Privacy Notice - UK Asset Resolution

UK Asset Resolution Ltd (“UKAR”, “we”, “us”, “our”) takes its obligations concerning data protection seriously, and processes personal data strictly in accordance with the UK data protection laws. This Privacy Notice contains important information explaining how UKAR collects and processes your personal data. Unless otherwise defined, terms used herein have the same meanings as set out in UK data protection laws.

Who we are

UKAR is wholly owned by HM Treasury (“HMT”) whose shareholding is managed by UK Government Investments (“UKGI”). UKAR is responsible for meeting the contractual obligations and managing the remaining liabilities and other strategic matters arising out of the Government’s former ownership of NRAM Ltd (“NRAM”), Bradford & Bingley (“B&B”), Mortgage Express (“MX”), and their respective subsidiaries (collectively the “BBG Entities”).

UKAR is the data controller with regard to the processing of your personal data, unless specifically stated otherwise.

What do we collect and process?

In order for UKAR to meet its contractual, legal, and regulatory obligations, it may be necessary for us to collect, maintain and process the personal data of the following data subjects (“you”, “your”):

Former B&B and NRAM employees;
Beneficiaries of the B&B Staff Pension Scheme and the NRAM Pension Scheme;
Beneficiaries of the private medical insurance scheme currently administered by B&B; and
Individuals who previously held/continue to hold a financial product where the BBG Entities/NRAM plc were legal title holders or, in the case of certain other non-mortgage products, the originating, acquiring, or intermediating entity.

UKAR may process the following different types of personal data:

In respect of former employees of the BBG Entities, beneficiaries of the B&B Staff Pension Scheme and the NRAM Pension Scheme, and beneficiaries of the private medical insurance scheme currently administered by B&B: name, title and address, contact information such as telephone number, postal address and email address, signature, date of birth, employment dates, employee ID number, job title / role, salary/fees/benefits, attendance/absence, disciplinary data, details relating to performance, leave, tax and pension status, dependants, expenses and bank account details, health-related data, ethnicity information, criminal offence data; and
In respect of former BBG Entity/NRAM plc customers: account-level information for any products you may have had with the BBG Entities/NRAM plc, which may include correspondence we/the BBG Entities/NRAM plc may have sent you, the balance on your mortgage/loan, monthly payments, and any arrears information. In limited circumstances, the account-level data which we process for you may include special categories of personal data, such as ethnicity data, health-related data, data relating to criminal convictions and offences, etc.

Personal data may have been collected from a few limited sources, including, in some cases, directly from you. In other cases, and where lawful to do so, your personal data may have been transferred from the BBG Entities or from other third parties, such as credit reference agencies and the HM Land Registry, and from publicly available information to which UKAR has access.

Why and how do we collect and use your personal data?

We are required by law to inform you of how and why we use your personal data and indicate our lawful basis for such use.

Personal data processed

Lawful basis and purpose for processing

Any account level information, such as: Name, title, address, contact details (telephone, email, postal), date of birth, previous names. This may, on occasion, include special categories of personal data, such as health-related data, ethnicity information, and data relating to criminal convictions and offences

Processing that is necessary for our own legitimate interests, provided these are not overridden by your interests and fundamental rights and freedoms, such as:

(a) to manage liability for certain contingent liabilities agreed to as part of previous asset sales undertaken by the BBG Entities and NRAM plc;

(b) to manage claims or complaints brought in respect of historic transactions to which UKAR and/or B&B, NRAM and/or MX are a party and for which UKAR is legally and economically liable, including allowing us to consider and respond to any current/future claims/complaints where UKAR or a BBG Entity is the named respondent;

(d) to manage our business operations, including carrying out the verification and audit of any claims or complaints relating to liabilities assumed by UKAR;

(e) to establish, enforce, and defend legal claims.

Processing that is necessary for compliance with our legal or regulatory obligations (e.g. Information Commissioner’s Office, Financial Ombudsman Service).

Any data of former employees of the BBG Entities, beneficiaries of the B&B Staff Pension Scheme and the NRAM Pension Scheme, and beneficiaries of the private medical insurance scheme currently administered by B&B, such as the data mentioned in the section above on “What do we collect and process?”

Processing that is necessary to fulfil a contract with you or when taking steps in connection with a contract with you, such as to set up and to administer any benefit or payment process we have agreed with you (e.g., health benefits, bonus payments, company un-funded pension payments, expenses).

Processing that is necessary to perform obligations under any previous employment (or other) contract you had where liability now lies with UKAR.

Processing that is necessary for our own legitimate interests or those of third parties provided these are not overridden by your interests. In each case the specific legitimate interest pursued is to manage and provide a continued service and handle our business operations, respond to requests/complaints, manage business transactions (sale/acquisition), enforce legal rights and legal claims, and adhere to our compliance obligations, including audits and record retention obligations.

To whom will your personal data be disclosed?

In connection with the purposes set out above, we may share personal data with third parties in limited circumstances and where lawful to do so. These third parties may provide services to UKAR, such as legal advice, administration of former-employee medical insurance schemes, complaints handling, and IT hosting and/or maintenance.

UKAR has no employees, and so has appointed PricewaterhouseCoopers LLP (“PwC”) to act as its outsourced service provider. Personal data will be processed by PwC where it is required in order for PwC to meet its contractual obligations to UKAR.

It may also be necessary for us to transfer your personal data to third parties in connection with any future transfer or disposal of our business. Should this occur, we will take appropriate steps to ensure your personal data remains protected in line with applicable law.

Your personal data will only ever be processed within the United Kingdom or a country within the European Economic Area (“EEA”). Your personal data will not be sent outside of the EEA by UKAR or any of its third-party service providers.

Security of your Personal Data

UKAR takes the protection of your personal data seriously and we have implemented technical, physical and organisational measures to ensure your personal data is kept accurate, up to date and protected against unauthorised or accidental destruction, alteration or disclosure, accidental loss, unauthorised access, misuse, unlawful processing and/or damage.

Data Retention

We will retain your personal data for as long as is necessary for compliance with legal or other obligations, including in relation to handling potential or actual future claims and / or complaints and in compliance with relevant tax legislation.

Your Rights

You can exercise your data privacy rights as follows:

Your right	What does it mean?
Right of access	Subject to certain conditions, you are entitled to have access to your personal data which we hold (this is more commonly known as submitting a “data subject access request”).
Right of data portability	Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a commonly-used machine readable format.
Rights in relation to inaccurate personal or incomplete data	You may challenge the accuracy or completeness of personal data which we process about you. If it is found that personal data is inaccurate, you are entitled to have the inaccurate data removed, corrected or completed, as appropriate.
Right to object to or restrict our data processing	Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data.
Right to have personal data erased	Where we are processing your personal data with your consent (and subject to certain conditions), or if you think that we no longer need your personal data or have a legitimate reason for using it, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where you think that the information we are processing is inaccurate, or the processing is unlawful.
Right to withdrawal	You have the right to withdraw your consent to any processing for which you have previously given that consent.

If you consider that we are in breach of our obligations under data protection laws, please contact us directly or you may raise your complaint with the Information Commissioner’s Office (https://ico.org.uk/global/contact-us/).

Updates to this Privacy Notice

UKAR may update this Privacy Notice from time to time in order to reflect changes in applicable law and/or UKAR’s processing of your personal data. The latest version of our Privacy Notice will always be available on our website, and you can see when this Privacy Notice was last updated by checking at the top of this page.

Contact details

If you have any queries in respect of this Privacy Notice or would like to exercise any of your rights, you may do so by writing to UKAR at the following address:

UK Asset Resolution Ltd
C/O Msp Secretaries Limited,
27-28 Eastcastle Street,
London,
England,
W1W 8DH