Peregrine Asset Finance Limited (Company Number 4208223 and ICO registration number Z7989599)
3 Maple House, Wykeham Road, Northminster Business Park, Upper Poppleton, York, North Yorkshire YO26 6QW
Peregrine Asset Finance Ltd is authorised and regulated by the Financial Conduct Authority. Registered No. FRN649227. Peregrine Finance is a broker not a lender it offers financial facilities to UK businesses only through a number of authorised funders, a list of which is available on request.
Telephone: 01904 405299
Legitimate interests is mentioned in our privacy notice because data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Those laws call this the ‘legitimate interests’ legal reason for processing personal information.
Personal information means information that is about you or from which we can identify you.
Process or processing includes everything we do with your personal information from its collection, through to its destruction or deletion when we no
longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting,
destroying and transferring it overseas. In this privacy notice we use “process”, “hold” and various other terms to mean the same thing – Processing.
Privacy notices of Fraud Prevention Agencies and Credit Reference Agencies
You will see within this privacy notice that we mention the privacy notices of Fraud Prevention Agencies and Credit Reference Agencies. We are required to inform you of these notices. Please read them carefully and contact those organisations if you have questions about their notices.
Why we process your personal information and what is the legal basis for this
(including when we share it with others)?
We may use the personal information which we hold about you for the following legal reason (for some processing more than one legal reason may be relevant except where we rely on your consent):
Performance of contract
We will process your personal information when that information is necessary to perform our contract with you or for taking steps prior to entering into the contract with us (but where the party to the contract is a corporate or business, this legal basis for processing personal data regarding any individual named or associated will not apply). We will do this for providing you with the product applied for and servicing that product during the life of the relationship. This could include:
• notifying you about either important changes to the features and operation of the product.
• responding to your enquiries and complaints.
• updating, consolidating, and improving the accuracy of our records.
• arrears and debt recovery activities on behalf of our lenders.
• sharing your personal information with payment services providers (this means a firm providing and maintaining a payment account) such as when you ask us to share information about your account with them.
We will process your personal information when it is necessary to comply with our legal obligations including:
• checking your identity (this means you as an individual and/or you as a person associated with a corporate entity who is our customer – as relevant), anti-money laundering checks and checks with Fraud Prevention Agencies pre-application, at the application stage, and periodically after that.
• crime detection, prevention, and prosecution.
• regulatory reporting.
• when required by law and for compliance with laws that apply to us.
• to process information about a crime or offence, and proceedings related to these (in practice this will be relevant if we know or suspect fraud).
• when we share your personal information with other people and organisations including:
a. your guarantor (if you have one), joint account holders and any person with power of attorney over your affairs (in each case only if relevant to you).
b. other payment service providers such as when you ask us to share information about your account with them;
c. Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Financial Ombudsman Service, the European Commission Online Dispute Resolution, the Information Commissioner’s Office and under the Financial Services Compensation Scheme (in cases where we are under a legal compulsion to provide the personal information);
d. Courts and to other organisations where that is necessary for the administration of justice.
We will process your personal information where we consider that it is, on balance, when having considered your rights and freedoms, appropriate for us to do so for the following legitimate interests (for ourselves our lenders and in some cases other organisations as listed below):
• processing personal information about you as an individual and you as a person associated with a corporate entity (or its subsidiaries) who is our customer – as relevant. For example, a signatory, director, trustee, >25% shareholder, controller or where you hold Power of Attorney for a customer.
• testing new systems and checking upgrades to existing systems.
• portfolio modelling, statistical and trend analysis, with the aim of developing and improving products and services or modelling the risk profile of the bank.
• to adhere to guidance and best practice under the regimes of governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Financial Ombudsman Service, the European Commission Online Dispute Resolution, the Information Commissioner’s Office and under the Financial Services Compensation Scheme.
• to carry out searches at Credit Reference Agencies (CRAs) pre-application, at the application stage, and periodically after that.
• administering and managing your account and services relating to it.
• to communicate with you about our products and services which we believe might relevant to you, because of similar products and services you have had (or applied to have ) with us in the past. If you do not want to receive communications from us, you can withdraw your consent at any time by ticking the box on the form we use to collect your data , by emailing email@example.com or by writing to us at the address detailed above.
• for all the Profiling that we do (see below for further information on Profiling).
• processing your information where you provide us with a CV in relation to a vacancy you have applied for or where you are submitting a CV with a view to future opportunities.
• when we share your personal information with other people and organisations including.
a. your guarantor (if you have one), joint account holders and any person with power of attorney over your affairs (in each case only if relevant to you).
b. other payment service providers such as when you ask us to share information about your account with them.
c. the broker or other intermediary who introduced you to us (if you have one).
d. our legal and professional advisers, auditors and actuaries; Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme (in cases where we are not under a legal compulsion to provide the personal information but where we consider this necessary for legitimate interests).
e. other organisations and businesses who provide services to us such as debt recovery agencies, field agents, solicitors and suppliers of back office/servicing functions or IT services.
f. buyers and their professional representatives as part of any restructuring or sale of our business or assets.
g. CRAs and other lenders who also hold or seek to hold a charge on any property on which we hold security; and
h. Providing feedback to recruitment agencies, head hunters and other agencies on the suitability of your CV or on any interview undertaken.
Your personal information may be also used for other purposes for which you have given your explicit consent, including:
• Sharing with another party – If requested by you.
• Special categories of personal information – this means information about your health. We take the wellbeing of our customers seriously. Therefore, where applicable to the product you hold with us, we may hold information on your health in order to service the agreement appropriately. In such cases we will explain why the information is needed and ask you to provide your consent to it being processed where this is needed. However, please note that sometimes there may be reasons of public interest or law which enable us to use this information without consent.
• Criminal convictions - We may store information about any criminal convictions you may have had as part of our credit risk assessment process. There may also be reasons of public interest or law which enable us to use this information without consent.
Source of information
If you are applying directly to us, the information stored by us will have been received directly from you either electronically or in paper form. This includes any information supplied for any joint applicant or associate for which you have obtained permission. If you make a joint application on behalf of a partnership or other relevant entity you must show this privacy notice to the other applicant and ensure they confirm that they know you will share information with us for the purposes described in it.
Our lenders will also obtain personal information from CRAs, public records and where you provide consent, business associates. Some of the personal information obtained from CRAs will have originated from publicly accessible sources. In particular, CRAs draw on court decisions, bankruptcy registers and the electoral register (also known as the electoral roll).
We will also obtain personal information from Fraud Prevention Agencies.
In addition we may obtain personal information from your employer, landlord, other lenders, HMRC, Department of Work and Pensions, publically available directories, debt recovery and/or tracing agents, other organisations who assist in prevention and detection of crime, police and law enforcement agencies.
Where you have applied to us via a Credit Intermediary/Broker/or other intermediary, your information will have been provided to us by them based on the legal ground of legitimate interests.
When a Credit Intermediary/Broker/ or other intermediary processes your personal information on our behalf, this privacy notice will apply and you should contact our Data Protection Officer to exercise your rights under data protection laws. When a Credit Intermediary/Broker/ or other intermediary processes your personal information as a data controller in its own right, its own privacy notice will apply and you should ask them for a copy if you do not have one
by the time you are introduced to us.
When one of our approved finance companies or lenders processes your personal information on our behalf, this privacy notice will apply and you should contact our Data Protection Officer to exercise your rights under data protection laws. When an approved third party finance company or lender processes your personal information as a data controller in its own right, its own privacy notice will apply and you should ask them for a copy if you do not have one by the time you are introduced to us.
In addition, as part of our Financial Crime/Anti-Money Laundering checks, we and our lenders use services provided by third parties. These are resellers of data which they obtain from public sources, Experian, Equifax, HMRC. They take taking data from these sources into their system to provide us with further information to complete our customer due diligence. This means these third parties are or maybe a source of the personal information we have about you.
Where you have provided your CV to a recruitment agency, head hunter or other agency with a view to obtaining employment and that agency has forwarded your details to us for consideration.
Information we hold
This will depend on the products or services you apply for and (if your application is successful) obtain from us. Before we explain what particular information we need in relation to our products we will explain what information is relevant to all of our products and services.
Personal information that we generally process in connection with all our products and services.
Peregrine Asset Finance process the following categories of information about you (the examples provided within each category are not exhaustive):
• Personal information – such as your name, address, date of birth, nationality (if this is necessary for us to comply with our legal and regulatory requirements), national insurance number, occupation, contact details (e.g. your email address, home and mobile telephone numbers), and security information.
• Financial/asset details – such as your bank account details from which you wish to repay a loan.
• Information about your employment status – including for example whether you are employed, retired or receive benefits.
• Product information – details of products held and applied for, including reasons for not proceeding where relevant and notes regarding contact made with ourselves.
• Fraud check details - Personal information which our lenders obtain from Fraud Prevention Agencies and some special categories of personal data such as about your health or if you are a vulnerable customer.
Who we hold information on
We hold information on customers, and where required by the product(s) applied for or by our legal obligations, we may also hold information on their associates, trustees, beneficial owners and guarantors.
If you apply for a product with a guarantor, that person will see this privacy notice when he/she submits his own personal information to us.
If there is somebody who has power of attorney over your affairs, that person will see this privacy notice when we make contact with him/her directly.
Where the customer is a corporate entity, information will be stored on the individual signatories to the agreement, directors, trustees, beneficial owners and any guarantors.
Who we may share the information with
We may share information outside of Peregrine Asset Finance Ltd if:
• allowed by our introducer agreements with our panel of lenders.
• you provide consent.
• it is needed by our agents, advisors or others involved in running accounts and services for you or collecting what you owe us (this would include debt recovery and field agents, solicitors, valuers and any supplier we have contracted with for back office/administration services).
• it is needed by subcontractors to help us manage your account or records.
• required by HMRC or other authorities.
• permitted or required by the law, regulatory bodies or the public interest.
• it is required by us or others to investigate or prevent crime.
• it is needed by any other parties connected with your account (including guarantors).
• you have a secured loan with us and we need to share information with other lenders who also hold or seek to hold a charge on your property.
If you are a guarantor, the performance for the agreement to which you are a guarantor will not impact your credit profile unless a County Court Judgement is obtained against you, for non-payment/breach of contract.
Credit Reference Agencies
For all finance products, we or our lenders will perform credit and identity checks on you, any joint applicant and guarantors, with one or more CRAs. We may also make periodic credit and identity searches at CRAs to meet our on-going regulatory responsibilities. To do this, we will supply your personal information to our lenders or CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to either ourselves or our lenders both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We or our lenders will use this information as relevant to:
• Assess your creditworthiness and whether you can afford to take the product.
• Verify the accuracy of the data you have provided to us.
• Prevent criminal activity, fraud and money laundering; and
• Trace and recover debts.
We or our lenders will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled/closed accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. Information may be supplied to other organisations by CRAs.
When CRAs receive a credit search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a partnership or joint application we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at:
Equifax – www.equifax.co.uk/crain
Experian – www.experian.co.uk/crain
Call Credit – www.callcredit.co.uk/crain
Call Credit is used for all electronic identification checks. Equifax is for the credit assessment and electronic identification checks. Experian is used for credit assessment purposes by the other lending departments and by all departments when verifying the registered address; company number; shareholders; directors of corporate customers.
You have a right to apply to the CRA’s for a copy of your file. The information they hold may not be the same and there is a small fee that you may need to pay to each agency that you apply to.
Post: Experian, PO BOX 9000, Nottingham, NG80 7WF
Phone: 0344 481 0800 or 0800 013 8888
Post: Equifax Ltd, Customer Service Centre PO Box 10036, Leicester, LE3 4FS.
Phone: 0333 321 4043 or 0800 014 2955
Post: Callcredit Information Group, One Park Lane, Leeds, West Yorkshire LS3 1EP.
Phone: 0330 024 7574
Fraud Prevention Agencies
The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be obtained by requesting in writing us for a copy of the full privacy notice of the fraud prevention agency that we use.
The fraud prevention agencies require us or our lenders to share their notice with you to explain how we will each process your personal information for preventing fraud and money laundering, and to verify your identity. In case of conflict between their notice and our own privacy notice, ours will prevail in respect of our own processing of your personal information to prevent fraud and money laundering and to verify your identity. In particular, you will see from our own notice that we consider compliance with our legal obligations as the lawful reason under data protection laws for the checks we or our lenders do at fraud prevention agencies which involve processing your personal information to prevent fraud, money laundering and to verify your identity. In the fraud prevention agencies’ notice they also mention the contract with you and legitimate interests as lawful reasons for fraud checks.
Location of personal information and processing of your personal information outside the UK and the European Union
At present we do not store or host your personal information outside the UK. This means that, for data protection law purposes, we do not at this time transfer it outside the UK.
Our lenders and finance company partners may sometimes who are in receipt of your personal information may still be processed from outside the UK or the European Economic Area (for instance by providers of Cloud hosting; IT vendors and providers of back office functions). When it is processed within Europe or other parts of the European Economic Area (EEA) then it is protected by European data protection standards. Some countries outside the EEA do have adequate protection for personal information under laws that apply to us but others do not. Our lenders will make sure that suitable safeguards are in place before they transfer your personal information to countries outside the EEA which do not have adequate protection under laws that apply to us except in cases where what are called ‘derogations’ apply.
For more information about suitable safeguards, and how to obtain a copy of them or to find out where they have been made available, should our lenders transfer data outside the European Union in the future, you can contact us using the details above.
The length of time we store your personal information depends on if your application resulted in taking out a product with us and the type of product you took.
• Applications that did not complete will be stored for 3 years from the date of the last activity.
• Account information will be stored for 6 years from the date of account closure. Where you hold or are associated to multiple transactions, the 6 years is effective from the date of closure of the last account held or associated to you.
Unless we explain otherwise to you, we will hold your personal information for the following periods:
• Retention in case of queries – We will retain the personal information that we need to keep in case of queries from you (for instance, if you apply unsuccessfully for a product or service) for 3 years unless we have to keep it for a longer period (see directly below).
• Retention in case of claims – We will retain the personal information that we need to keep for the period in which you might legally bring claims against us or our lenders which in practice means 6 years from the date of closure for the last/only account with us unless we have to keep it for a longer period (see directly below); and
• Retention in accordance with legal and regulatory requirements – We will retain the personal information that we need to keep even after the relevant contract you have with us has come to an end for 6 years from the date of closure for the last/only account with us and this will be to satisfy our legal and regulatory requirements.
If you would like further information about our data retention practices, contact us using the details above.
Fraud related retention
Based on the legal ground of this being necessary for our legitimate interest of seeking to protect our business against risk of fraud, and of protection of our interests more generally with regard to potential financial loss and reputational damage, we will retain your personal information for a further 6 years after our usual retention period has passed (as more particularly described above) if we have identified attempted frauds or frauds, financial crime or for accounts where performance would mean that we would not wish to re-enter into a contract with you at a future point such as repossession of assets, enforcement of guarantee, appointment of receivers and use of the right of set off.
Where you have provided to us your CV, unless we subsequently employ you, at which time you will be provided with an appropriate Privacy Notice, we will store your CV and the information contained therein for 6 months for our legitimate interests. This is in case of questions or queries from you about your application and in case suitable other roles come up which might
interest you. If you send us your CV, we will keep your details on file for a period of 6 months so that we may contact you in the event that a suitable opportunity at UTB (not anywhere else) arises during that time. If you’d rather we did not retain your details on file, please let us know as soon as possible by contacting us at firstname.lastname@example.org. In that case your CV will no longer be used by us to contact you about opportunities and it will be dealt with in accordance with our data retention policy.
Data access rights
You have the right to obtain a copy of the personal information we are processing and to obtain information about how we process it. We will not charge you for providing you with the information but may charge you a reasonable fee for supplying any additional copies.
Please contact us on:
Data Protection Officer, Peregrine Asset Finance Ltd, 3 Maple House, Wykeham Road, Upper Poppleton, York, North Yorkshire YO26 6QW email@example.com
Other rights under data protection laws
Here is a list of other rights that all individuals have under data protection laws. They do not apply in all circumstances. If you wish to exercise any of them we will explain at that time if they are engaged or not:
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed.
• The right to object to processing of your personal information.
• The right to restrict processing of your personal information.
• The right to have your personal information erased (the “right to be forgotten”).
• The right to move, copy or transfer your personal information (“data portability”).
• The rights in relation to automated decision making which has a legal effect or otherwise significantly affects you (we mention this right here for completeness but we do not carry out automated decision making and so in practice this right will not be relevant to you).
Please contact us (contact details at the top of this Privacy Notice) if you wish to exercise any of these rights if and to the extent they are relevant.
Please note that where the request is received via email, security checks will be conducted prior to release of any information
Right to withdraw consent
In the cases where we have asked you to give consent for the processing of your personal information you have the right to withdraw this consent at any time by contacting us using the details above. You also have the right to withdraw consent for any future marketing communications, to do this you can use the contact details above, but you may also do this by email at firstname.lastname@example.org. You can unsubscribe in this way at any time.
To comply with payment services regulations we have to share some of your personal information with other payment service providers in some circumstances such as when you ask us to share information about your account with them. Whilst those payment services regulations mention ‘consent’ for this, ‘consent’ in that context does not have the same meaning as ‘consent’ under data protection laws. The legal grounds which may be relevant to this are compliance with our legal obligations, performance of our contract with you, our legitimate interests, or a combination of these. This is why if you ask to withdraw consent from what we do with your personal information where we need to have it under the payment services regulations, we may still have to hold and use your personal information.
How to make a complaint
To make a complaint about how your personal data is used, please refer to our complaints process which can be found at www.peregrinefinance.co.uk or contact us on 01904 405299.
You also have the right to register your complaint directly with the Information Commissioner’s Office (ICO) which regulates the processing of personal data. You can contact the ICO at ico.org.uk/concerns/ or on 0303 123 111
Profiling means any form of automated processing of your personal information to evaluate certain personal aspects about you, such as to analyse or predict aspects concerning your economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
General introduction to our profiling activity
We do not undertake profiling to evaluate personal aspects of our customers and applicants as individuals however our approved finance companies and lenders may do so. For example, they may obtain a score from the CRAs. This score is not used when they make our decision to lend.
In addition when they are collating information about the loans that our customers require, they may carry out profiling to help them set the price (interest rate) of that loan for the particular customer. They do this activity based on their legitimate interests (and they are listed in the section about legal grounds above). This is on the basis that the profiling we have described above does not have a legal or other significant effect on you. Here we mean it is not profiling that leads us to a ‘yes/no we will/will not lend to this individual’ for example. Instead this profiling (which does involve a human and it is not automated decision making) helps us to inform our pricing for loans and it is for the other reasons described above. This profiling based on legitimate interests can mean that you have a right to object to it because it is processing of your personal information based on the legal ground of legitimate interests (see ‘rights to object’ below).
Electronic identification and verification
When providing loans and periodically during the life of the relationship, we or our lenders use scoring methods to validate your identity. This process involves using various data sources via CRAs to validate, name, date of birth and address. This does not happen in an automated way. This happens with human involvement and that is why this is not automated decision making. Where your identity cannot be validated electronically, we will ask you to provide physical forms of identity such as Passport and Driving Licence.
Credit Risk Profiling
When you apply for a loan, we or our lenders may use credit scoring to enable us to understand the credit risk within our portfolio and to help design future products.
The credit score is provided by CRAs and is not used as part of the assessment process when granting a loan. A credit score is a method of assessing your likely conduct of an account based on a range of data, including the conduct of previous similar accounts. It is a system widely used by credit providers. This does not happen in an automated way. This happens with human involvement and that is why this is not automated decision making. In addition we will use information on you, the use of our products and payment performance to help us understand the credit risks within our portfolio during the life of the loan with us.
Product pricing and eligibility
When applying for a loan with the pricing and eligibility of the product is determined by your credit profile supplied to us by either a lender or a CRA. This does not happen in an automated way. This happens with human involvement and that is why this is not automated decision making. For further information on our product
criteria and pricing, please refer to your Broker/Credit intermediary.
Additionally, when applying for a loan we will undertake an assessment of your financial situation to establish if the loan is affordable. In making this assessment, in addition to asking you information about your income and expenditure, we will also use national data to help formulate our decision.
We may monitor and or record phone calls to ensure that we have carried out your instructions correctly, to resolve queries and complaints, for regulatory purposes, to help detect or prevent fraud or other crimes, improve service and to help monitor and train our staff. Our lawful reason for this under data protection law is our legitimate interests or in some cases compliance with legal obligations.
Data anonymization and use of aggregated information
Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.