Privacy Policy
Who we are
We are Great Western Credit Union (GWCU). Our registered office is at 2 York Court, Upper York Street, Bristol, BS2 8QF
Our telephone number is: 0117 924 7309
You can email us at:info@gwcu.org.uk
We are a financial co-operative that is owned and controlled by its members. We do not have shareholders, which means we can put our members and our local community first and make sure all our profits go back into our business. We provide affordable savings and loans but we also have a social purpose, which is to improve the long-term wealth and well-being of our members and our local community by reducing financial and social exclusion.
We are regulated by the Prudential Regulatory Authority (PRA) and the Financial Conduct Authority (FCA).
About this guide
This guide explains how Great Western Credit Union (GWCU) uses its members’ personal information. It sets out the kind of information we use, the reasons why we use it, anyone we might share it with and why, and our legal reasons for doing so. It also explains the legal rights you have over your information under Data Protection legislation.
It is our Privacy Notice for members as required by Data Protection legislation.
Download Privacy Policy (336.8KB)
What is personal information?
Personal information is information that identifies you, either on its own or if it is combined with other information that GWCU has about you. Sometimes it is called “Personal Data”. Examples of personal information held by GWCU include:
- contact details
- financial details
- information about personal circumstances
- the information you provide when you apply for savings or loan accounts, which includes membership of GWCU
- the information you provide on loan application forms
- the information recorded during your telephone calls with GWCU
- any information outside organisations or third parties send us
- information we record on CCTV
Special category data
The law regards some sensitive information as particularly special and deserving of particular care. The guide explains why we might use this information.
Why does GWCU collect personal information?
The main legal reasons we collect and use personal information are:
- to be able to run our business, which is providing a credit union service, efficiently and to a high standard
- to make our business sustainable and ensure our systems are robust
- to achieve our social purpose and demonstrate our social impact
- to work with partner organisations to achieve these aims
- to comply with the obligations that result from our contract with our members
- to provide our members with enough information to participate fully in their Credit Union membership, for example through attending our Annual General Meeting
- to comply with our legal and regulatory obligations
- to develop and promote any new products and services and assess whether they are successful
- to operate as an employer
- to carry out tasks in the public interest, including sharing information with organisations whose work is in the public interest.
We may also occasionally use information for other legal reasons, which are explained in the guide.
Under Data Protection law, these legal reasons for using information are the same as our legal bases for processing information.
Your rights over your personal information
The Guide also sets out your rights over your information that we hold and what you need to do to be able to carry them out.
We, GWCU are the DAta Controller for the information we collect from you and store about you. We may also process data about you that we collect from other organisations such as credit reference agency data when you apply for a loan.
Data Protection Officer
GWCU does not have a full-time Data Protection Officer. However, all our staff have data protection training. The CEO has operational responsibility for data protection, which is set out in our Data Protection Policy. The Board of Directors reviews and agrees our Data Protection Policy and ensures that we follow its requirements.
The Personal Information we collect
When anyone contacts GWCU
Contact details
Whether you are a member of GWCU or not, and whether you are applying to join GWCU or not we collect certain information about you when you contact us.
This information can include:
- your name;
- your contact details such as email address or telephone number;
- details about a third party should your enquiry relate to or involve a third party;
- source information from email or other electronic contact, such as details of the IP address from which a webform was submitted;
- any other information you provide to us
We collect and use this information in order to respond to your query, request, or complaint as it is in your and our interests to do so.
Recorded telephone calls
We may record your telephone calls to GWCU:
- to ensure we record correctly the information you have given us;
- to operate your account properly where you are a member;
- to help resolve any queries or complaints;
- for regulatory purposes;
- to improve the quality of our service;
- to help detect or prevent fraud or other crime.
Information used to join GWCU and open a Savings Account
Confirming your identity, address and eligibility to join GWCU
To become a member we ask you to provide information to confirm your identity, to check you’re eligible to join and to prevent fraud and money laundering; we keep a copy of this information. We do this because we have a legal obligation to check your identity and because it is also in the legitimate interest of our business to prevent fraud and money laundering.
We also record:
- your contact details;
- your National insurance number; and
- your date of birth.
If you do not live in the membership area, we also ask you to confirm either:
- that you work in the member area, with the postcode of the place that you work, and sometimes who your employer is, or
- that you live in the South West and that you are a member of the relevant trade unions that make you eligible to join GWCU; or
- Details that verify any other membership qualification that you may use.
We undertake checks to prevent fraud and money laundering and to verify your identity. We use Identity and Anti-Money Laundering service providers, Credit Reference Agencies and fraud prevention agencies to confirm your identity, age and address and to prevent fraud and money laundering. You can find out more about how Credit Reference Agencies use and share personal data through the Credit Reference Agency Information Notice which can be found at: https://www.equifax.co.uk/privacy-hub/crain
We will check your details against lists of Politically Exposed Persons, lists relating to Financial Sanctions maintained by HM Treasury and any other lists or sources of data which we are required to check by legal or regulatory obligation. You can find out more about Money Laundering Regulations (which includes Politically Exposed Persons and Counter Financing for Terrorism checks) by searching on the https://www.gov.uk/ website.
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk then your data can be held for up to 6 years.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the loan or any other services you have asked for. We may also stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by fraud prevention agencies and may result in others refusing to provide services, financing or employment to you. If you have any questions about this then please contact us using the details above or on page 1 of the downloaded document.
We may use the information that you give us when applying for membership in order to contact you about your application if we need to clarify anything, if we need to offer you support, or if you don’t complete the joining process so that we can offer to help you to do so. We further use this information to be able to run your account properly once you become a member. This is because:
- you have asked to enter into a contract with us;
- it is in your interests that we do not confuse you with someone else who may have the same name, address or date of birth as you;
- it is in our business interests to make sure:
- you are entitled to be a member of GWCU
- we are sure you are who you say you are
- we can protect GWCU against financial loss
- we have a legal obligation to take action against financial crime, including fraud, money laundering, and against other crime.
If, following our checks, we are unable to accept you as a member, or you provide details to us but do not complete the joining process then we will retain the details that you have provided to us. This is in order to remove duplicate applications and to identify and prevent fraud or other financial crime.
We might do this where we are assessing a loan application or where we are seeking to make contact about money that you owe us, or for other reasons in connection with your accounts or membership. We do this because it is in our business interests, and because we have a legal obligation to take action against financial and other crime.
Next of kin
Whether or not we are able to give your money to this person after your death also depends on other factors, such as the overall size of your estate, and other aspects of the law as it relates to inheritance.
Information needed to operate your membership and Savings Account
All GWCU members have a savings account as a condition of membership. We use your information to fulfil our contract with you and because it is in GWCU's legitimate interests to do so.
To operate your savings account, as well as the information you provide when you join, we also collect:
- information on non-GWCU accounts you may ask us to send money to on your behalf;
- where we receive deposits to your account, whether you are receiving payments from external agencies such as:
- HMRC (child tax credits, child benefit)
- the Department of Work and Pensions (Employment Support Allowance, Jobseekers Allowance, Personal Independence Payments, Universal Credit, the State Pension and other benefits)
- your local council (for example Local Housing Allowance/Housing Benefit or other support payments)
- a private pension scheme
- an employer
- details about your employer if you save and borrow with GWCU through an Employee Partnership Scheme;
- details about your landlord, if we pay your housing benefit to them;
- all your account transactions (including the sort code and account number and any reference information for inbound electronic transactions, and payer details for cheque deposits).
- administer your account correctly;
- provide you with an account statement when you request one;
- respond to your queries and instructions;
- help resolve any complaints.
We may also use it to help detect or prevent fraud or other crime, including by operating electronic checks on individual transactions and/or patterns of transactions, including comparing those to others’ transactions and/patterns of transactions.
Changes to your member statusWe may record changes to your membership status. This includes where:
- we are informed that you are no longer at the address we hold for you (‘gone away’);
- you move out of the membership area (‘non-qualifying’);
- your account has been unused for a period and is made dormant in accordance with the Rulebook (‘dormant’);
- we are informed that you are deceased (‘deceased’);
- we have agreed a short or long term arrangement to repay money you owe us which is different to any arrangement originally agreed (‘in arrangement’)
- you are no longer a member (‘left’);
- we record fraud or bad debt activity against your account (see separate sections below);
- where you change from being a junior depositor to a member (‘Active’); or
- where there is a change from any of the states listed here to being a fully qualifying active member in accordance with the Rulebook (‘Active’).
We may seek to verify this information, for example by using other details we hold about you to confirm a change of address, or by using details we may hold about any nominated beneficiary to confirm your death.
We do this as it is in our legitimate interests to keep a record of the current status of your membership, and because it is in your interest that we keep our records as up-to-date and as accurate as possible.
Bad Debt
- recover your loan payments;
- decide whether to offer you a loan in future; and
- tell Credit Reference Agencies, who can share the information with other financial organisations.
Fraud
If the fraud is current or recent we are obliged to share it with the Police or other law enforcement agencies, such as the Serious Fraud Office.
We use this information:
- to meet our legal obligations under the Fraud Act and other legislation;
- to meet our duties to our members;
- as part of our business interest and regulatory duty to lend responsibly;
- to complete a task in the public interest.
In exceptional circumstances we might keep your information for longer but only with good reason and if we are allowed to under data protection law. An example of this might be where your account has become dormant, but still has a balance, or where we suspect but have been unable to confirm that you are deceased.
We can keep information for many years if we decide to keep it for research, statistical or historical purposes.
A record of your membership is maintained in perpetuity in accordance with the requirements of section 30 of the Co-operative and Community Benefit Societies Act 2014.GWCU Current Accounts
- Contact information of closed account holders;
- Details of all of the transactions on accounts;
- Notes made regarding the accounts, including those relating to potential or actual fraud.
- This allows us:
- to comply with our record retention obligations to keep financial information for 7 years after accounts are closed;
- to be able to resolve any queries or complaints you may have;
- To help detect or prevent fraud or other crime.
Information used to apply for a loan or to manage a loan
We use this information:
- To help us meet our regulatory requirement to lend responsibly;
- To meet our legal requirements to report and prevent financial crime;
- Because it is in our interests:
- to protect GWCU against financial loss;
- to give GWCU a sustainable future; and
- to be able to help other members.
It is also in your interests that you are not burdened with a debt you cannot afford.
Loan application forms
When you apply for a loan we may ask you for the following information:
- contact details
- information about your personal circumstances, including:
- your marital status
- your housing status
- your employment status
- employer details
- we ask for a detailed breakdown of:
- your income, including any pensions, allowances or benefits you receive
- your partner’s income
- how much you spend on:
- rent or mortgage payments
- bills (gas, electricity, phone etc)
- insurance
- car or transport costs
- costs associated with having children
- food
- other regular household costs
- how much you owe to other companies or organisations, such as retail and mail order companies, finance companies and any other credit providers if your loan is to consolidate other debts
- whether you have missed any loan, hire purchase or other credit payments
- whether you are in arrears with bills, rent or mortgage payments
- what you want the loan for
- how much you want to borrow
- how you plan to repay the loan
- the bank account where GWCU should pay the loan
- If you have dependent children we record how old the youngest child is
- We record whether your loan has been approved (and the amount approved) or declined or withdrawn at your request (or withdrawn by us because you failed to provide any further information that we requested or failed to finalise the application for any other reason).
We retain a record that a loan application was made, the outcome of the application and, where a loan was issued, details of the financial transactions relating to the loan.
Credit Reference Referencing AgenciesIn order to process credit applications you make we will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as information about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity.
We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates. This may affect your ability to get credit.
The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at:
- Transunion at https://www.transunion.co.uk/legal/privacy-centre
- Equifax at https://www.equifax.co.uk/privacy-hub/crain
- Experian at https://www.experian.co.uk/legal/crain/
They may retain information for up to 6 years after any credit agreement between us has ended. When we share this information all parties conform to industry standards.
Credit Reference Agencies also share information about people with many financial organisations.
Their records can tell us:
- whether you have kept up with paying your bills, rent or mortgage, and other debts such as loans, phone and internet contracts;
- your previous addresses;
- information on any businesses you may own or have owned or directed;
- whether you are financially linked to another person, for example by having a joint account or shared credit;
- whether you have changed your name;
- whether you have been a victim of fraud.
Where you are financially linked to another person their records can provide us with details about that person’s credit agreements and financial circumstances.
They also use publicly available information to record information about people, including information from:
- The Royal Mail Postcode Finder and Address Finder;
- The Electoral Register;
- Companies House;
- The Accountant in Bankruptcy and other UK equivalents;
- The Insolvency Service and other UK equivalents;
- County Court Records.
This tells us, among other things:
- Your age, address and whereabouts;
- whether you are on the Electoral Register;
- whether you have been declared bankrupt;
- whether you are insolvent; and
- whether there are any County Court Judgements against you.
We use this information to help us make sure we are lending our money responsibly and to help us decide whether a loan is appropriate for you. We cannot do this without:
- confirming your identity;
- verifying where you live;
- making sure what you have told us is accurate and true;
- checking whether you have overdue debts or other financial commitments; and
- confirming the number of your credit agreements and the balances outstanding together with your payment history.
We also have a duty to protect GWCU and wider society against loss and crime, so we use and share Credit Reference Agency information:
- to identify, prevent and track fraud;
- to combat money laundering and other financial crime; and
- to help recover payment of unpaid debts.
We also use information from Credit Reference Agencies to help us to understand changes to your financial situation, including details about other amounts you may owe, your repayment history and income level, whilst you have a loan account open with us. This information can help us to target support for borrowers where it might most be needed and to make sure we can deliver good outcomes for you and other consumers.
We use this information to meet our legal and regulatory responsibilities relating to responsible lending and financial crime, to protect GWCU from loss and to pursue our legitimate interests. We may also use this information for research purposes and to develop new products.
Fraud Prevention Agencies
We use your information to carry out checks for the purposes of preventing fraud and money laundering. These checks require us to process and share personal data about you.
The personal data can include information that you have shared with us in making your loan application, other information we have collected or hold about you, or information we receive from third parties such as Credit Reference Agencies.
We will share:
- Your name;
- Your address;
- Your date of birth;
- Your contact details;
- Your financial information;
- Your employment details;
- Device identifiers, including IP address; and
- Any other information that it is in our legitimate interest to share in order to prevent or detect fraud, or that we are legally obliged to provide.
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
We process your data in these ways because we have a legitimate interest in preventing fraud and money laundering in order to protect our business and to comply with laws that apply to us.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, for up to six years.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the loan or any other services you have asked for. We may also stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by fraud prevention agencies and may result in others refusing to provide services, financing or employment to you. If you have any questions about this then please contact us using the details on page 1.
Debt Recovery Agencies
We may share your information with debt recovery agencies if you fail to or are unable to maintain your loan repayments as agreed. This helps GWCU:
- recover your debt to us to avoid loss to GWCU;
- use the money we recover to help other members; and
- help you get back on track with repayments to protect your credit score.
These organisations may record their conversations with you. From time to time we may listen to these conversations to make sure they are providing an appropriate and professional service to you and to resolve any queries or complaints.
We use this information:
- to administer loans and loan repayments;
- to carry out our contract with you (your loan agreement);
- to comply with our legal obligations to report fraud, money laundering and other financial crime.
- because it is in our legitimate interests to recover money we are owed
- so we can use it to help other members
- to protect GWCU from financial loss
Debt recovery agencies may act in our name, or in their own name. They usually act in our name where your account is in arrears, but you have not been issued with a Notice of Default. They may act in their own name if a Notice of Default has been issued against you, and any sums outstanding have not been repaid. Whichever name they act in they are acting on our behalf and you may continue to contact us with any query or complaint, and if you contact them then any query or complaint will be passed to us to review.
If your loan application is rejected or when you have fully repaid your loan
We are obliged to keep your records, including your financial information, for up to a further seven years to fulfil our legal and regulatory obligations, and any business record retention requirements. Your records will continue to be private and confidential and handled in line with this Privacy Notice and GWCU’s other relevant policies.
If you applied for, but were not issued with a loan then we will retain the full application details for up to three years in order to prevent fraud and other financial crime, and to help us to make decisions on any future application(s). We will retain a record that you applied for a loan, the amount that you applied for and the outcome of the application for as long as you remain a member of the credit union.
In exceptional circumstances we might keep your information for longer but only with good reason and if we are allowed to under data protection law. An example of this might be where your account has become dormant, but still has a balance, or where we suspect but have been unable to confirm that you are deceased.
We can keep information for many years if we decide to keep it for research, statistical or historical purposes.
Communicating with you
General communications
We use your information to communicate with you for various purposes, including:
- managing your account;
- managing your loan;
- providing you with an account statement;
- ensuring we record the additional information you give us accurately;
- complying with your legal rights and our legal obligations;
- enabling you to participate fully in your Credit Union membership;
- asking you how our service has operated for you, about our service quality and about other membership/account related matters through surveys;
- keeping you up to date with GWCU news;
- telling you about any changes in the law that could affect you.
We do this to fulfil our contract with you, to meet our legal and regulatory obligations and because it is in the interests of our business to do so.
We will communicate with you by means of email, by post, by telephone, by text or other electronic message format, and face-to-face, including through webinars or other technologically-supported means. We will take as much account as we are able of your preferences in receiving communications, but sometimes we may not be able to do so. For example if there is an urgent matter requiring us to contact you about your account then we may only be able to do that by telephone or email and not face-to-face, or if you have requested contact by email but your email address no longer appears to be in use or valid then we may have to post information to you.
We only contact you with marketing information if you give your consent (and you can withdraw this at any time). See the separate section below.
Where we send newsletters and other general information by email through an external email system such as ClickDimensions then the messages that we send may contain tracking beacons/tracked clickable links or similar server technologies in order to track activity within those messages. Where used, such marketing messages may record a range of data such as: times, dates, IP addresses, opens, clicks, forwards, geographic and demographic data. Such data (within its limitations) will show the activity each subscriber made for that email. We use this data only in order to:
- ensure that our messages reach the recipient’s email address, and so we can contact them by other means where delivery fails;
- track whether members have viewed/downloaded important legal or regulatory information about their membership or account; and
- take account of any requests not to receive further information (though we may be required to ignore any such requests where we have a legal or regulatory obligation to provide you with information).
Annual General Meeting (AGM) and other General Meetings
Our Annual General Meeting is where our Members can meet the Directors, receive, discuss and question the report and accounts for the year, elect new Directors and formalise the dividend. It is your chance to vote and express your opinion on Credit Union issues. You are legally entitled to this information and we are legally obliged to send it to all members.
If any other type of General Meeting of the members of the credit union is called for any purpose then you are legally entitled to this information too, and we are legally obliged to send it to all members.
We have a legal obligation to send you this information. It is also part of our contract with you as a member of GWCU to enable you to participate fully in your Credit Union membership. It is also in GWCU’s legitimate interests to involve as many members as possible in the AGM.
If you attend the AGM or any other General Meeting we will record your name and member number as an attendee. If you send formal apologies we will record these in the Minutes, with your name.
Where an AGM is held online, through a webinar or other technologically supported means, any recording that we make may include your name and any questions that you ask. It may also include a record of your voice if you speak, for example to ask a question, and your appearance if you have a web camera and have it turned on.
If you attend the AGM or other General Meeting the Minutes may include:
- your name;
- details of any questions you ask or questions, motions or proposals to which you respond; and
- where you have proposed or seconded any motion or proposal put to the meeting.
The Minutes become a formal record, may be published on our website and are available to any member on request. They are also presented to the next General Meeting for approval. Where we record a General Meeting, including the AGM, we may make the recording available online, for example through our website, so that other members can see what happened.
This is to help fulfil our legal obligations in running General Meetings, including the AGM in the interests of all members, including checking that the meeting is quorate, and maintaining a proper record of the business conducted at the meeting.
We send all our members a newsletter keeping them up to date with the latest GWCU news. This includes:
- general information about membership;
- general information on any accounts you have with us;
- information about the AGM;
- any other information we are legally obliged to send you;
- telling you about the Members’ Forum;
- updating you on the new projects or other matters we described or discussed at the AGM;
- giving you news of how the Credit Union is operating in your area;
- telling you about new groups we are serving;
- news of any external investment or funding we might be seeking or receive
- offering hints and tips on managing your money;
- letting you know about changes to services (for example in opening hours, Christmas operating times); and
- giving you updates about the law.
Our contract with you requires us to enable you to participate fully in your Credit Union. Sending you this information is also in our business interests because it furthers our social purpose of financial and social inclusion and is part of our commitment to being fair and transparent with our members. The newsletter is not for the purpose of marketing.
Surveys
We use your email address (where you’ve provided one) to email you with surveys from time to time. We do this:
- to evaluate the quality of services we provide to you;
- to provide us with insight about potential new services;
- to seek feedback from you as a member of your credit union about other matters which may affect your membership.
Any results we share are anonymised. If you have provided us with feedback, for example a quote about our service, we will ask your permission before we use it. We may follow up with you on any specific queries, compliments or complaints that we identify through responses to a survey in order to make sure that we provide the best service we can to you.
We do this because it is in our business interests to do so, and because it is in your interests that we develop and improve our services.
Facebook - our page
We maintain a page on Facebook where we publish information and updates about the credit union for members and other people and organisations who are interested in what we do.
This information is available to anyone who views our page.
We also allow people to ‘like’ our page. Liking our page means that when we publish new content to our Facebook page the person who has liked the page is more likely to be shown that content. We may also pay Facebook to ‘boost’ our content, which means that people who like our page are even more likely to see it.
We do not collect details of the people who have liked our page, or their Facebook accounts, and we neither control nor process this data.
People can also contact us via our Facebook page or by means of Facebook Messenger. Where you contact us via our Facebook page or via Facebook Messenger then we will respond to you in the same way. We do this:
- because you have asked us to by contacting us in this way;
- in order to respond to your request, query or complaint;
- in order to ensure our legitimate business interests are met.
We may not monitor our Facebook or Messenger accounts outside of business hours, and we may not monitor them regularly in business hours either. To be sure of contacting us members and others are advised to call us by phone, or to email our main email address info@gwcu.org.uk
We may refuse to allow questions, queries or comments to be published on our Facebook page, and we can remove or delete any content which we do not wish to be displayed on our Facebook page and/or block any user or account for any reason at all.
Our X (formerly Twitter) and LinkedIn accounts
We no longer have a corporate ‘X’ (formerly Twitter) account.
We maintain a corporate LinkedIn account in order to provide information and updates for members and other people and organisations who are interested in what we do.
The information and other content we publish is available to anyone who views the relevant account/page.
People may contact us via LinkedIn, but we specifically discourage members (and others) from sharing account or membership details where there is any risk that the information may be shown to others (for example through responding to a post).
We may refuse to allow questions, queries or comments to be published on our LinkedIn account/page, and we can remove or delete any content which we do not wish to be displayed and/or block any user or account for any reason at all.
Marketing
With your permission, we use your information so we can tell you about the services and products we offer in a more targeted and specific way, including offering you special deals or opportunities. You have the choice to receive information by any one or more of:
- email;
- text message;
- post;
- telephone; or
- through online advertising.
Or you can opt out of specific marketing activity altogether.
Where you have chosen to receive marketing information then you can update your marketing preferences via the member portal https://mymoney.bristolcreditunion.org/members/existingmember/, or by contacting us info@gwcu.org.uk.
Email marketing messages & subscriptionEmail marketing messages that we send may contain tracking beacons/tracked clickable links or similar server technologies in order to track subscriber activity within those messages. Where used, such marketing messages may record a range of data such as: times, dates, IP addresses, opens, clicks, forwards, geographic and demographic data. Such data (within its limitations) will show the activity each subscriber made for that email campaign.
Any email marketing messages we send are sent in accordance with the GDPR and the PECR. We provide you with an easy method to withdraw your consent (unsubscribe) or manage your preferences/the information we hold about you at any time.
See any marketing messages for instructions on how to unsubscribe or manage your preferences. You can also unsubscribe from email marketing, by updating your marketing preferences via the member portal https://mymoney.bristolcreditunion.org/members/existingmember/, or by contacting us info@gwcu.org.uk
Facebook - advertising
Facebook is a social media platform we use to communicate with our members and supporters through both unpaid posts and paid advertising. We use cookies to measure the effectiveness of paid advertising on Facebook to ensure the money we spend is used effectively. They also enable us to either particularly serve advertisements to, or exclude, people who have visited our website.
You can manage your preferences here: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen (please note that this is an external Facebook link and not to our own site, and therefore use is at your own risk).
Online targeted advertisements
Where you have specifically consented to online targeted advertising then we may use your data in order to provide you with relevant information through online services such as Google, Facebook, LinkedIn, X (formerly Twitter) and others.
We may upload information about you to online services in order to match your details with details that such services hold about you in order to perform such targeted online marketing.
We will only do this where we are assured that your information will be processed in accordance with this Privacy Policy and in accordance with our Data Protection Policy.
We do this because you have agreed that we can, and in order to make sure that you are aware of relevant marketing information and offers.
You may withdraw your consent at any time by contacting us or by updating your marketing preferences via the member portal https://mymoney.bristolcreditunion.org/members/existingmember/, or by contacting us info@gwcu.org.uk
You may sometimes see adverts online from GWCU without us having uploaded your details in order to show you these adverts. This is because we also carry out online advertising of our services, including targeting those adverts using the tools and services provided for us by our advertising partners, without using any GWCU data.
How we use sensitive information
Special category data and prisoner data
The law says that the following types of information should be regarded as special, and need to be treated with extra care:
Information on an individual’s race or ethnicity, religion, health, genetics, biometrics, political opinions, Trade Union membership, sex life or sexual orientation. We are also obliged to treat information on people’s criminal convictions, sentences or alleged criminal acts with extra care.
From time to time we may ask you to tell us about yourself including information which is special category data.
If we ask for this data then it is only for these purposes:
-
So that we can assess our services to make sure they are operating as we would like in meeting the needs of all of our communities;
-
So that we can provide information and insight to our partners, stakeholders, investors and funders.
Any special category data that we ask for will be stored separately from our other data, and will not be accessible to our operational teams. It will never be used to make operational, marketing or targeting decisions about any individual.
Where we supply special category data to others then we will only do that on a completely anonymised and summarised basis.
Providing this special category data will always be optional.
Trade Union Membership
Members of UNITE and Unison in the South West are entitled to become members of GWCU. Unite and Unison may provide a referral to us on your behalf in order to ask us to open an account for you, or you may apply directly to us for membership where membership of one of those unions is the sole qualification for membership that you meet.
Applying for membership on these grounds tells us you are a Trade Union Member and we note this solely to record that you are eligible to join GWCU. The information is not shared with anyone other than your Union and is never used to make any other decisions about you.
Disability
GWCU may use information about any disability you declare to us to comply with our legal obligations under the Disability Discrimination Act to make reasonable adjustments for disabled members, for example providing information in accessible formats, or ensuring wheelchair access to our premises or to other buildings where there are GWCU activities.
Health information
GWCU does not ask members for information about their physical or mental health or disability. However, members often provide us with this information, either by telling us they receive a particular state benefit (which might suggest or imply health information), or by telling us that health problems have changed their circumstances. This is especially relevant if they are having difficulty repaying their loans.
This information usually comes directly from members by telephone, in emails or letters or when they visit our premises; sometimes it comes at the request of the member from other organisations such as mental health workers, other financial organisations, local authorities, charities or others who refer members to us, or who act on your behalf to help support you in dealing with financial and other matters.
It may also be contained in letters and emails, including letters from creditors or letters about Individual Voluntary Arrangements, which we place on file.
We record this kind of information in the diary notes on our computer system where we record relevant data provided by members that GWCU does not routinely require. We do not collect and analyse this information systematically.
- We record information about your benefits to carry out our contract with you;
- We record if you tell us you have a support worker because of your physical or mental health so we can follow your instructions to operate your account or service your loans;
- If you ask us to record this information because you feel it is relevant to your relationship with GWCU we will do so to comply with our contract with you;
- We also record loan-related information because we have a legal duty to lend responsibly.
Offering Credit Union services to particular groups (health, disability, religion, race, ethnicity)
Sometimes partner organisations fund us to operate schemes aimed at helping particular groups improve their financial wellbeing. This could include those with physical or mental health challenges, with a disability or those from a particular racial group or ethnicity, such as refugees from a particular country. We administer programmes on behalf of partners who will refer individuals to us, having obtained their permission to do so. This referral could result in us being able to identify that the individual referred has a particular category of health or disability need, and/or that the individual is of a particular religion, race or ethnicity.
We record the relevant special category data solely to confirm eligibility to join the relevant programme. We do not use the information to make decisions about them and we do not share this information other than with the relevant funding partner.
Collecting special category data to measure our social impact
GWCU may sometimes ask members for special category data, including racial or ethnic origin so we can measure our social purpose or identify communities where we are underrepresented. No one will be required to give this information and deciding not to do so will not have any effect on the service we provide to any individual member.
If members choose to provide this information, we will never use it to make decisions about them. It will be collected only in line with GWCU’s Data Protection Policy and will be anonymised before it is shared outside GWCU.
Information on criminal convictions, sentences or alleged criminal acts
We offer a credit union savings account to some prisoners. We use their address and prisoner number to verify their identity so we can offer a proper service and so we do not confuse them with someone else with the same name, address or date of birth.
We cannot offer loans to prisoners.
Sometimes members also tell us that they cannot repay their loan because they or a family member has gone to prison, or a third party may get in touch with us in order to provide this information about them. The information could include details of the length of sentence. Where we receive this information then it will be recorded to help us agree the best way forward for them.
If we suspect you may be committing a crime
We have a legal obligation and moral duty to our members and staff to protect GWCU against criminal activity, including any financial or identity crime, violence or threatening behaviour, or the offence of coercive control.
If we suspect you may be committing a crime we will record any relevant information and share it with the relevant authorities (e.g. police, insurers, legal advisers, courts, government). This is to protect GWCU’s legitimate interests and, in certain circumstances, could be to protect individuals’ vital interests.
If you have committed fraud
We will record if you have ever committed fraud against us, and we may record other actual or alleged fraud that we find out about.
If you provide us with false and inaccurate information which we think may be fraudulent we will share this information with Credit Reference Agencies, Fraud Prevention Agencies and, if relevant, with the Police and other relevant law enforcement authorities
We use this information:
- to comply with the contract you made with us (including any loan agreement);
- to meet our legal obligations to report fraud, potential money laundering and the funding of terrorism;
- to protect GWCU from loss;
- to perform a task in the public interest.
We may also share this information with anyone else we think necessary.
Extra information that members or others provide about their personal circumstances, including some special category data
Members often ask us to record a change in their personal circumstances that affects their finances, especially their ability to make loan repayments. This information sometimes includes special category data or prisoner data and is often of a sensitive nature. It can include information on:
- relationship breakdown;
- being on benefits or having a change to benefits;
- job loss;
- loss of their home;
- a death in the family;
- being a refugee;
- being a vulnerable person; and
- other similar information.
Some members are also affected by others’ circumstances, for example, if their partner becomes ill, goes to prison or loses their job. If you ask us to record this information because you feel it is relevant to your relationship with GWCU we will do so to comply with our contract with you.
We record this information:
- because you have asked us to;
- because it helps us comply with our legal obligation to lend responsibly; and
- to further our social purpose of reducing social and financial exclusion.
If your personal circumstances affect your ability to repay your loan
If you tell us that personal circumstances affect your ability to repay your loan, GWCU will record the information you give us about this on your membership record. This enables us to help you decide the best way forward, which may include rescheduling loan repayments or entering into arrangements. We will try to help you get back on track with your loan repayments and maintain your credit score.
We do this because:
- you have asked us to;
- we have a legal duty to lend responsibly; and
- it is in the interests of our business and part of our social purpose to lend responsibly.
We will share information about the status of any loan account with Credit Reference Agencies, including where we have made an arrangement to reduce or suspend payments, but we do not share information about why we have agreed to make such arrangements.
We will share this information with Debt Recovery Agents acting on our behalf so that:
- they can treat you fairly;
- they can work with you to address any issues you may be having in maintaining your payments; and
- they can look after our business interest in ensuring that amounts owing are repaid so they can continue to benefit other members.
Sharing personal information with other people and organisations
Please note that “third parties” is another way of describing other people or other organisations.
Sharing information with others at your request or with your consent
If you ask us to or if you give consent we can share your information with others, including your advisers, anyone you appoint to represent you, or anyone you authorise to use or manage your account on your behalf.
Engage Card
We no longer open Engage prepaid card accounts on behalf of members, but where you have an account with them we may record, your account number. We do this in order to enable us to make payments to your card account at your request.
Where we have previously identified you as in need of particular support, or that you are or may be in a particularly vulnerable situation, we may share that information with Contis. We do this in order to help them to provide you with any additional support you may need and in order to fulfil our responsibility to ensure we treat you fairly.
We may also share information such as your member number and name with them if we ask them to close your card and account where you have not complied with the terms and conditions of an account with us (for example where we have issued a Default where you have not repaid a loan); where we suspect or have confirmed fraud; or where you have otherwise not abided by the membership conditions set out in the Rulebook. We do not share details with them about why we are asking them to close your account.
Sharing your information as part of an Employer Partnership
We work with some employers to offer you savings and loans through your payroll. We need to share your name and payroll reference with your employer to do this, and to tell them how much to deduct from your salary to be paid to your credit union account(s).
If you are part of an Employer Partner scheme, we do this because:
- you have asked to use this service and have therefore asked to enter into a contract with us;
- to fulfil our ongoing contract with you;
- to fulfil our contract with the partner organisation; and
- because it is our interests to make sure we have enough information to run the scheme properly
We sometimes run special loan schemes with some of our Employer Partners. If you apply for a loan under one of these special schemes which guarantees you will be accepted subject to some basic checks then we check your salary band with your employer, and your employer may make special separate deductions for these loans. We do this in order to provide you with the service that you have requested.
Please note that this does not apply to our ‘standard’ Employer Partner loan product and interest rates, where we do not share information about any loan(s) with your employer.
Sharing your information with our other partner organisationsWe work together with various partner organisations, including local and national government, local employers and various charitable and third sector groups to offer a credit union service to some of the community groups and/or clients they employ, represent or serve. This is in line with our social purpose.
Partner organisations share information with us to:
- enable us to offer savings and loans to their clients/members/service users;
- ensure that the right potential beneficiaries are able to benefit from special programmes;
- claim housing benefit and pay landlords on behalf of clients/members/service users; and
- to help us provide any other service requested through them.
We share information with partner organisations including information about transactions, ongoing member status and contact details in order to:
- enable them to monitor the service we are providing to their clients/members/service users;
- enable them to provide further support to their clients/members/service users;
- so that they can further assist us in providing a good service to their clients/members/service users under particular programme(s); and
- where they can help us to regain contact with a member with whom we have lost contact, particularly where there might be an outstanding amount owing to us from a loan made under a particular scheme or programme we operate on their behalf.
We share information reciprocally because:
- The members have asked to join this particular GWCU programme and we are fulfilling our contract with them;
- To fulfil our contract with the partner organisation; and
- Because it is in the legitimate interests of our business, including our social purpose.
Consolidation Loan Pilot
Where we have offered you a consolidation loan as part of a consolidation loan pilot project, we may collect and share some information as part of that pilot with an organisation called Fair4All Finance Limited (“Fair4All”). We are working together with Fair4All to run the consolidation loan pilot, and to see whether consolidation loans can help people to improve their financial position. In particular, we may collect the following information and share it with Fair4All on an aggregated and anonymised basis:
-
information to see if particular people are eligible for a consolidation loan. This will help us understand the which groups of people are and aren’t eligible and to make changes accordingly to try and help as many people as possible. We may also use this data for case studies to demonstrate the wider value of the pilot, and to improve future pilots and other services;
-
demographic data (including information relating to age, background (including ethnic origins), gender, disability, housing type, education level, work experience, and caring responsibilities) to help us understand how the pilot is working overall, who it is reaching, and if there are any groups of people we are not reaching who may benefit from consolidation loans;
-
certain information in the course of tracking, monitoring and analysing how people repay their loans, to understand the potential benefits of consolidation loans for people in different situations, to identify common obstacles and to develop products that may be helpful to members or other people;
-
information about people’s financial circumstances after they have repaid their loan (for example any changes to their credit score) to assess how effective the pilot is in the long run;
-
information that people provide to us as part of any surveys that we or Fair4All ask them to complete at different stages of the loan process.
We will only share this information with Fair4All on an aggregated and anonymised basis, meaning that Fair4All will not be able to identify you from the data that we send them – we are sharing the data so that we and Fair4All can understand if the pilot is working, how we can make it better, and how we can help more people in the future.
We and Fair4All may also share this aggregated data with:
-
Evaluation partners who will conduct evaluation work to understand if the pilot is working;
-
Data analytic specialist organisations to help us analyse the pilot’s performance;
-
Contractors, suppliers, or other third parties that provide services on our behalf;
-
Other technology providers that we might work with to develop and/or improve direct settlement technology and/or who GWCU may work with to provide more consolidation loans more broadly;
-
A third party as part of a sale, merger or acquisition involving GWCU or Fair4All, or other transfer of all or part of our or Fair4All’s assets including as part of a bankruptcy proceeding;
-
Pursuant to a subpoena, court order, or other legal process or as otherwise required or requested by law, regulation, or government authority programs, or to protect our rights, Fair4All’s rights or the rights or safety of third parties;
-
Professional advisors, lawyers, accountants and auditors; or
-
With your consent or as otherwise disclosed at the time of data collection or sharing.
We and Fair4All are ‘joint controllers’ of the information described above – this means that we are jointly responsible for deciding what should be collected and used to enable us to better understand how the consolidation loan pilot is working and how we can improve it, and for keeping your information safe accordingly. In order to collect and use this information, we will typically rely on the legal reason that:
-
this is in our (both GWCU’s and Fair4All’s) legitimate interests, that is our interests in being able to provide consolidation loans and understand how they are working; or
-
in the case of survey results – that we have your consent (please note that you can always choose not to respond to surveys on consolidation loans, or – if you do respond – to provide as much or little information as you would like),
To the extent that we collect special category data (for example data relating to race, ethnicity or disability ) we do so on the basis that this is necessary for equality of opportunities monitoring and improvement (unless we are obtaining the information from you as part of a survey, in which case we rely on your consent).
If you have any questions about our arrangement with Fair4All or wish to exercise any of your rights in relation to the data that we process as joint controllers (see below, “Your rights in relation to data”), you can contact us at info@gwcu.org.uk.
As well as the information set out above, we at GWCU will also collect certain information about you to enable us to provide you with and manage your consolidation loan – we won’t share this information with Fair4All, (but may share this information as set out elsewhere in this section on “Sharing personal information with other people and organisations”) and will handle it in accordance with other parts of this Policy (“Information used to apply for a loan or to manage a loan”). We may also share your information with other lenders participating in the consolidation loan pilot or other pilots funded by Fair4All in the event that there is any indication that you have applied for other Fair4All funded pilots for example No Interest Loans or other pilot schemes.
Credit Reference Agencies
We share information with Credit Reference Agencies in connection with opening account(s) and verifying identity, and in connection with making and administering loans (including where loans are not being repaid in accordance with the original agreement, or are in Default).
Further information about this is set out above in the relevant parts of this Privacy Notice (“Information used to join GWCU and open a Savings Account” and “Information used to apply for a loan or to manage a loan”).
You can find out more about how Credit Reference Agencies use and share personal data through the Credit Reference Agency Information Notice which can be found at https://www.equifax.co.uk/privacy-hub/crain.
Fraud Prevention Agencies
We share information with Fraud Prevention Agencies when you apply to join, for an account or for a loan so that we can prevent and detect fraud and prevent money laundering.
Further information about this is set out above in the relevant parts of this Privacy Notice.
The main Fraud Prevention Agency we work with is CIFAS. You can find more information about them here: https://www.cifas.org.uk/about-cifas/what-is-cifas.
Debt Recovery Agencies
We share information with Debt Recovery Agencies in order to assist where members have missed one or more payments on their loan(s) with us, and in some circumstances to recover money owed to us where a loan is in Default.
Full details are set out above in the section headed “Information used to apply for a loan or to manage a loan”.
Our Regulators
We are regulated by the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) and have a legal obligation to share any information (including personal information) with them so they can make sure we are running the credit union properly, and in order for them to meet their regulatory objectives including protection for consumers and ensuring the overall integrity of the financial system.
The UK Financial Services Compensation Scheme
This is statutory scheme compensates people if their credit union cannot meet its obligations. We are obliged to make regular reports to them to comply with our legal obligations and to carry out our contract with you.
If requested by them (including to test our and their systems) we share your contact information and details of any account(s) held with us that are eligible for protection under the Financial Services Compensation Scheme in order to ensure that you can receive compensation you are due.
The Police and other Law Enforcement Agencies
We may on occasion need to share your information with the police or other law enforcement agencies including:
- the Serious Fraud Office;
- HMRC; and
- the National Crime Agency
for the prevention and detection of crime and the apprehension and prosecution of offenders. This is never done on a blanket basis.
We only do this:
- in specific circumstances;
- after careful consideration and, if necessary, advice; and
- in line with our Data Protection Policy.
We use personal information in this way:
- to fulfil our legal and regulatory obligations to report and prevent crime, including the Fraud Act, the Theft Act, the Criminal Justice Act and the Police and Criminal Evidence Act;
- when we need to safeguard the welfare of our staff, members, volunteers and others;
- to protect our property;
- when it is in our legitimate interests to protect GWCU from loss.
The Government
We share information with various government departments, including:
The UK Tax Authorities (HMRC)
We are obliged to share information with HM Revenue and Customs for the assessment and collection of tax. We also accept payment of child tax credits and child benefit from HMRC on behalf of our members. In some cases of fraud we are also legally obliged to share information with HMRC.
The National Crime Agency
We are legally obliged to report suspected money laundering or suspicious transactions to the National Crime Agency.
The Department of Work and Pensions (DWP)
We accept payments from the DWP of several benefits, including Employment Support Allowance, Jobseeker’s Allowance, Personal Independence Payments, the State Pension and Universal Credit.
The Health and Safety Executive (HSE)
We may need to share information about you with the Health and Safety Executive if there is a health and safety issue at our premises, the AGM, the Members’ Forum, or at another GWCU event.
Local Authorities
We receive Housing Benefit from local councils on behalf of our members. With consent, we can pay it directly to landlords on our members’ behalf.
Bristol City Council and Bath and North East Somerset Council, Dorset Council and Dorchester Town Council are payroll partners with GWCU.
Councils sometimes fund us to operate partnership programmes to offer some credit union services to particular community groups.
We use this information:
- with specific consent;
- to comply with a contract between GWCU and a member;
- to comply with a contract with the relevant local council; and
- to further our business interest in the social purpose of financial and social inclusion.
We may sometimes need to share information about you with our legal advisers, our insurers or the Courts. This includes allowing us to:
- to obtain advice;
- defend ourselves against a claim;
- defend GWCU in court;
- safeguard the health and welfare of our staff;
- protect our property;
- protect our reputation;
- take you or others to court.
We use this information:
- to allow us to run our business
- to comply with a contract with you
- to fulfil our legal obligations, including those on reporting and preventing crime
Our Insurers
We may have to share information about you with an insurance company:
- if you make a claim against us
- if someone else makes a claim against us and you are involved in some way, or
- if there is an incident at our premises, the members Forum, the AGM, or any other GWCU event.
Consultants, experts and other advisers
We use consultants, experts and other advisers to help GWCU carry out its legal obligations and to help run the organisation to a high standard. This includes our accountants and our external auditors.
We share information with them if they need it for their work. This is covered by contract or confidentiality agreements.
We use this information for this purpose:
- to meet our regulatory and legal obligations (for example our legal obligation under the Credit Union Act 1979 to have our accounts audited);
- to enable to us to run our business and improve our services; and
- to be able to comply with our contract to offer you a full credit union service.
Contractors
We are a very small organisation so we sometimes use contractors to do work we cannot do in-house to help us run GWCU to a high standard.
This includes IT consultants, who maintain the security and reliability our IT systems. They might access your information when doing this, or when checking the security of our IT network.
We also use marketing and other consultants to help us develop products and services suitable for our members.
We share personal information with contractors only if they need it for their work, which is covered by contract or confidentiality agreements. When we do this we will use appropriate technology to ensure the information is secure.
We use information for this purpose:
- to meet any other of our regulatory and legal;
- to enable to us to run our business and improve our services; and
- to be able to comply with our contract to offer you a full credit union service.
Our Funders and Investors
We may collect some information to be able to demonstrate to partners or funders that we are achieving a social purpose. This will be provided to them on an anonymised basis. Most information will be of an aggregated, statistical nature but we may also share stories provided to us by members that illustrate the social impact that we have delivered for them. We will only share stories like this with specific permission.
Any other data will only be shared with the express permission of the CEO and in line with GWCU’s Data Protection Policy.
CCTV
We use CCTV at our premises to ensure the safety of our staff and members and protect our property, including the prevention and detection of fraud and other crime. There are no cameras in private areas such as toilets.
Network Security
GWCU uses administrative, technical and physical security controls to protect your information. We may use your information when testing whether our network and electronic records are secure. It is part of our contract with you and in GWCU’s legitimate interests to make sure our IT can keep your money safe.
Sending information to other countries within and outside the European Economic Area (EEA)
Countries within the EU plus Iceland, Liechtenstein and Norway (the EEA), have data protection rules that are give you the same legal rights and protections as those of the UK. If we, or those we share your information with, send your information outside the EEA we will take all reasonable steps to ensure that handling of your information meets UK standards, including imposing contractual obligations on the recipients of that data and requiring recipients to subscribe to ‘international frameworks’ intended to secure data sharing.
Research and statistics
We may use information about you for statistical purposes. If we share or publish this information we always anonymise it first.
We use this information to:
- better understand our members;
- to see whether we are successfully carrying out a social purpose;
- decide which products we offer are successful; and
- to explain to grant-awarding bodies or potential investors the social impact we have.
GWCU’s legal reasons for using your information
The law allows us to use your personal information as long as we have at least one legal basis for doing so.
Our legal bases are:
To fulfil a contract with you or to take steps if you have asked to enter into a contract with us:
Becoming a member of GWCU, or applying for or taking out a loan with GWCU creates a contract between you and us, agreeing
- that GWCU:
- will provide you with member services and a savings account and (if your apply) assess any application you may make for a loan
- will administer your account, any loans and financial products with efficiency, fairness and transparency
- will make sure you have the information you need to be able to take part fully in your credit union membership, including in its democratic processes
- will take the relevant steps to keep your information and finances safe and secure and ensure our processes are secure and robust
- will uphold your legal rights and freedoms
- is entitled to take action:
- to recover loan repayments
- to prevent crime
- to protect its legitimate interests
- will ensure that you are provided with information and news about your credit union’s ongoing development
- will ensure that you are provided with any information that you need to have as a legal or regulatory requirement
- will issue you with an invitation to the Annual General Meeting and any other General Meeting(s) in accordance with the Rulebook
2. that you:
- will always give us all the honest, accurate and relevant information we need to carry out these duties
- will tell us if your details or circumstances change
- will repay any money you borrow as agreed in any loan agreements you sign
- will take part as much as you are able, and wish to, in the ongoing development of your credit union, including taking part in its democratic processes
- will read any legal or regulatory information that you are provided with
- will let us know if you need any particular support that we may be able to provide in order for you to utilise fully your credit union membership and account(s).
To fulfil a contract with someone else:
This could include:
A contract with our partner organisations, if you are party to this contract.
When it is our legal or regulatory duty
GWCU has many legal duties and regulatory responsibilities, including the following:
Our regulatory duty to lend responsibly
Our regulators, the Financial Conduct Authority and the Prudential Regulatory Authority, require us to lend responsibly, without having an adverse impact on an individual’s financial situation or financial wellbeing. This duty obliges us to make sure we have enough information to be able to make a full assessment, including using Credit Reference Agencies if this is appropriate.
We also need to monitor and report on the outcomes that we deliver for our members to meet our ‘Consumer Duty’ obligations,
Reporting to our regulators
The Financial Conduct Authority (FCA) and the Prudential Regulatory Authority (PRA) regulate our services to make sure the financial products we sell are suitable for the people we are selling them to. They require us to share information with them, some of which may be personal information.
We have a legal duty to report to the FCA and the PRA any information they might reasonably expect to have. This is called a Section 11 general notification requirement. This could include sharing your information in the case of fraud, money laundering, or when we need to supply it for any another lawful purpose.
Reporting Money Laundering
We are obliged to report suspected money laundering to the National Crime Agency under the Proceeds of Crime Act 2002 and the Terrorism Act 2000.
Reporting Fraud
Because we are authorised under the Financial Services and Markets Act 2000 we have a legal duty to report fraud to the police or other relevant law enforcement authority. We also have similar responsibilities under the Proceeds of Crime Act 2002 and the Terrorism Act 2000. We are also obliged to report fraud to our regulators the FCA under our Section 11 general notification requirements. This means we have to take steps to check the information our members give us, including information about their identity and whereabouts, are accurate, true and not fraudulent.
Obligation to comply with the Disability Discrimination Act
We have legal obligations to comply with the Disability Discrimination Act which may sometimes mean that we are required to share information in order to enable us to meet our legal duties.
Obligation to share information with other third parties
We have legal obligations to share information with some external organisations, such as HM Revenue and Customs, the Department of Work and Pensions, the Health and Safety Executive, the UK Financial Services Compensation Scheme, the Information Commissioner’s Office, and law enforcement and fraud prevention agencies.
When we have a legitimate business reason (legitimate interest)
This means we are allowed to use your information to run our business, unless your fundamental rights and freedoms override our interests.
We have a number of legitimate business reasons to process your data, including:
- Being able to run our Credit Union business efficiently and make it sustainable
- Being able to grow our business and market and sell our products and services
- Being able to lend responsibly
This may include:
- verifying the identity, age and address of all our members
- checking whether what they have told us is accurate and true
- confirming whether someone is eligible to join GWCU and any of the relevant partnership programmes it operates
- assessing whether loan applicants can afford their loan repayments, including:
- whether they have other outstanding debts
- whether they are managing their finances sufficiently
- Avoiding loss to our members and GWCU, including recovering outstanding loan payments so we can help as many members as possible
- Preventing Crime against GWCU, our staff, our members and others
We screen applications and accounts to avoid loss to our members and to GWCU to stop criminals from, among other things:
- using false identities for criminal purposes
- hiding the proceeds of crime
- committing identity theft
- committing fraud
- funding terrorism
- laundering money
- Safeguarding the welfare of our staff, members and volunteers and keeping our premises and property secure
- We use CCTV at our premises
- We tell the police of threatening or abusive behaviour against our staff, volunteers, members and others
- We share information with the relevant authorities if we suspect a crime is being committed
- Protecting our reputation
We may use information to defend legal and insurance claims or in court or to take action to protect ourselves.
- Making sure our systems, including our computer systems, are resilient and secure
- Undertake system testing and development to help us improve our services - This can include using third-party companies to try to access data in order to make sure that our systems are robust and secure, and using data in order to test that our systems will still work as intended when we make changes to them.
- Attracting funding and investment to make GWCU’s future more sustainable
- Carrying out statistical and other analysis to develop and improve our services and products
- Achieving our social purpose of improving our members’ financial wellbeing, financial and social inclusion, financial education and supporting our local community.
This may include:
- partnering with other organisations to offer a service to the groups they serve, employ or represent
- offering services to those who might previously have been financially excluded
- helping people get their finances back on track
- helping people improve their credit score
- helping children and young people learn good financial habits
- working to benefit the local community
Protecting someone’s vital interests
We may share your personal information with other organisations if your life, health or personal safety or that of someone else, is seriously threatened and we either cannot obtain consent or would reveal the investigation of a crime by asking for it. GWCU will only rely on this legal basis for using personal information
- very rarely
- after careful consideration
- if the circumstances are very serious or it is an emergency
- on a case-by-case basis.
Examples might include if someone is taken ill on our premises and is not able to share their information with the ambulance service or other medical help, or if a child is missing and we have information that might help locate them.
Public Task
We are allowed to use personal data to carry out a task that is in the public interest. At GWCU this includes using (and in particular, sharing) personal information to prevent, detect or prosecute fraud, crime, terrorism or financial loss.
Your rights in relation to data
The law sets out a number of rights you have about how we use your data which may apply in different circumstances depending on the legal basis we have for holding and processing that data.
The right to access your personal data
You have the right to request access to the personal data we hold about you (sometimes known as a subject access request). Please note that in some circumstances we may need to ask you to verify your identity (for example by providing us with some ID) to ensure that it really is you asking for your data (and that we are providing data to the right person).
The right to correct your personal data
You have the right to have your personal data rectified if it is incorrect. If you feel that any information that we hold about you is inaccurate or out of date, please let us know by contacting us at info@gwcu.org.uk.
The right to delete personal data
In some circumstances, you have the right to request that we delete your personal data (this is sometimes known as the ‘right to erasure’. Those circumstances are:
-
where we no longer need to process of your data (in light of the purpose that we collected/processed that data for);
-
where we have relied on your consent to process your data and you withdraw that consent (see below);
-
where you object to our processing of your data (see below) and we don’t have an overriding legitimate interest to process that data;
-
where processing is unlawful.
The right to restrict processing
In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are:
- you contest the accuracy of the personal data;
- processing is unlawful but you oppose erasure;
- we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and
- you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data.
- with your consent;
- for the establishment, exercise or defence of legal claims; or for the protection of the rights of another natural or legal person.
We will only otherwise process it:
- with your consent;
- for the establishment, exercise or defence of legal claims; or for the protection of the rights of another natural or legal person.
The right to object to processing
You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the data is necessary for the purposes of the legitimate interests pursued by us or by a third party.
If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.
The right of data portability
In some circumstances, you have the right to request that we provide certain data to you in a structured, commonly used and machine readable format and/or that we transmit your data to another controller. Please note that this right only applies where we are processing your data on the basis of your consent or to fulfil a contract and where we are carrying out the processing by automated means (in other words, the right does not apply to paper files).
Rights related to automatic processing
We may use automated processes for processing members’ loan or membership applications to make sure that our decisions are quick, fair, efficient, and correct based on what we know. If we use fully automated decision processes then you have the right to have the decision reviewed by a member of staff, express your point of view, and obtain an explanation of the decision and challenge it.
Right to withdraw consent
To the extent that the legal basis for our processing of your personal information is your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
The right to complain to the Information Commissioner’s Office
If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with the Information Commissioner’s Office which is responsible for data protection in the UK. You can contact them by:
Going to their website at: https://ico.org.uk
Phone on 0303 123 1113
Post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Changes and updates to this Privacy Notice
We are continuously working to be as clear and transparent as we possibly can be about how we collect and process your personal information.
This means that we will make changes to this Privacy Notice from time to time. These changes will usually be because:
- we have changed the way we do something, and need to update the Notice to reflect that change;
- a partner or external body has changed something and we need to update the Notice to reflect that change;
- the law or a regulatory requirement has changed;
- we review the Notice and find areas where we can improve clarity and transparency;
- we receive questions or comments from members or others which suggest we haven’t been as clear or transparent as we would like to be, or which otherwise suggest changes and improvements; and/or
- they help to ensure that we can continue to meet our obligations to our members collectively, and to fulfil our social purpose.
If you identify an area of this Privacy Notice which is not clear, or which gives rise to further questions then do please let us know so we can see what changes and improvements we may be able to make to it, as well as answering your questions.
Privacy Policy last updated: 19/08/2024