WO Funding Limited

PRIVACY DECLARATION

The data controller in respect of your personal data is WO Funding Limited (referred to as "we", "our" or "us" in this Privacy Declaration). If you have any queries about our handling of your information, you can contact our Data Protection Officer by writing to 129 Marston Road, Stafford, Staffordshire, ST16 3BT or by telephone on 01785 241537.

This Privacy Declaration explains how we will use the personal data that you provide to us via your intermediary or that we have obtained about you through our use of the personal data you have provided (referred to in this Privacy Declaration as your "information") when you enter into a loan agreement with us. Please read this Privacy Declaration carefully.

Where we refer to "intermediary" in this Privacy Declaration, this means the dealership that has contacted us on your behalf regarding a loan.

Where we refer to "Group" in this Privacy Declaration, this means any company within the WO Funding Limited's group of companies or any person that is a joint venture partner with any of those companies.

DATA PROTECTION LAW

From 25 May 2018, data protection law is changing – the new law is called the General Data Protection Regulation or GDPR for short. From this date, you will have additional rights (and we will have additional obligations) in respect of your personal information. This Privacy Declaration (under the "Your Rights" section) sets out the rights you will have when the GDPR comes into force.

If we propose to enter into an agreement with you, it is a condition of you being assessed for that purpose for you to provide us with the personal information that we request from you (or from the intermediary who introduces you to us) which it is necessary for us to have for the purpose of entering into the agreement with you, administering the agreement and for the purposes described below. If you fail to provide us with the information we request from you, we will not be able to proceed with the checks that we need to perform to enter into the agreement (described below) and, consequently, we will not enter into the agreement with you.

HOW WE USE YOUR INFORMATION

(A) Before We Enter Into an Agreement with You

Purpose

Before we provide a loan to you, we undertake checks for the purposes of preventing fraud and money laundering, to verify your identity and to assess whether you are sufficiently likely to repay amounts which you would owe to us if we were to enter into an agreement with you. These checks require us to process personal data about you (for example, name, nationality, visa, address, date of birth, contact details, employment details, bank details, credit/debit card details, monthly rent or mortgage payments, passport, driving information, utility bills and monthly income you receive other than salary) which you have provided, we have collected from you or we have received from third parties. This personal data will be used to prevent fraud and money laundering, to allow us to assess the credit risk of entering into an agreement with you and to verify your identity. Further information about the role of credit reference agencies ("CRAs") when you apply for a loan is set out at (C) below.

Lawful basis of processing

We process your personal data on the basis that we have a legitimate interest and a legal obligation in preventing fraud and money laundering, to verify your identity, in order to protect our business, to assess the credit risk of entering into an agreement with you and to comply with laws that apply to us. Such processing is also a contractual requirement of the loan you have requested.

(B) Administration

Purpose

Our main use of your information is to administer your agreement with us. We will use your information to process payments, notify you of any late or overdue payments and to contact you regarding any other matter relating to your agreement.

Lawful basis of processing

The use of your information in this way is necessary for the performance of the agreement with you and, initially, to take steps to enter into the agreement with you.

(C) Credit Referencing and Fraud Prevention

Purpose

In order to process your application, we will perform credit and identity checks on you with one or more CRAs. When processing your personal data, decisions about your application will be made by automated means. We will use a scoring matrix (or other automated process) to assess your application and may automatically decide that we consider your credit risk to be too high or that you pose a fraud or money laundering risk if our processing reveals your behaviour to be similar to that of fraudsters or money launderers. You have rights in relation to automated decision making: if you want to know more please contact us using the details set out at the start of this Privacy Declaration.

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• Assess your creditworthiness and whether you can afford to take the loan;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us it will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.callcredit.co.uk/crain or www.experian.co.uk/crain.

Lawful basis of processing

This is necessary for the purposes of our legal obligations in establishing any risks in entering into an agreement with you and any risks throughout the agreement and to prevent, detect and prosecute fraud and other crimes.

Use of your information in this way is also necessary for the purposes of our legitimate interests in recovering any debt owed to us and detecting and preventing fraud. We currently obtain information from Callcredit and Experian (relating to the 'credit search') and we currently pass information about you to Callcredit and Experian.

(D) Introducers, Agents and Other Third Parties

Purpose

We may pass your information to companies within our Group, who may use and update your information to assess lending risks, to recover debts, to prevent, detect and prosecute fraud and other crimes, and to manage our and any member of our Group's relationship with you.

Lawful basis of processing

This is necessary for the purposes of our legitimate interests in establishing any risks in entering into an agreement with you and any risks throughout the agreement, the ability for us to recover any debt owed to us by you and for the administration of the agreement with you. The Group also has legal obligations that it must comply with (such as to report fraud).

Purpose

Sometimes we need to give information to the intermediaries who introduce you to us for the following purposes:

• to enable the relevant intermediary to deal with complaints made by you;
• to coordinate responses to requests made by you relating to you rights under the GDPR;
• to effect the exercise of any rights that you have under applicable laws and regulations.

Lawful basis of processing

This is necessary for the purposes of our legitimate interests in order to protect our business and to comply with relevant data protection laws that apply to us.

Purpose

If we become entitled to terminate any agreement we have with you, we may pass your information to a debt collection agency in connection with recovery of monies due on your agreement.

Lawful basis of processing

Use of your information in this way is necessary for the purposes of our legitimate interests in recovering any debt owed to us.

Purpose

We will share your information with other organisations if we sell or buy any business or assets (as we will share your data with the prospective seller or buyer), or if we or substantially all of our company assets are acquired by another party, in which case your information will be one of the transferred assets.

Lawful basis of processing

This is necessary for the purposes of our legitimate interests to ensure that we or our business remains commercially viable.

Purpose

We will share your information with direct debit and card processing companies. We also share your information with third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services.

Lawful basis of processing

This is necessary for the performance of the agreement with you and, initially, to take steps to enter into the agreement with you.

(E) Call Recording

Purpose

We will record phone conversations with our customers.

Lawful basis of processing

This is necessary for the purposes of our legitimate interests to enable us to properly resolve complaints, to improve our service standards and for staff training purposes.

(F) Analytics

Purpose

We use analytics tools on our website that are provided to us by third parties acting on our behalf; we will ensure that your information is secure and protected in accordance with our obligations under data protection law.

Lawful basis of processing

We use your information in this way as it is necessary for our legitimate interests in (i) detecting fraud by understanding behaviours and patterns that correlate to committing fraud; and (ii) understanding the customer journey so that we can understand your needs and provide a better service to you, and to help us develop and improve our products and services.

These tools may process some of your personal data by converting it into statistical or aggregated data.

MARKETING PREFERENCES

You can change the marketing preferences that you have selected at any time – please call WO Funding Limited on 01785 241537.

RETENTION OF YOUR INFORMATION

If your application for a loan is declined or if your application is accepted but you do not proceed, we keep your information for 12 months. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed (whether settled by you or upon default).

Information that we provide to credit reference agencies remains on their file for 6 years after any loan agreement with us is closed. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

We may hold your information for a longer or shorter period from that described above where:

• the law requires us to hold your personal information for a longer period, or delete it sooner;
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and
• in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.

LOCATION OF YOUR INFORMATION

The information that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the processing of your payment details and the provision of support services. Where adequate protections for your information do not exist under the applicable laws of that third country, we (or the party transferring your information) will take necessary steps to ensure that appropriate safeguards are put in place to maintain the same levels of protection as are needed under UK data protection legislation. Safeguards include imposing contractual obligations on the recipient of your information or subscription to 'international frameworks' that ensure adequate protection (for example, the EU-US Privacy Shield for transfers to the US). Please contact us for more information about the protections that are in place.

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to 'international frameworks' intended to enable secure data sharing.

By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Declaration.

YOUR RIGHTS

Under the Data Protection Act 1998 you have certain rights including the right of access to your personal data. We may charge a fee of £10 for this service. If anything is inaccurate or incorrect, please let us know and we will correct it.

From 25 May 2018 (when the GDPR comes into force in the UK), you have certain rights in relation to your information. From this date, you will have the right to (i) be informed about how your information will be used (at no cost to you), (ii) ask us to restrict processing, (iii) if it is technically feasible, transmit your information from our systems to a third party’s system in a safe and secure way, (iv) object to our use of your information where we are using it for the purposes of our legitimate interests as described in this agreement, (v) not to be subject to a decision when is it based on automated processing and it produces a legal effect or a similarly significant effect on you and if it does then you have the right to request a human intervention – please contact us using the contact details below for more information about exercising this right (vi) access your information at no cost (unless your request is unfounded or unreasonable), (vii) if your information is inaccurate or incomplete, then you can ask us to have it rectified, (viii) in certain circumstances, you have the right to ask us to delete your personal information. For more information or to exercise your data protection rights, please contact us using the contact details above.

CUSTOMER COMPLAINTS

You have the right to lodge a complaint with the Information Commissioner's Office where your data has or is being used in a way that you believe does not comply with data protection laws. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.

CHANGES TO THIS PRIVACY DECLARATION

We may make changes to this Privacy Declaration at any time by sending you an e-mail or letter with the modified terms or by posting a copy of them on our website. Any changes will take effect 7 days after the date of our e-mail or letter or the date on which we post the modified terms on our website, whichever is the earlier. Your continued use of the website after that period expires means that you agree to be bound by the modified policy.