Privacy Policy
How we collect, use and protect the personal data you provide through this website — together with our Cookie Policy and details of how to give feedback or make a complaint.
Thank you for visiting www.charlesstreetfinance.com (the “Website”). The Website is operated by Charles Street Commercial Investments Limited (0173973), Charles Street Capital Limited (14701559) and Charles Street Finance Holdings Limited (14701076) (the “companies”) trading as “Charles Street Finance”, and these companies are registered in England and Wales and their registered office addresses situated at Lake View, Lakeside, Cheadle, Cheshire, SK8 3GW. References in this Privacy Policy to “we”, “us”, “our” and “ourselves” are references to Charles Street Finance, a trading style of the companies. References to “you” or “your” are references to any person reading this Privacy Policy.
We take the privacy of our Website users seriously and we are committed to protecting your privacy in compliance with data protection laws and regulations, including the UK GDPR and the Data Protection Act 2018 (“Data Protection Laws”). This Privacy Policy explains what personal data (see below for details of what this means) is collected about you via the Website (including, without limitation, via any ‘web-chat’ facility that is accessible via the Website, “Web-Chat”) and what we do with that personal data. Please see our Cookie Policy below for information on how the Website (including Web-Chat) uses cookies, and your choices regarding cookie use.
We encourage all of our customers to familiarise themselves with this Privacy Policy to understand our views and practices regarding your personal data collected via the Website and how we will treat it.
We reserve the right in our sole discretion to amend this Privacy Policy from time to time. In this event, we will post the revised policy on the Website and we will notify you of any material changes via a banner on the Website. This Privacy Policy (together with our website terms of use and any other documents referred to on it) sets out the basis by which any personal data we collect about you via the Website (or you provide to us) will be processed by us.
Where you interact with us other than through the Website (e.g. via the phone or where you make a loan application by post or through a broker), this Privacy Policy may be supplemented by separate privacy policies, notices or other privacy related information which will apply to personal data obtained by us (or on our behalf) other than through the Website. This additional privacy information will be made available to you at the relevant point at which we collect your personal data.
If you do not agree to your personal data being used in the manner described in this Privacy Policy then please do not provide this to us. However, please note that some functionality of the Website may be restricted/unavailable where you do not provide us with any personal data we request.
You have a right to know how we will use your personal data
We provide this Privacy Policy to make you aware of our practices in connection with your privacy and of the choices you can make about the way your personal data is collected via the Website and used.
We are committed to ensuring the security of your personal data
Data Protection Laws place obligations on us to process your information fairly and lawfully and to keep it secure. For the purposes of Data Protection Laws, the controller of your personal data which is collected through the Website when users make an online enquiry is Charles Street Finance of Lake View, Lakeside, Cheadle, SK8 3GW.
What is “Personal Data”?
Personal data broadly means information that relates to an identified or identifiable living individual (“identifiable” refers to being able to identify the living individual when the information held is combined with other information).
How will we comply with Data Protection Laws?
Data Protection Laws require that we meet certain lawful grounds before we are allowed to use your personal data in the manner described in this Privacy Policy and that we explain these legal grounds to you. We take our responsibilities under Data Protection Laws seriously, including meeting these conditions. To use your personal data, we will rely on the following lawful grounds (more than one ground may be relevant to each example of our processing):
- Contract: Where you are a prospective or existing customer we will process your personal data to the extent required for us to deliver contractual services related to products that you have or intend to purchase from us (for example existing customers can make a payment, request information in respect of how to obtain additional finance or how to obtain a redemption figure). Additionally, if you are not an existing customer but you have requested further information about one of our products or services, we may use your personal data if necessary to do so in accordance with the prospective contractual terms.
- Legitimate Interests: We will process your personal data where this processing is in our "legitimate interests". It is in our legitimate interests to collect your personal data as it provides us with the information that we need to run the Website or provide our services and/or products more effectively. When relying on this condition, we are required to carry out a balancing test of our interests in using your personal data (for example, in order to improve the Website or our services), against the interests you have as a user and the rights you have under Data Protection Laws. The outcome of this balancing test will determine whether we can rely on legitimate interests as the lawful basis for using your personal data. We will always act reasonably and give full and proper consideration to your interests in carrying out this balancing test.
- Legal obligation: Where there is a legal requirement upon us to obtain or use your personal data to comply with a law or statutory obligation, we must do so. For example to comply with laws and regulations which govern our business, such as the Financial Services and Markets Act 2000 and the Proceeds of Crime Act 2002.
- Substantial Public Interest: Where you have a health issue and are unable to provide consent to us, we may record special category data where it is necessary for reasons of safeguarding your economic well-being.
- Consent: Where you have provided your consent, we rely on this consent to use your personal data in specified ways.
- Vital interests: The processing of your personal information is necessary to protect you or someone else's life.
The type of personal data we will collect about you via the Website
The Website provides users who are interested in our products/services with an opportunity to submit online enquiries to us. The personal data that you may provide to us through the Website is set out below:
- your name;
- your contact details (including postal address, email address and phone number);
- your account number (when you are an existing customer and you contact us via the Website about your existing loan/mortgage, for example to request that we contact you with a redemption figure);
- any personal data you choose to include when typing into Web-Chat or when typing additional comments in free text boxes (such as ‘tell us a little bit more about your enquiry’);
- any personal data you may include when submitting a complaint online;
- your debit/credit card details (only when you choose to make a loan or mortgage payment online through the Website); and
- we may automatically collect technical information (including IP address, device details and your login information) and information about each visit you make to the Website (such as page response times and length of visit).
The Website also uses cookies. Please see our Cookie Policy below for information about the cookies we use and your choices in relation to cookie use.
How we handle your personal data
We will only use the personal data you provide to us as described in this Privacy Policy, and any supplemental privacy information, as set out above.
We will observe the rights granted to you under applicable Data Protection Laws and will ensure that queries relating to privacy issues are dealt with promptly and in a transparent manner. See below for details about how to contact us and how to exercise your rights under Data Protection Laws.
We will only collect and process your personal data where we have lawful grounds to do so.
We will update our records if you inform us that your details have changed. Please tell us (see contact details below) as soon as possible about this. We will update our records promptly once we are satisfied that the new information (such as your new address or contact detail) is accurate.
How we will use the personal data we collect about you
We will store and process your personal data on our business systems. Please see the Data Security header below for details about how we keep your personal data secure, in line with our obligations under Data Protection Laws.
We will use your personal data collected (including from any third parties, where relevant and lawful) to:
- contact you about our products/services (in response to your request for this contact which you have made via our Website);
- provide our products/services to you if you decide to go ahead and obtain them (but please note as explained above that supplemental privacy information, notices and/or statements will also be relevant to that processing);
- manage and contact you about any products or services that we provide to you (and in doing so enter your details into our customer relationship management tool);
- contact you in respect of any complaints that you submit;
- process payments you choose to make if you make a payment to us relating to your loan/mortgage via the Website;
- comply with our legal obligations;
- in an anonymised form, identify patterns which we can use to help us develop, administer, support and improve our services; and
- for marketing purposes.
Other websites
Please note that our services/products may be available via other websites (e.g. broker or intermediary websites) and we may link to other websites through the Website. We are not in control of these websites. Their use of your personal data is governed by their privacy policies.
We therefore recommend that you check the policy of each website that you visit and make sure that you are comfortable with the terms of such policies before providing any personal data.
Who do we pass your data to?
We may use third parties to provide services on our behalf which may include processing (but not using themselves for their own purposes) your personal data and this means we will disclose your personal data to them.
We will provide your personal data to the following categories of third parties:
- companies that provide data hosting and website management services such as Microsoft; and
- companies that provide website analytics services and/or help us to make advertising messages more relevant to you such as Google Analytics, Bing, AppNexus and/or Infinity (please see our Cookie Policy for further information).
In each case, we will, in accordance with our obligations under Data Protection Laws, put in place appropriate written protections for your personal data.
Other than set out in this Privacy Policy (and supplemental privacy information, notices and/or statements where relevant), we will not otherwise disclose, sell or distribute your personal data we collect via the Website to any third party without your permission unless we are required to do so by law.
In addition to the disclosures described above, we may disclose your personal data to:
- our auditors, solicitors, professional advisors and the companies who have agreed to treat your personal details as confidential;
- anybody having a legal right to your personal data, including the police and any other legal and regulatory authorities and government bodies;
- any third party who acquires all, or substantially all, of the assets or shares in the companies and/or the Website, whether by sale, merger, acquisition or otherwise; and
- as required to enforce or apply our Terms of Use.
How long we keep your personal data
We take steps with a view to permanently deleting, destroying or anonymising your personal data (which means that we are no longer able to identify you from it) when it is no longer necessary for its purpose and we are not required by law to keep it.
How long we keep your personal data depends upon the purpose for which your personal data was collected or provided. Generally however:
- we will keep the information no longer than is necessary to enable us to provide you with a service that you have requested for as long as it takes us to provide that service (i.e. until that service or product has been provided to you and you have fulfilled your obligations in relation to that service or product). After that, we will only keep information about you if it is necessary for us to do so to comply with our legal obligations;
- we will keep your contact details for a reasonable period after you have given us your consent to use them for marketing purposes (but we will not retain these details for this purpose after your consent has been withdrawn); and
- where you have provided your personal details in order to request more information about a product or service and you do not uptake that product or service we will delete your personal data after 12 months.
Will my personal data be transferred outside of the European Economic Area?
We currently do not intend to transfer your personal data to third parties and organisations who hold data outside of the European Economic Area (EEA). However, some third party suppliers or service providers may have back up or disaster recovery data centres that are located in multiple jurisdictions outside the EEA (for example, in the United States). This may mean that in certain limited circumstances personal data is transferred to countries which do not provide the same level of protection for personal data as the EEA.
Where your personal data is being transferred outside the EEA, we will ensure that appropriate safeguards are in place to protect your information in accordance with Data Protection Laws, such as the use of the International Data Transfer Agreement or Addendum as issued by the Information Commissioner under S119A(1) Data Protection Act 2018.
Your rights in relation to your records
You have a number of rights under Data Protection Laws in relation to the way we process your personal data. These are set out below. You may contact us using the details below to exercise any of these rights and we will respond to any request received from you within one month from the date of the request.
- Individuals have the right to be informed about the collection and use of their personal data.
- A right to access personal data held by us about you.
- A right to require us to rectify any inaccurate personal data held by us about you.
- A right to require us to erase personal data held by us about you. This right is not absolute and will only apply in certain circumstances where (for example): we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent (if we are using your personal data based on your consent); or where you object to the way we process your data (in line with Right 6 below).
- A right to restrict our processing of personal data held by us about you. This right is not absolute and will only apply in certain circumstances (for example): when you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but you require the data for the purposes of dealing with legal claims.
- A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation, at your request.
- A right to object to our processing of your personal data (including for the purposes of sending marketing materials to you).
- Rights related to automated decision making including profiling (making a decision solely by automated means without any human involvement); and profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.
If you would like to exercise the rights listed above, you can send a request:
- By mail to: Data Rights Team, Lake View, Lakeside, Cheadle, Cheshire SK8 3GW, enclosing details of your account number(s) or application date
- By e-mail to: datarightsteam@togethermoney.com
- By telephone to: 0330 828 3136
Data Security
In accordance with our obligations under Data Protection Laws to keep your data secure, we have put in place appropriate technical and organisational measures to safeguard the personal data we collect from you through our website.
However, we alert you to the fact that, unfortunately, the transmission of information via the internet, including the online enquiry forms you submit to us and/or any information provided via Web-Chat, is not completely secure. Although we regularly review, test and enhance our website security measures to ensure we maintain a high level of security, we cannot guarantee the total security of data transmitted via the Website: any transmission (i.e. your sending of the personal data to us) is at your own risk. Once we have received your personal data, we will use the steps detailed above to protect it.
You should be aware that there are inherent risks in transferring personal data over the Internet. For example, if you send us an e-mail from your private mailbox, we cannot guarantee the security of the content during its transmission to us. For that reason, please do not send to us an unsecured e-mail with confidential information such as your National Insurance or bank account numbers, or any sensitive personal data.
Customer feedback and complaints
If you are not happy with the way in which your personal data is held or processed by us, or if you are not satisfied with our handling of any request by you in relation to your rights or any automated profiling that we carry out, our Data Protection Team would be happy to help. You can contact our Data Protection Team at Lake View, Lakeside, Cheadle SK8 3GW.
Alternatively, you have the right to complain to the Information Commissioner’s Office (ICO) by calling 0303 123 1113. The ICO is the UK’s independent body set up to uphold information rights. You can find out more about the ICO on its website (www.ico.org.uk).