Privacy Notice
UK Asset Resolution Ltd “UKAR Ltd” takes its obligations with regard to data protection seriously. As such, we are providing this notice (“Privacy Notice”) to you so that you are provided with information about how UKAR Ltd collects and processes your Personal Data. Please read this Privacy Notice, as it contains important information which you should be aware of.
UKAR Ltd is the data controller with regard to the processing of your Personal Data (as defined below), unless specifically stated otherwise.
- What do we collect and process?
In order for UKAR Ltd to manage its business efficiently, it is necessary for us to collect, maintain and process your Personal Data. “Personal Data” is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
UKAR Ltd may process the personal data of the following data subjects:
- former and current Bradford & Bingley plc (“B&B”) and NRAM Limited (“NRAM”) employees
- beneficiaries of the B&B Staff Pension Scheme and the NRAM Pension Scheme
- beneficiaries of the private medical insurance scheme currently administered by B&B
- individuals who previously held a mortgage with B&B, NRAM, NRAM plc or Mortgage Express (“MX”) that has been sold to a third party purchaser as part of a previous asset sale
- individuals who currently hold a mortgage with B&B, NRAM or MX
UKAR Ltd may process the following different kinds of personal data:
- Personal details such as your full name, current/previous addresses, date of birth, telephone numbers and e-mail addresses;
- Financial and transactional details regarding any mortgage account you may have or have had with B&B, NRAM, NRAM plc or MX, such as the balance on your account, monthly payments and arrears information;
- In respect of current or former employees of B&B or NRAM, employment date, employee ID number, job title / role, details relating to expenses or salary and your bank account details;
For the avoidance of doubt UKAR Ltd currently does not process any special category personal data, as such term is defined in relevant data protection legislation.
Personal Data has been collected from a few limited sources, including, in some cases, directly from you. In other cases, your Personal Data has been transferred from B&B, MX or NRAM, where lawful to do so. Personal Data has also been collected by UKAR Ltd from other third parties or publicly available information about you which UKAR Ltd has access to.
Please note that you are under no obligation to provide UKAR Ltd with your Personal Data, however, not providing some Personal Data could prevent UKAR Ltd from performing certain contractual obligations UKAR Ltd has undertaken.
- Why and for what purpose do we collect and use your Personal Data?
The term “processing” means any action taken, also with the help of electronic means, in connection with Personal Data, including collection, handling, use, transfer and disclosure by transmission, dissemination or otherwise making available, as well as recording, organisation, storage, retention, adaptation or alteration, access, retrieval, consultation, alignment or combination, blocking, anonymising, erasure, disposal or destruction.
In the rest of this Privacy Notice we talk about having a “lawful basis” for using your Personal Data within our business. In order for our use of your Personal Data to comply with applicable data protection law, that use by us needs to fall under at least one of the specific lawful reasons that are set out in applicable data protection law. Examples of these lawful reasons include our use of your Personal Data being necessary for the performance of a contract, or our use of your Personal Data being necessary for compliance with a legal obligation.
We are required by applicable data protection law to inform you of how and why we use your Personal Data and indicate the lawful basis for such use. This may include (as relevant):
Personal data | Basis of processing | Purpose of processing |
---|---|---|
· Personal details such as full name and address, financial and transactional details regarding any mortgage account you may have or have had with B&B, NRAM, NRAM plc or MX | Processing that is necessary for our own legitimate interests, provided these are not overridden by your interests and fundamental rights and freedoms, such as:
(a) to manage liability for certain contingent liabilities agreed to as part of previous asset sales undertaken by B&B and NRAM (b) to manage claims brought in respect of historic transactions to which UKAR Ltd and/or B&B, NRAM and/or MX are a party and for which UKAR Ltd is legally and economically liable (c) assess the validity of a claim within the commercial context
|
· to assess the validity of a claim
· to manage, verify, audit and mitigate any claims relating to the liabilities assumed by UKAR Ltd · to establish any defence against claims |
· Name, title and address
· Contact information (including telephone number, postal address and email address) · Signature · Date of birth · Employment date · Employee ID number · Job title/Role · Salary/Fees and benefits (including level and history and performance bonus, if relevant, tax information and pension information, if applicable) · Bank account information · Payments to/from third parties · Information you provide in relation to your family which may include but not be limited to name, date of birth and medical/health data
|
Processing that is necessary to fulfil a contract or when taking steps in connection with a contract with you, such as:
(a) to set up and to administer any agreed benefit or payment process we have agreed with you (health benefit, bonus payments, company un-funded pension payments, expenses etc)
|
· to administer benefits, including pension, expenses, private medical insurance, company un-funded pension payments etc, as applicable;
· to perform obligations under any previous employment (or other) contract you had where liability now lies with UKAR Ltd.
In each case the specific legitimate interest pursued is to manage and provide a continued service.
|
· Name, title and address
· Previous name(s) · Contact information (including telephone number, postal address and email address) · Date of birth · Employment date · Employee ID number · Job title · Salary and benefits (including level and history and performance bonus, if relevant, tax information and pension information, if applicable) · Expenses · Performance Development Reviews · Attendance/absence data · Disciplinary data
|
Processing that is necessary for our own legitimate interests or those of third parties provided these are not overridden by your interests and fundamental rights and freedoms, such as:
(a) for payments and expenses administration, pension administration, health insurance/benefits (b) to respond to and/or deal with requests, enquiries or complaints; (c) in connection with the sale or acquisition of a business (including the necessary due diligence associated with such transactions); (d) for establishment and defence of our legal rights;
|
· to respond to and/or deal with requests, enquiries or complaints.
· the sale or acquisition of a business (including the necessary due diligence associated with such transactions). · the acquisition of a legal obligation (including the necessary due diligence associated with such acquisition). · audits. · financial forecasts. · compliance with UKAR Ltd policies. · dealing with legal claims and record retention obligations. · other related administrative activities. · UKAR Ltd may also use Personal Data to establish or exercise its legal rights.
In each case the specific legitimate interest pursued is to manage and provide a continued service.
|
· Name, title and address
· Contact information (including telephone number, postal address and e-mail address) · Date of birth · Employment date · Employee ID Number · National Insurance Number · Gender · Information required to provide reasonable adjustments under relevant disability discrimination laws · Religious or philosophical beliefs · Details of any criminal allegations or offences
|
Processing that is necessary to comply with a legal obligation to which we as the data controller are subject (other than a contractual obligation), such as:
(a) to process a request by you to exercise your rights under applicable data protection law or other laws;
|
· for compliance with local legal requirements/applicable laws; · regulatory requirements; · for the purposes of fraud prevention
In each case the specific legitimate interest pursued is to manage and provide a continued service.
|
Please note: this list may be updated from time to time.
We may convert your Personal Data into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from that data. We may use this aggregated data to conduct research and analysis, including to produce statistical research and reports. We may share such anonymous aggregated data with third parties. Aggregated and anonymous data does not personally identify you and is therefore not Personal Data.
- Who will your Personal Data be disclosed to?
Personal data will only be shared with authorised third parties and only in limited circumstances and where lawful to do so.
We use third party service providers who provide services including, medical insurance providers, IT hosting and/or maintenance providers. UKAR Ltd has also engaged PricewaterhouseCoopers LLP (“PwC”) to provide certain administrative functions on behalf of UKAR Ltd. Personal Data will be shared with PwC where such Personal Data is required in order for PwC to meet its contractual obligations to UKAR Ltd. In providing the services, your Personal Data will, where applicable, be used by the service provider on our behalf.
We will check any third party that we use to ensure that they can provide enough guarantees regarding the confidentiality and security of your Personal Data. We will have written contracts with them which provide assurances regarding the protections that they will give to your Personal Data and their compliance with our data security standards and international transfer restrictions.
Your Personal Data may be sent outside the European Economic Area.
Consequently, your Personal Data will be used in what is one of the “third countries”. It is important to understand that “third countries” are not deemed by the European Commission to have adequate legal protections for Personal Data. We have implemented appropriate technical and organisational measures to protect your Personal Data in the form of (standard data protection clauses. If you would like to obtain a copy of the standard data protection clauses, please contact us using the details above).
- Security of your Personal Data
As stated above, UKAR Ltd takes the protection of your Personal Data seriously and we have implemented technical, physical and organisational measures to ensure your Personal Data is kept accurate, up to date and protected against unauthorised or accidental destruction, alteration or disclosure, accidental loss, unauthorised access, misuse, unlawful processing and/or damage.
- Data Retention
We will retain your Personal Data for as long as is necessary for compliance with our legal obligations, including compliance with relevant tax legislation, for which the normal retention period is 7 years following the cessation of your benefit.
- Your Rights
You can exercise your data privacy rights as follows:
Your right | What does it mean? |
---|---|
Right of access | Subject to certain conditions, you are entitled to have access to your Personal Data which we hold (this is more commonly known as submitting a “data subject access request”).
|
Right of data portability | Subject to certain conditions, you are entitled to receive the Personal Data which you have provided to us and which is processed by us by automated means, in a commonly-used machine readable format.
|
Rights in relation to inaccurate personal or incomplete data | You may challenge the accuracy or completeness of Personal Data which we process about you. If it is found that Personal Data is inaccurate, you are entitled to have the inaccurate data removed, corrected or completed, as appropriate.
|
Right to object to or restrict our data processing
|
Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your Personal Data. |
Right to have Personal Data erased | Where we are processing your Personal Data with your consent (and subject to certain conditions), or if you think that we no longer need your Personal Data or have a legitimate reason for using it, you are entitled to have your Personal Data erased (also known as the “right to be forgotten”), e.g. where you think that the information we are processing is inaccurate, or the processing is unlawful.
|
Right to withdrawal | You have the right to withdraw your consent to any processing for which you have previously given that consent.
|
If you consider that we are in breach of our obligations under data protection laws please contact us directly or you may raise your complaint with the Information Commissioner’s Office (https://ico.org.uk/global/contact-us/).
- Updates to this Privacy Notice
UKAR Ltd may change this Privacy Notice from time to time in order to reflect changes in the law and/or its privacy practices. When this happens and where UKAR Ltd is required to do so by law, it will publish a new and/or updated Privacy Notice detailing how the use of your Personal Data is changing..
- Contact details
If you have any queries in respect of this notice or would like to exercise any of your rights, you may do so by writing to the UKAR Ltd Data Protection Officer, using the following methods:
UKAR Ltd Data Protection officer
FAO Central Team
PricewaterhouseCoopersLLP
Central Square,
29 Wellington Street,
Leeds,
LS1 4DL
Email address: uk_UKARcentralmail@pwc.com