Ciao Finance Privacy Policy
 

1. Introduction
   

This privacy policy relates to www.crayonmoney.co.uk (Ciao Finance Ltd – 013561073 t/a Crayon Money) it informs you the customer, what to expect and how we collect data and information held about you. By using our services you are accepting and consenting to the practices described in the Privacy Policy, which we may update at any time. Last updated 01/06/2023. 

2. Data Collected

This Privacy Policy explains how we look after your personal data, your privacy rights and how the law protects you. For the purpose of the General Data Protection Regulation (GDPR) 2018, the registered data controller is our compliance officer, whose registered address and our trading address is Cliff Lane Farm, Cartridge Lane, Grappenhall, WA4 4SH. Our ICO number is ZB334383 

We may collect data obtained from contacting you via phone, automation and interaction with our website, email, SMS, or other agreed communication methods including WhatsApp in order to obtain further information to support and complete our service. Should you wish to complete an application we may also require information in hard copy this will be via postal services or even handed into our offices. This may also be from Third Parties or publicly available sources such as credit reference agencies, Lenders, couriers, third party & partner websites. 

When we complete a fact find we will collect the following information from you within the advice process: 

• Loan details 
• Application(s) details 
• Employment/Income 
• Credit commitments 
• Adverse 
• Portfolio 
• Property details 
• Solicitors/Accountants 
• Budget planner 
• Products, features & preferences

  In addition to this, we may collect information from you during the mortgage application process including: 

• Your credit report
• Identification, anti-money laundering and address verification 
• Bank statements 
• Payslips, P60 and contracts of employment 
• Tax year overviews and accounts 

We may also collect personal information from you over the telephone for mortgage and general life insurance purposes. 

We hold the right to record our telephone calls for training and quality purposes. 

 We will collect, store, process and transfer a variety of data which includes:  

• Identity – your full name, previous names, date of birth, gender, marital status 
• Contact – home address, email address and telephone numbers 
• Financial – banks statements, payment card details, savings, credit commitments, income & expenditure, pension benefits 
• Transaction – date and times when collected 
• Technical – including internet protocol (IP) address, browser type and version and other technology on the devices used to access our websites 
• Profile and usage – including feedback and survey responses, and how you use our website and services 
• Marketing and communication – in receiving marketing from us and our Group & communication preferences 

If you would like more information on the above, please feel free to contact us and we would be able to explain in detail.
We collect data relating to those that are financially dependent as this affects our affordability calculations to provide you with the most suitable recommendation However, we will only ask for further data relating to any dependents if specifically required to submit an application to a lender. 

We may also record information about potential vulnerabilities to meet the obligations of the Financial Conduct Authority (FCA) with regards to vulnerable customers. 

We may share your information with the following entities:  

• Any TMG Direct Group Company 
• Any regulatory body, ombudsman or law enforcement who has authority 
• Any electronic identification form we use for identification, anti-money laundering and address verification purposes 
• Lenders on our Panel; to allow us to make the mortgage application on your behalf 
• Any third parties who are involved within the mortgage journey; conveyancers, solicitors, surveyors, mortgage clubs 
• Insurance providers with whom we complete general / life insurance applications with on your behalf 

We will ensure all data remains within the EEA and captured under the General Data Protection Regulation (GDPR) 

Under this you have various rights in relation to your information. You have the right to: 

• Be informed 
• Have access to your information 
• Have personally identifiable information rectified 
• Erase your personally identifiable information (this is not absolute and only applies to certain circumstances where there is no legal obligation) 
• Restrict processing of personally identifiable information 
• Port your personally identifiable data 
• Object to the processing of your data 

If you would like more information relating to the above, please feel free to contact us and we will answer any questions that you have openly and transparently. 

If you apply for a mortgage through us, the lender may use this information to help make its decision about whether or not to lend to you. 

3. How we use your data

We will collect information from you in relation to mortgage & loan services and rely on the following lawful basis for processing: 

• Consent We will always seek your consent to process certain types of information where we are legally required to do so. We use consent to initially engage with you and may communicate through phone, email, SMS & webchat to discuss your requirements. We request consent to provide you with an ongoing service and contact you in the future to keep you informed of other products and services from our Group that may be of interest to you. 
• Legitimate Interest To process your application, we will supply your personal information to credit reference agencies (CRAs), and they will give us information about you, such as your financial history. We do this to assess creditworthiness and product suitability, check your identity and prevent criminal activity. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants, or other financial associates. 
• Performance of a Contract We collect information about you from the Credit Reference Agencies to assess your eligibility for the products you requested. 
• Legal obligation We collect proof of your identity and proof of address to verify your identity and complete anti-money laundering checks. 
• Contract & legitimate interest To manage our relationship with you and inform you of changes to our products and services and re-engage with you to review your existing mortgage or protection needs. 
• Legal obligation & legitimate interest To handle case enquiries, complaints, and your requests to exercise your rights. 
• Legitimate Interests We may process your personal data for the purposes of our own legitimate interests or for the legitimate interests of our suppliers provided that such processing does not outweigh your interests. For example:  

• To comply with our legal obligations. 
• Develop and improve our products and services, including for the purpose of quality control and analysis. 
• Deliver relevant website and advertisement content to you. 
• Administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) 
• Measure or understand the effectiveness of the advertising we serve to you. 
• Use data analytics to improve our website, products/services, marketing, customer relationships and experiences. 
• Where you have been referred to us by a third party, we will provide them with the outcome of your application 

4. Third party data collected or shared with

• TMG Direct Ltd 
• Our Lenders a list is available on request. 
• Third parties who we trust to assist us with your enquiry or application, specifically The Quint Group, its group of companies including its Appointed Representatives. 

• Legal service providers such as conveyancing, estate agents, surveyors as part of the applications process. 
• Introducers if you have been referred to us from a third party Introducer, we may share limited information to inform them on the progress of the application. 
• Credit Reference Agencies (CRAs) The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at – Equifax (Credit Reference Agency) https://www.equifax.co.uk/crain, Experian (Credit Reference Agency) https://www.experian.co.uk/crain and Call Credit (TransUnion) https://www.callcredit.co.uk/crain. 
• External suppliers Specialist IT system providers, e.g., Lynk Telecom, Get First Ltd 
• Our Regulators to fulfil our legal obligations, for example with the Financial Conduct Authority or the Information Commissioner’s Office. Sharing of information to verify your identity and comply with Anti Money Laundering legislation, and co-operate with law enforcement, legal proceedings, or regulatory authorities. 
• Software systems we use third party software systems including cloud-based storage, to help us to manage mortgage applications to process and verify the personal information you supply to us. All software suppliers store any data in the UK and are subject to UK regulations including the UK Data Protection Regulations and are obliged to keep your details securely and use them only to fulfil the contracted service. 

These third parties are not entitled to send you marketing or promotional messages. It is shared for the purpose of ensuring we can adequately fulfil our responsibilities to you. We recommend you also read their Privacy Notice in conjunction with ours which can be found on their own websites. 

5. Your personal data will be kept for the following periods of time

 We only retain your personal data for as long as is necessary and depends on the purpose for which we use it, our obligations, and your actions. We will retain and process your personal information based on our statutory and legal obligations, our regulatory requirements, and our legitimate business interests. 

• Successful mortgage applications that do not need to be accessed regularly after 6 years will be safely archived. 
• Withdrawn, incomplete and failed mortgage applications 2 years from the date the latest application began. 
• Enquiry data obtained from customers & third parties that do not result in an application for any product or service from us or the Group 2 years from the date when the lead was received. 
• Future marketing of customer data where consent has been obtained indefinitely unless customer requests data be removed. 
• Complaint’s data 3 years as per FCA guidelines. 

After these retention periods, if there is no other on-going relationship, your personal data will be securely deleted. 

6. Marketing

You have the choice to opt-in to receive information on products and services offered by us, that may be of interest to you and not relate to your specific mortgage. 

We will obtain explicit consent from you either verbally, via our website, by email, or by completion of a consent form and will keep a record of your consent. 

Marketing may include emails, SMS, telephone calls and postal marketing. You can advise us of your preferences on how you would like us to provide marketing. 

We will not provide your personal data to any unconnected third party in connection solely with marketing. 

You may withdraw your consent at any time by contacting any member of our team by phone, email, SMS or post.

7. Complaints

If you have a compliant about how we handle your data, please contact us by email to [email protected] 

Include your name, address, preferred contact number and the email address you signed up with. We will investigate your complaint promptly and will respond to you with our findings. If we have been unable to resolve your information rights concern, you can raise the matter with the Information Commissioner’s Office (ICO), who is the regulator for data protection in the UK. You can contact them on 0303 123 1113 to find out more.

8. Cookies

Cookies are a small text file places on your device or computer when using our website. They allow us to understand the number of visitors we have so that we can analyse data about web traffic and helps us to improve our website.

Cookies can be temporary or permanent and do not collect personal or identifiable information about you. Temporary cookies form part of the security process and permanent cookies identify the link you used to find our website.