In this Privacy Declaration, unless the context otherwise requires:
We, us, our means STB Leasing Limited (STB), and/or RentSmart Limited trading as ThinkSmart, and any person to whom any of our respective rights and/or duties in connection with the agreement with you are transferred. Please note that in certain circumstances STB has appointed ThinkSmart as its agent – any queries concerning this Privacy Declaration should be directed to ThinkSmart.
Group means any company within the STB Leasing Limited’s group of companies and/or the ThinkSmart group of companies.
More information on ThinkSmart can be found at www.thinksmartworld.com
DATA PROTECTION LAW
We are the data controller in respect of the information that you give to us and which we hold about you. If your agreement is assigned solely to ThinkSmart at any point, ThinkSmart will be the sole controller of your personal data. STB Leasing Limited will only have access to your personal data to comply with its legal obligations in relation to statutory and regulatory reporting (for example, to HMRC and the Financial Conduct Authority) and to comply with its legal obligations in relation to complaint handling. STB retains your personal data in accordance with the section below titled "Retention of Your Information".
Data Protection Law does not generally apply to information about limited companies or limited liability partnerships (LLPs), but it does cover personal data relating to sole traders and partnerships (and, in the case of sole traders and partnerships, “you” applies to the sole trader or the partners in the partnership). When we receive an application from a business which is a limited company or an LLP, we may perform a search with credit reference agencies and fraud prevention agencies on the individual company directors, beneficial owners and LLP members, in which case the parts of this Privacy Declaration that concern those checks and your rights under Data Protection Law, applies to “you” in that capacity.
If we propose to enter into an agreement with you, it is a condition of you being assessed for that purpose for you to provide us with the personal information that we request from you (or from the retailer who introduces you to us) which it is necessary for us to have for the purpose of entering into the agreement with you, administering the agreement and for the purposes described below. If you fail to provide us with the information we request from you, we will not be able to proceed with the checks that we need to perform to enter into the agreement (described below) and, subsequently, we will not enter into the agreement with you.
HOW WE USE YOUR INFORMATION
(A) Before We Enter Into an Agreement with You
Purpose
Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, to verify your identity and to assess whether you are sufficiently likely to repay amounts which you would owe to us if we were to enter into an agreement with you. These checks require us to process personal data about you (for example, name, address, date of birth, contact details and employment details) which you have provided, we have collected from you or we have received from third parties. This personal data will be used to prevent fraud and money laundering, to allow us to assess the credit risk of entering into an agreement with you and to verify your identity.
Lawful basis of processing
We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business, to assess the credit risk of entering into an agreement with you and to comply with laws that apply to us. Such processing is also a contractual requirement of the financing you have requested.
(B) Administration
Purpose
Our main use of your information is to administer your agreement with us. We will use your information to process payments, notify you of any late or overdue payments and to contact you regarding any other matter relating to your agreement.
Lawful basis of processing
The use of your information in this way is necessary for the performance of the agreement with you and, initially, to take steps to enter into the agreement with you.
Purpose
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
Lawful basis of processing
We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering.
(C) Credit Referencing and Fraud Prevention
Purpose
When processing your personal data, decisions about your application will be made by automated means. We will use a scoring matrix (or other automated process) to assess your application and may automatically decide that we consider your credit risk to be too high or that you pose a fraud or money laundering risk if our processing reveals your behaviour to be similar to that of fraudsters or money launderers. You have rights in relation to automated decision making: if you want to know more please contact us using the details set out at the end of this Privacy Declaration.
If you have a financial associate (such as someone with whom you have a joint mortgage or a joint bank account or have jointly applied for an account with in the past), we will link your records together. Credit reference agencies will also link your records together and these links will remain on your and their files until such time as you or your financial associate successfully files for a disassociation with the credit reference agencies to break that link.
If you apply to us for credit, when processing applications, we will use the information that you provide to us to obtain information about you from credit reference agencies to assess whether you are sufficiently likely to repay amounts which you would owe to us if we were to enter into an agreement with us (credit search), to verify your identity and prevent fraud and money laundering. We will record information about you with them to help make decisions about your application. Following the credit search, if we determine that you pose a fraud or money laundering risk, we may refuse to provide the credit that you have requested. A record of any fraud or money laundering risk will be retained by us and by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details provided at the end of this notice. When we perform a credit search this will leave a footprint on your credit file and this may affect your chances of obtaining credit in the future. This does not apply to any credit search that we take in relation to beneficial owners of your business, as such searches will be "soft" searches which do not leave a footprint on the credit file.
Lawful basis of processing
This is necessary for the purposes of our legitimate interests in establishing any risks in entering into an agreement with you and any risks throughout the agreement and to prevent, detect and prosecute fraud and other crimes.
Purpose
We will give details of any loan agreement that you have with us and how it is conducted to credit reference agencies and fraud prevention agencies. If you do not make repayments in full and on time, we will tell credit reference agencies who will record the outstanding debt. The information at the end of this Privacy Declaration (under ‘How To Find Out More’) provides a link which gives you further details about how credit reference agencies, fraud prevention agencies, we and other lenders use your information in this way – we currently submit data to both Experian and TransUnion.
Lawful basis of processing
Use of your information in this way is necessary for the purposes of our legitimate interests in recovering any debt owed to us and detecting and preventing fraud. We currently obtain information from Experian and TransUnion (relating to the ‘credit search’) and we currently pass information about you to Experian and TransUnion.
Please contact us at the details provided below in the ‘How to find out more’ section, if you would like the details of those credit reference agencies from which we obtain information (relating to the “credit search”) and the credit reference and fraud prevention agencies to which we pass information about you in accordance with this Privacy Declaration.
(D) Introducers, Agents and Other Third Parties
Purpose
We may pass your information to companies within our Group, who may use and update your information to assess lending risks, to recover debts, to prevent, detect and prosecute fraud and other crimes, and to manage our and any member of our Group’s relationship with you.
Lawful basis of processing
This is necessary for the purposes of our legitimate interests in establishing any risks in entering into an agreement with you and any risks throughout the agreement, the ability for us to recover any debt owed to us by you and for the administration of the agreement with you. The Group also has legal obligations that it must comply with (such as to report fraud).
Purpose
Sometimes we need to give information to the retailers who introduce you to us for the following purposes:
to enable the relevant retailer to deal with complaints made by you;
to coordinate responses to requests made by you relating to your rights under the data protection laws;
to effect the exercise of any rights that you have under applicable laws and regulations.
Lawful basis of processing
This is necessary for the purposes of our legitimate interests in order to protect our business and to comply with relevant Data Protection Laws that apply to us.
Purpose
We may contact you by mail about an insurance product regarding equipment that you have taken on hire from us and which we think may be of interest to you. The insurance product is provided by our third party partner, Great American Specialty & Affinity Limited trading as Lease & Loan Insurance Services (LLISL), who may, in addition to any contact by us, contact you by mail or telephone (provided that your telephone number is not registered with the TPS or CTPS or such other preference service that may replace those services from time to time) and, for that purpose, we will provide your name, address and telephone number to LLISL.
Lawful basis of processing
Use of your information in this way is necessary for the purposes of our legitimate interests in ensuring that the leased equipment is insured, in accordance with the terms of the lease agreement.
Purpose
If we become entitled to terminate any agreement we have with you, we may pass your information to a debt collection agency in connection with recovery of monies due on your agreement.
Lawful basis of processing
Use of your information in this way is necessary for the purposes of our legitimate interests in recovering any debt owed to us.
Purpose
We will share your information with other organisations if we sell or buy any business or assets (as we will share your data with the prospective seller or buyer), or if we or substantially all of our company assets are acquired by another party, in which case your information will be one of the transferred assets.
Lawful basis of processing
This is necessary for the purposes of our legitimate interests to ensure that we or our business remains commercially viable.
Purpose
We will share your information with any funder who provides the finance for your agreement.
Lawful basis of processing
This is necessary for the purpose of our legitimate interests in maintaining our funding lines so that our business remains commercially viable.
(E) Call Recording
Purpose
We will record phone conversations with our customers.
Lawful basis of processing
This is necessary for the purposes of our legitimate interests to enable us to properly resolve complaints, to improve our service standards and for staff training purposes.
(F) Analytics
Purpose
We use analytics tools on our website that are provided to us by third parties acting on our behalf; we will ensure that your information is secure and protected in accordance with our obligations under data protection law.
Lawful basis of processing
We use your information in this way as it is necessary for our legitimate interests in (i) detecting fraud by understanding behaviours and patterns that correlate to committing fraud; and (ii) understanding the customer journey so that we can understand your needs and provide a better service to you, and to help us develop and improve our products and services.
These tools may process some of your personal data by converting it into statistical or aggregated data.
MARKETING PREFERENCES
You can change the marketing preferences that you have selected at any time. You can do this by;
Email – [email protected]
Phone – 0161 333 2400
Or in writing to ThinkSmart, 7th Floor, Oakland House, Talbot Road, Old Trafford, Manchester, M16 0PQ
RETENTION OF YOUR INFORMATION
Information that we provide to credit reference agencies remains on their file for six years after any loan agreement with us is closed, whether settled by you or upon default. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
If we have an agreement with you, when the agreement ends for any reason, we retain your records for a period of six years plus the current year after your agreement with us has ended, after which your information will be removed from our records.
All other information that we hold about you will be held for a period of six years plus the current year from the date of your application.
If your agreement is assigned solely to ThinkSmart at any point, STB Leasing will only hold your personal data after the assignment takes effect in accordance with applicable laws. STB Leasing will destroy or fully anonymise personal data it holds if that data is no longer required to meet the purposes set out in the section titled "Data Protection Laws" above or to meet its obligations under applicable laws.
LOCATION OF YOUR INFORMATION
The information that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (“UK”). It may also be processed by staff operating outside the UK who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the processing of your payment details and the provision of support services. Where adequate protections for your information do not exist under the applicable laws of that third country, we (or the party transferring your information) will take necessary steps to ensure that appropriate safeguards are put in place to maintain the same levels of protection as are required under UK data protection laws. Safeguards include imposing contractual obligations on the recipient of your information or subscription to ‘international frameworks’ that ensure adequate protection. Please contact us for more information about the protections that are in place.
Whenever fraud prevention agencies transfer your personal data outside of the UK, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the UK. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.
By submitting your personal data, you acknowledge that such transfer, storing or processing may take place. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Declaration.
YOUR RIGHTS
You have certain rights in relation to your information under applicable data protection laws. You have the right to: (i) be informed about how your information will be used, (ii) ask us to restrict processing, (iii) if it is technically feasible, transmit your information from our systems to a third party's system in a safe and secure way, (iv) object to our use of your information where we are using it for the purposes of our legitimate interests as described in this agreement, (v) not to be subject to a decision when is it based on automated processing and it produces a legal effect or a similarly significant effect on you and if it does then you have the right to request a human intervention – please contact us using the contact details below for more information about exercising this right, (vi) access your information at no cost (unless your request is unfounded or unreasonable), (vii) if your information is inaccurate or incomplete, then you can ask us to have it rectified, (viii) in certain circumstances, you have the right to ask us to delete your personal information. For more information or to exercise your data protection rights, please contact us using the contact details below.
CUSTOMER COMPLAINTS
You have the right to lodge a complaint with the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.
CHANGES TO THIS PRIVACY DECLARATION
We may make changes to this Privacy Declaration at any time by sending you an e-mail with the modified terms or by posting a copy of them on the customer area of our website. Any changes will take effect on the date stated in our e-mail or if no date is specified, within 7 days after the date of our e-mail or the date on which we post the modified terms on the customer area of our website, whichever is the earlier. Your continued use of the website after that period expires means that you have acknowledged and will be bound by the modified policy.
HOW TO FIND OUT MORE
You can contact the credit reference agencies currently operating in the UK; the information they hold may not be the same so it is worth contacting them all. They will charge you a small statutory fee.
TransUnion Information Group, One Park Lane, Leeds, West Yorkshire, LS3 1EP or call 0330 024 7574 or log on to https://www.transunion.co.uk/consumer/consumer-enquiries
Equifax Ltd, Customer Service Centre, PO Box 10036, Leicester, LE3 4FS or call 0333 321 4043 or 0800 014 2955 or log on to https://www.equifax.co.uk/Contact-us/Contact_Us_Personal_Solutions.html
Experian, Consumer Help Service, PO Box 8000, Nottingham NG80 7WF or call 0344 481 0800 or 0800 013 8888 or log on to https://www.experian.co.uk/consumer/contact-us/index.html
These three credit reference agencies have together produced a joint Credit Reference Agency Information Notice (CRAIN) which provides further information as to how they use your personal data. You can find the most up to date version of the CRAIN at http://www.experian.co.uk/crain/index.html.
If you have any queries or concerns about the way in which we use your information, or if you want details of the relevant fraud prevention agencies, you can contact us at:
Data Protection Officer
ThinkSmart
7th Floor, Oakland House,
Talbot Road,
Manchester,
M16 0PQ
or send an e-mail to [email protected] with the subject heading “data protection query”.