Pool House believe in providing each you with your rights under the General Data Protection Regulation. Firstly, your right to be informed. We provide, as requested by the Information Commissioners Office, complete transparency over how we use your personal data.
We clearly state who we are, how you can contact us, and the time limit in which we will respond. We provide all relevant information to you, such as our address, our Financial Conduct Authority registration number, Information Commissioners Office Registration Number and Companies House Number.
We inform you that your data will only be used for 6 months from the most recent confirmation of marketing consent, after this, the data will be securely encrypted and archived and removed from our marketing database. All data is securely archived and encrypted and will only be kept as long as physically necessary, as per ICO guidelines. Data will be kept after marketing consent has expired, in case of potential complaint, investigation or query. By storing this data in our secure archive, we can provide in depth, accurate information at point of complaint, investigation or query.
We describe your rights to access, such as subject access requests, which is a free service, how to request an SAR, which is via email or telephone, all contact details are provided and a time frame in which to expect an acknowledgement and a full response.
We also provide details on your right to be forgotten, although this is not a given right, if we have a legitimate reason for holding the data, this can be stated. However, you have the right to request complete removal of your details from our database.
Right of access:
As per the ICO guidance, the right of access allows individuals to be aware of and verify the lawfulness of the processing.
You have the right to access the personal data we hold, although this is usually the information that you have supplied to ourselves at point of application, this can also include such things as communications between yourself and Pool House.
We provide instructions on how to request a ‘Subject Access Request’, which is where Pool House will supply all reasonable information and documentation which is relating to the individual that has requested this. We will not charge for this service, and we advise that this can take up to 1 month to receive a full response, however, if the request is complex or if one individual is asking for numerous details, then we can advise that this period will be extended to two months. But notice must be given to the individual who provided the original request.
We will issue our response electronically, unless otherwise requested. Before issuing our response, we will carry out thorough security checks to ensure we verify the individual’s identity and provide personal information.
Right to rectification:
As per ICO guidance, the GDPR gives you the right to have personal data rectified when inaccurate or incomplete.
From the date the communication was received, we have one month to rectify the information, and to inform all relevant third parties of the amendment. If the request is complex, we can request an extension of one month to fully complete the request, we will notify you of this extension and will update you on our progress.
Right to erasure:
Right to erasure is also known as the right to be forgotten, this is the right for you to request the deletion/removal of personal data where there is no reason behind its continued processing.
This is not an absolute right and there are reasons applicable to ourselves that we can refuse to comply with the request, please see the relevant exceptions below:
You have the right to have personal data erased and to prevent processing only in specific circumstances, please see below for detail (as taken from ICO guidance):
Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
When the individual withdraws consent.
When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
The personal data has to be erased in order to comply with a legal obligation.
The personal data is processed in relation to the offer of information society services to a child.
When we have received a request of erasure and agree to comply, we must also advise any relevant third parties to erase this data also. We will inform all relevant third parties via email. A confirmation will be sent to you when the request has been completed
Right to restrict processing:
You have a right to suppress the processing of your personal data. As per the ICO guidance, if an individual requests for us to suppress their details, we can still store these details in our encrypted archive, as long as they have been suppressed.
Pool House are aware that an individual can request for us to restrict the processing of their details, if they do not think their details are correct. We also must restrict the processing if consent has not been gathered or has been withdrawn.
We are aware that we can offer a right to restrict processing as an alternative to erasure, when it is not required for us to comply with the right to erasure request.
When a request for restricted processing has been received, we must inform all relevant third parties to confirm they will carry out the relevant actions also.
Right to data portability:
Pool House comply with the right to data portability by providing, upon request, your personal data that we hold.
You may require this to provide to a different business, which will provide you with a service, or the you may require these details for personal use.
We will provide/transfer this information in a clear and structured format, it will not be encrypted.
We will respond to all requests within a month from receiving the initial request. However, if the request is complex, then we will require an extension of an extra month. We will inform you of this and the reason behind needing an extension.
Before providing the information, we will carry out thorough checks to verify your identity.
Right to object:
You have the right to object to direct marketing and your details being processed based on legitimate interest.
Pool House comply with the right to object by informing you of your right to object to processing. We do this on each marketing promotion sent and at initial point of obtaining consent.
As soon as a ‘right to object’ request has been received, we will cease all processing and contact the relevant third parties to ensure they cease all processing of the relevant details.
We ask for 3-5 working days to cease all communications.
Rights related to automated decision making including profiling:
We comply with the ‘rights related to automated decision making including profiling’ as we do not rely on an automated decision/profiling when receiving applicants for our service, we provide our service after receiving an application form completed by an individual.
All information is supplied and submitted by yourself and not electronically gathered. The information provided is then passed to our partners, exactly how you have supplied it.
Although the final decision of awarding a loan may be automated through a system, this part of the journey is not carried out by ourselves. We supply your details to the lenders within our network, they then make the final decision as to whether the you are eligible for a loan.
You are made aware of this service at point of application, ‘We are a broker, not a lender’ we do not provide the loan or have the final decision.
We understand that individuals can challenge and ask for reasoning behind the outcome of their loan application. We will happily comply and provide all information we have available, although this will not answer any questions in regard to acceptance or the decline of an application. Pool House would provide contact details for the relevant lender who can provide further information and an explanation behind the outcome.
The panel of lenders that we work with will make their decision based on certain details, such as Age, Loan Amount Requested, Loan Term, Employment, Income, and details similar to this description. This is for your safety. However, if the you feel that all relevant information has not been obtained via the application form, such as a second income, you have the opportunity to contact the lender and advise of any extra or incorrect information.