to-date version of this notice on our website at www.portadowncu.com or you can ask us for a copy.

We will collect and use relevant information about you, your transactions, your use of our products and services, and your relationships with us. We will typically collect and use this information for the following purposes:

Fulfilling contract

This basis is appropriate where the processing is necessary for us to manage your accounts and credit union services to you.

Administrative Purposes: We will use the information provided by you, either contained in this form or any other form or application, for the purpose of assessing this application, processing applications you make and to maintaining and administer any accounts you have with the credit union.

Third parties: We may appoint external third parties to undertake operational functions on our behalf. We will ensure that any information passed to third parties conducting operational functions on our behalf will do so with respect for the security of your data and will be protected in line with data protection law.

Irish League of Credit Unions (ILCU) affiliation: The ILCU (a trade and representative body for credit unions in Ireland and Northern Ireland) provides professional and business support services such as marketing and public affairs representation, monitoring, financial, compliance, risk, learning and development, and insurance services to affiliated credit unions. As this credit union is affiliated to the ILCU, the credit union must also operate in line with the ILCU Standard Rules (which members of the credit union are bound to the credit union by) and the League Rules (which the credit union is bound to the ILCU by). We may disclose information in your application or in respect of any account or transaction of yours from the date of your original membership to authorised officers or employees of the ILCU for the purpose of the ILCU providing these services to us. The Privacy Notice of the ILCU can be found at www.creditunion.ie

The ILCU Savings Protection Scheme (SPS): We may disclose information in any application from you or in respect of any account or transaction of yours from the date of your original membership to authorised officers or employees of the ILCU for the purpose of the ILCU providing these services and fulfilling requirements under our affiliation to the ILCU, and the SPS.

Insurance: As part of our affiliation with the ILCU, we purchase insurance from ECCU Assurance DAC (ECCU), a life insurance company, wholly owned by the ILCU. To administer these insurances we may pass your information to ECCU and it may be necessary to process ‘special category’ personal data about you. This includes information about your health which will be shared with ECCU for the purposes of our life assurance policy to allow ECCU to deal with insurance underwriting, administration and claims on our behalf. Further information can be found in our lending privacy notice.

Electronic Payments: if you use your electronic payment services to transfer money into or out of your credit union account or make payments through your debit card into your credit union account, we are required to share your personal data with our electronic payment service provider; Worldpay.

Membership Service: To help us improve our service to you, we may use information about your account help us improve our customer service.

Incapacity to Act on your account: The Credit Unions (Northern Ireland) Order 1985 (as amended) provides, in the circumstances where you become unable to transact on your account, due to a mental incapability and no person has been legally appointed to administer your account, that the Board of Directors may allow payment to another who it deems proper to receive it, in order that the money be applied in your best interests. In order to facilitate this, medical evidence of your incapacity will be required which will include data about your mental health. This information will be treated in the strictest confidentiality.

Our legal duty

This basis is appropriate when we are processing personal data to comply with UK, Northern Ireland or EU Law.

Tax liability: We may share information and documentation with domestic and foreign tax authorities to establish your liability to tax in any jurisdiction. Where a member is tax resident in another jurisdiction, the credit union has certain reporting obligations to HM Revenue and Customs (HMRC) under the Common Reporting Standard. HMRC will then exchange this information with the jurisdiction of tax residence of the member. We shall not be responsible to you or any third party for any loss incurred as a result of us taking such actions. The legal basis upon which we do this is compliance with HM Revenue and Custom’s Automatic Exchange of Information standard. We may also share information in respect of dividends and interest payments to members to HMRC where required by law.

Regulatory and statutory requirements: To meet our duties to regulators (the Financial Conduct Authority (FCA) and the Prudential Regulation Authority ((PRA), we may allow authorised people to see our records (which may include information about you) for reporting, compliance and auditing purposes. For the same reason, we will also hold the information about you when you are no longer a member. We may also share information with certain statutory bodies such as Department for the Economy (DfE), the Financial Services Compensation Scheme (FSCS) and Financial Ombudsman Service (FOS) if required by law.

Compliance with our anti-money laundering and combating terrorist financing obligations: The information provided by you will be used for compliance with our customer due diligence and screening obligations under anti-money laundering and combating terrorist financing obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and associated legislation.

Audit: To meet our legislative and regulatory duties to maintain audited financial accounts, we appoint an external auditor. We will allow the external auditor to see our records (which may include information about you) for these purposes.

Nominations: The Credit Unions (Northern Ireland) Order 1985 (as amended) allows members to nominate a person(s) toreceive a certain amount from their account on their death, subject to a statutory maximum. The credit union must record personal data of nominees in this event.

Legitimate interests

A legitimate interest is when we have a business or commercial reason to use your information. But even then, it must not unfairly go against what is right and best for you. If we rely on our legitimate interest, we will tell you what that is.

Credit Assessment and Credit Reference Agencies (CRAs): We may share information you have provided to us with credit reference agencies to verify your identity and suitability for a loan, using information from the Electoral Register and other public sources. When you apply to us for a loan, we may check the following records about you:

(a) our own records;

(b) records at credit reference agencies. When credit reference agencies receive a search from us they will place a search footprint on your credit file that may be seen by other lenders. They supply to us both public (including the electoral register) and shared credit and fraud prevention information; and

Our legitimate interest: The credit union, for its own benefit and therefore the benefit of its members, must lend responsibly and will use your credit scoring information in order to determine your suitability for the loan you are seeking. When using the service of a CRA we will pass them your personal details and details of your credit performance. The searches may also assess your application for the purpose of verifying identities, to prevent and detect crime and money laundering. We may also make periodic searches at CRAs and fraud prevention agencies to manage your account with us a part of our ongoing customer due diligence. If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together so you must be sure that you have their agreement to disclose information about them. CRAs also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the credit reference agencies to break that link. If you give us false or inaccurate information and we suspect or identify fraud we will record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention. In order to process your application we will supply your personal information to CRAs and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Further information about credit reference agencies, and financial connections and how they may be ended, can be obtained from the Credit Reference Agency Information Notice (CRAIN) which sets out how the three main credit reference agencies Callcredit, Equifax and Experian, each use and share the personal data they receive about you and/or your business that is part of or derived from or used in credit activity. CRAIN is accessible from each of the three CRAs – clicking on any of these three links will also take you to the same CRAIN document: Transunion https://www.transunion.co.uk/crain; Equifax; www.equifax.co.uk/crain; Experian www.experian.co.uk/crain.

CCTV: We have CCTV footage installed on the premises with clearly marked signage. The purpose of this is for security.

E-Signatures: if you use Portadown Credit Union’s E-Signature Service to complete loan documents or membership documents, this may result in Docusign coming into possession of personal data attributable to yourself. Where any such personal data is contained in any document which you have signed using an E-Signature generated for you by Docusign, it is intended that such document will have either been purged or redacted by Signable within 12 months after you have signed the document.

Our legitimate interest: With regard to the nature of our business, it is necessary to secure the premises, property herein and any staff /volunteers/members or visitors to the credit union.

Your consent

Marketing and Market Research
To help us improve and measure the quality of our products and services we undertake market research from time to time. This may include using the Irish League of Credit Unions and/ specialist market research companies. See section on Your Marketing Preferences.

Art Competition
This credit union is involved with the Art competition in liaison with the ILCU. Upon entry you will be given further information. Where the person is below 16* then we ask that the parent/legal guardian provide the appropriate consent. A separate privacy notice is included in all Art Competition entry forms. (*This is subject to change)

Schools Quiz
This credit union is involved in the Schools Quiz in liaison with the ILCU. The Schools Quiz is open to entrants aged 4 to 13. Upon entry parent/legal guardians will be given further information and asked for their consent to the processing of their child’s personal data. Where the person is below 16* then we ask that the parent/legal guardian provide the appropriate consent. A separate privacy notice is included in all School Quiz entry forms. (*This is subject to change)

You have a right to complain to the Information Commissioners Office (ICO) in respect of any processing of your data by:

Tel: 028 9027 8757 or 0303 123 1114
Email: ni@ico.org.uk
Post: ICO, 3rd Floor, 14 Cromac Place, Belfast, BT7 2JB

**Please note that the above rights are not always absolute and there may be some limitations.

If you want access and or copies of any of your personal data or if you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we send you a copy/a third party a copy your relevant personal data in a reusable format please contact the Data Protection Representative in writing using their contact details above.

There is no fee in using any of your above rights, unless your request for access is clearly unfounded or excessive. We also reserve the right to refuse to comply with the request in such circumstances.

We may need to verify your identity if we have reasonable doubts as to who you are. This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Ensuring our information is up to date and accurate

We want the service provided by us to meet your expectations at all times. Please help us by telling us straightaway if there are any changes to your personal information. If you wish to avail of any of these rights, please contact us on 028 38335104.