Win your car finance on us! Privacy Statement
Last updated: 15th May 2024 (v1.8)
In this Privacy Statement the terms ‘we’ and ‘us’ mean CarFinance247 Limited.
We are authorised and regulated by the Finance Conduct Authority (FCA), firm reference numbers is:
CarFinance 247 - 653019
We are registered in England and Wales, Company Number:
CarFinance 247 - 06035525
We are registered with the UK Information Commissioner's Office (ICO) under registration number:
CarFinance 247 - Z1897658
Your privacy is important to us, and we are committed to keeping your information secure and managing it in accordance with our legal responsibilities under applicable data protection laws.
This Privacy Statement (together with our Cookie Policy, Website/Mobile Application Terms and Conditions, Product(s) Terms and Conditions, and the applicable information provided as part of an application process) sets out the basis upon which: we will process personal information that:
- is collected from you when you apply for and/or express an interest in a product or service;
- we obtain during the provision of that product or service;
- is provided to us through www.carfinance247.co.uk ("Website"), our mobile application, over the phone or through social media.
Please read this Privacy Statement carefully as it contains important information to help you understand our practices regarding any personal information that you give to us.
By accessing, browsing or otherwise using the Website or mobile application you confirm that you have read and agree to this Privacy Statement. If you do not agree with any part of this Privacy Statement, you should not use the Website or mobile application. If you are applying for one of our products or services online or by phone and do not agree with any part of this Privacy Statement, you should not continue with your application.
1. What information we collect
We may collect personal information (which means any information about an individual whose identity is apparent or can be reasonably ascertained from such information) from you in connection with a service or product provided to you by us, including:
- Your name,
- address,
- telephone number,
- email address,
- date of birth,
- employment details (including place of work and income),
- details of expenditure,
- passport information,
- driving licence details,
- bank details,
- credit history,
- insurance details,
- information regarding your dependants,
- IP addresses,
- transaction and credit card information,
- Sensitive data (e.g. health information regarding a disability, illness or impairment) where you inform us of such circumstances. (See our section on Sensitive Personal Data below for further details).
Where information fields are marked as mandatory on any application form that you complete, you will need to provide such information in order for us to continue with your application. Should you complete mandatory sections of the application form, but not complete the application, we may use the information provided to contact you to provide support with the application process.
Android/iOS App Location Use
1. Collection of Location Data: We only collect location data when it is necessary to provide you with a personalised experience, specifically for vehicle search purposes. This data is collected solely to enhance your user experience within the app.
2. Use of Location Data: The location data collected is used exclusively within the app and is not stored or shared with any third parties. It is utilised in real-time to customise your search results based on your current location, providing you with relevant information and options.
3. Storage and Sharing: We do not retain any location data beyond the duration of your app session. Once you exit the app, the location information is discarded and not stored on our servers or shared with any external entities.
4. Opt-Out: You have the option to disable location services within the app settings if you prefer not to share your location data. However, please note that this may limit certain features and functionalities of the app that rely on location information.
2. How We Collect Your Information
We collect information provided in connection with the following activities:
- If you apply for or purchase any product or service from us;
- Where you provide information to us on our Website, our mobile application, in writing, through social media, or over the phone (including via call recording);
- If you register an interest in a job vacancy, or a product and/or service,
- If you request information or assistance from us;
- If you make a complaint;
- Information provided to us from third parties including lenders, credit reference agencies, tax authorities, fraud prevention agencies, market information sharing databases, motor dealers, brokers and introducers; and
- Use of the features of the Website or mobile application that may be offered from time to time, and may require such information in order to utilise the feature.
3. Lawful Basis for Processing
Four lawful bases have been defined for the processing of data:
Consent
Consent to the processing of personal data for one or more specific purposes are outlined in detail within this privacy statement - however, in summary they include:
- For marketing activities;
- In connection with the introduction and administration of a consumer credit agreement;
- For the purpose of introduction and administration of related insurance policies,
- For enabling you to search our motor vehicle database prior to any subsequent dealer introduction;
- To enable us to provide you with information on your current finance agreement and to provide you with information on any future finance options for which you may become eligible>/li>
Contract
Legal Obligations
Processing is necessary in order for us to adhere with legal and regulatory obligations. These obligations include, but are not limited to:
- HM Government for money laundering and financial crime prevention,;
- Financial Conduct Authority (FCA) to evidence robust system and controls;
- Information Commissioner's Office (ICO) to evidence appropriate technical arrangements for the processing and control of data
Legitimate Interests
Processing is necessary for the purposes of credit profiling to enable us to develop and improve product offering. Any data held for this purpose will be psedonymised and retained only for the purpose of improving product and service offerings and will not be used for any other purpose including communicating directly to you as an individual data subject.
Depending on the continuing relationship with us, ordinarily all four legal basis for processing will apply and we will not use personal data for any other purpose than written within this Privacy Statement.
During the processing of your personal data, CF247 may identify special category data in the course of business. We will always obtain explicit consent from you when recording this data, and it will only be used for the specific purpose of facilitating the contract.
CF247 and associated companies will rely on the lawful bases of consent, contract and legal obligations when processing data for the purpose of an application for employment.
4. Use of Your Information
Your information will be used by us in connection with the following purposes:
Service Provision and Internal Processing
- to provide the product or service that you applied for;
- to allow us to consider and process your application and/or enable a third party lender (from our carefully selected panel of lenders) to provide you with a suitable car finance product or service tailored to your need;
- to evaluate risk in connection with the provision of car finance in the event we process your application and agree suitable car finance products through our own lending division, 247 Money, in particular credit and credit related services (including lending risks). For further information, see section below on Credit Checking and Automated Decision Making;
- to confirm, update and improve our customer records;
- to allow us to provide a quotation and process your application to enable a third party insurer to provide you with a suitable insurance product or service tailored to your individual needs;
- to validate claims (i.e. to ensure that your account is not being used without your agreement) and to report on the performance of an account;
- to troubleshoot problems with the Website or mobile application, or to customise your experience on the Website or mobile application;
- to assess what forbearance options are appropriate if you are in financial difficulties;
- to recover debts / money which you owe to us;
- to provide you with any information on the products or services you hold with us
Open Banking
We may also ask you to provide current account information via our current regulated Open Banking provider or via Bank Statements. This may also be used as part of an automated, manual, or part-automated decisioning process to assess your application and/or the suitability of the current product/service you have with us/through us, or of any other products/services you may be able eligible for. During this process, we may gather information including, but not limited to:
- Your income, including sources of income;
- Transactional information on any accounts you share with us, including patterns of spending, type of transaction, and any references/other information shared by your bank;
- Details of any missed payments, charges, debit or credit interest;
- Payment information (if you choose to make a payment to us via Open Banking or payments are made by us to you via Open Banking).
We will only obtain Open Banking data on the specific accounts you choose to share with us. During the sharing of this data, you will be redirected to your bank/finance provider, and you will be asked to complete authentication with your bank/finance provider through their own security systems. We will not, during this process or at any other time, be privy to, obtain, or seek to obtain any information about other accounts you hold with that provider (other than what can be seen via information to choose to share), or about your login/security details with that provider.
Access to the information you share with us about your account information via Open Banking may last for as long as you wish this access to continue. After 90 days, if we wish to maintain access to this information, we will ask you for a re-confirmation of your consent to access this information. If you do consent to this, we may access your data for a further 90 days. If you do not consent to this continued access/do not respond to any re-consent, then any access to this information will be revoked (please note that any revocation of access to Open Banking data may impact our ability to assess if the products/services we offer/you have with/through us is appropriate, and these product/services may no longer be available to you and/or products/services you hold may be withdrawn).
Management of Relationship
- to manage, analyse, understand and develop your relationship with us;
- to inform you about improvements to the Website or mobile application;
- to keep you informed of any of our other/new products and services and identify and market products and services that may be of interest to you, where you have chosen to be made aware of this, and to assist in any future applications to us.
Queries/Problems
- to respond to any queries or complaints that you may have;
- to contact you if an application you have started is incomplete;.
Training, Service Review and Statistics
- for training purposes and to enhance or review the service we provide or have provided to you;
- to conduct statistical analysis and research (where possible using anonymised data);
Legal Obligations
- to prevent, investigate and prosecute crime, fraud and money laundering and for auditing purposes;
- if we are obliged to disclose information by reason of any law, regulation or court order;
- if we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to employ you, or we may stop providing existing services to you;.
- A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details provided;
General
- the personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity;
- both we and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime
- to process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested;
- fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years;
Other
- to consider you for potential job opportunities where you provide us with a CV, complete an application on LinkedIn or complete a candidate registration form;
- to transfer information to any entity which may acquire rights in us;
- for any other purpose to which you agree
5. How We Might Share Your Information
The third parties with whom we may need to share personal information to help us provide services and products to you are detailed within this section.
Car, Bike and Van Finance
Our partners, including brokers, introducers, lenders and motor dealers we work with dependent upon your individual credit profile and the specific criteria determined by the lender.
Premium Credit Limited (Insurance premiums only)
Guaranteed Asset Protection (GAP) Insurance
Insurance providers, in the event that you apply for an insurance product, for the purposes of underwriting, processing, claim handling and fraud prevention; The current panel of insurers and insurance brokers are:
AmTrust (GAP only)
Some of our insurance providers will use your personal information to assess your circumstances (including information about any other person who you choose to be a Named Driver on your policy) and verify the information that you have provided before providing a quote.
We or the insurer or the re-insurer will exchange information with various databases and registers to help us check information provided, to detect and prevent crime or fraud and to obtain information about your no claims history. These may include the Claims and Underwriting Exchange Register run by Insurance Database Services Limited (IDS Ltd), the Motor Insurance Anti-Fraud and Theft Register run by the Association of British Insurers (ABI) and any other relevant industry databases or registers. Information may be shared with these registers and checks carried out against the information held on these registers when we or the insurer or the re-insurer deal with your request for insurance, at renewal, when amendments are made to your motor policy, where a claim is made or where it is necessary to update our policy records.
Information relating to your insurance policy will be added to the Motor Insurance Database (MID) managed by the Motor Insurers' Bureau (MIB). MID and the data stored on it may be used by certain statutory and/or authorised bodies including the Police, the DVLA, the DVLANI, the Insurance Fraud Bureau and other bodies permitted by law for purposes not limited to but including:-
I. Electronic Licensing
II. Continuous Insurance Enforcement
III. Law enforcement (prevention, detection, apprehension and/or prosecution of offenders)
IV. The provision of government services and/or other services aimed at reducing the level and incidence of uninsured driving.
If you are involved in a road traffic accident (either in the UK, the EEA or certain other territories), insurers and/or the MIB may search the MID to obtain relevant information. You, or appointed representatives, pursuing a claim in respect of a road traffic accident (including citizens of other countries) may also obtain relevant information which is held on the MID.
Please be aware that any false or incorrect information provided may result in your insurance provider invalidating the quote you are given or may lead to your insurance policy being cancelled at a later date.
Other
- Our subsidiaries or affiliates, for the purpose of managing our customer relationships, administering our business and to provide you with information about other products and services which might be of interest to you;
- Service providers who need to know the information in order to provide us or you with a product or service (including our third party service providers who process information on our behalf to help run some of our internal business operations including email distribution, electronic signature processing, storage of customer documentation, our HR careers portal, IT services, customer services and for data analytics (using anonymised data));
- Third party credit providers at your request where you have been unsuccessful in applying for personal lending services and/or product(s); in which case third party credit providers will become the relevant data controller;
- Credit and fraud agencies (including Call Credit, Equifax, Experian and Cifas) to help make decisions (See Section 6: Credit Checking and Automated Decision Making for more information).
- Law enforcement bodies in order to comply with any legal obligation or court order.
- Third parties for the purpose of validating and assessing fitness and propriety in connection with any application for employment.
- Entities who may or do acquire any rights in us for the purpose of a business sale or reorganisation;
- CF247 business advisors, for the purpose of assisting us to better manage, support or develop our business and comply with our legal and regulatory obligations
- Occasionally, we may make your details available to reputable suppliers of credit and insurance related services that we feel may be of interest to you where you have agreed to receive such marketing.
- Debt recovery agencies or service providers, tracing agents or investigators, solicitors or other agents for the purpose of collecting monies or assets due or outstanding on your account;
- We reserve the right to sell performing and non performing accounts. We will inform you if we do this.
6. Credit Checking and Automated Decision Making
Whenever you apply for any of our products and/or services, or to make decisions about future products, services and offers that we think you may be interested in the future we and/or our lenders will carry out checks with credit reference agencies ("CRAs"), including-
- Checks against publicly available information such as the Electoral Register, County Court Judgments (CCJs), bankruptcy or repossession information. These checks may be referred to as "soft searches" or "quotation searches" and are visible to only you;
- Checks against data relating to your financial situation and financial history. These checks may be referred to as "hard searches" or "credit application searches" and may be visible to other third parties, such as potential lenders
- • During the lifetime of an agreement introduced through CF247 or provided by 247Money we may complete checks of publicly held information such as the Electoral Register, County Court judgements (CCJ’s), bankruptcy or repossession information, as well as data relating to your financial situation and financial history and these may show as ‘account management searches’ or ‘portfolio management searches’ and are only visible to you.
We will use this information to:
- Assess your creditworthiness and whether you can afford to take the product;
- Verify the accuracy of the data you have provided to us;
- Prevent criminal activity, fraud and money laundering;
- Manage your account(s);
- Trace and recover debts; and ensure any offers provided to you are appropriate to your circumstances.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application.
CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail within the Credit Reference Agency Information Notice (CRAIN). CRAIN is also accessible from each of the three CRAs clicking on any of these links will also take you to the same CRAIN document: Equifax, Callcredit and Experian.
Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to "international frameworks" intended to enable secure data sharing.
Credit scoring is an automated decision. The decision on the provision of credit provided by 247 Money is subject to the use of credit scoring, however may also be subject to a manual review and assessment, however if we were to reject your application solely on the basis of a credit scoring system, you can request human intervention and ask us to reconsider your application.
7. Retention of Your Personal Information
The personal information that you provide will be retained by us in accordance with applicable laws. However, in accordance with our lawful basis, data will only be retained in line with our stated policy approach and only be used for the purposes detailed, any marketing activity will only be undertaken where we have your consent, following the conclusion of your relationship or employment with us. Where the information is retained under our legitimate interests basis, personal data will be psedonymised and held securely and will not be used to contact you directly or for marketing purposes.
Our retention policies are aligned to individual rights and freedom and any request under those rights will be met in accordance with our stated lawful bases or obligations.
8. Sensitive Personal Data
Sensitive personal data includes information about an individual's health and other categories of personal information which are closely protected (e.g. criminal convictions). We do not generally process such information, unless you have voluntarily provided that information to us (for example, where you have notified us of a health issue).
You agree that, to the extent that you have provided us with sensitive personal data, you provided it voluntarily and agree that we can use any sensitive personal data that you provide us to deliver products or services to you and/or determine your fitness to avail yourself of our products or services. Where possible we shall seek to minimise the collection and use of such sensitive personal data.
9. Marketing
Where you tell us you are happy to receive information from us we may send you communications products that we perceive may be of interest to you (including in relation to products and/or services of our partners where we have your agreement).
Depending on the contact preferences you select, we will communicate with you by letter, telephone, SMS, email or other electronic means such as via social and digital media.
If, at any time, you prefer not to receive further communications from us in any or all forms (except in connection with information, products or services that you specifically request), you will have the ability to unsubscribe from such communications by means of a link provided in every e-mail that is sent to you by us or by contacting us (See section on Contact Us below).
10. Refer a Friend
When you provide details of a friend to whom an e-mail is to be sent you confirm the following:
- That you have obtained the consent of your friend to pass your friend's details to us and for your friend to receive the e-mail from us.
- That you are happy for us to disclose your details as the person who asked that we send the e-mail to your friend.
We will not use that person's details for any marketing purposes.
11. Third Party Websites
Our Privacy Statement does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you in our "car search" results. Our Privacy Statement does not cover the information practices of other companies and organisations that advertise our services and that may use cookies, pixel tags and other technologies to serve and offer relevant ads. Please see section titled 'Access to Website' in our Website Terms and Conditions for further details.
12. Email
Emails sent via the internet can be subject to interception, loss or possible alteration, therefore we cannot guarantee their security. Although we will do our best to protect your personal information, we cannot guarantee the security of your data sent by email and therefore will have no liability to you for any damages or other costs in relation to emails sent by you to us via the internet. If you would like to contact us, please see the section below or use our contact us page.
13. Childrens Privacy
It is highly unlikely that we will target particular products at a different age group, the Website is not intended for use by individuals under the age of 18 without the agreement and involvement of a parent or guardian.
We do not knowingly collect personal information from individuals under the age of 18. Where we are able to identify that an individual under the age of 18 has used our services (e.g. the individual may have entered a date of birth into the application form) we will ensure no further processing of the individual"s data takes place except for the purpose of erasing the data.
14. Keeping your information secure
We invest appropriate resources to protect your personal information, from loss, misuse, unauthorised access, modification or disclosure, in particular:
- We review our information collection, storage and processing practices, including physical security measures, to guard against unauthorised access to systems.
- We restrict access to personal information to our employees, contractors and agents who need to know that information in order to process it for us and who are subject to strict contractual confidentiality obligations. They may be disciplined or their contract terminated if they fail to meet these obligations.
We and the other companies processing your data for the purposes mentioned in Section 4 may from time to time need to undertake some of the processing in countries outside of the European Economic Area. Different privacy laws may apply in these countries and you understand and unambiguously agree to the transfer of personal information to these countries and parties. We only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect any information held in that country or that the service provider acts at all times in compliance with applicable privacy laws.
15. Updates to this Privacy Statement
Our Privacy Statement applies to all of the services offered by us. We will keep this Privacy Statement under review and make updates from time to time. We will not reduce your rights under Privacy Statement without your explicit consent. We will post any Privacy Statement changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Privacy Statement changes). If you do not accept the amended Privacy Statement, you should stop using the Website; this may affect our ability to provide certain products and services to you. Please see the section regarding Your Rights for further information regarding continued processing.
16. Cookies
Our website uses cookies (including Google Analytics cookies to obtain an overall view of visitor habits and visitor volumes to our Website). To view more information on what cookies we use and how we use them please review our separate Cookie Policy.
17. Your Rights and Freedoms
You have a number of rights under Data Protection law including:
Right to be informed - We provide all customers with this privacy statement to provide transparent and clear information as to arrangements for the collection, control and processing of personal data.
Right of Access - Copies of personal data held can be requested under an access request and will be met in the 30 day legislative standard ordinarily free of charge. Any extension to these requirements will be advised on the basis of the nature of the request but will be by exception and subject to senior management scrutiny, please see contact us section for further detail.
Right to Rectification - In the event we hold inaccurate data please advise us of the correct information and records will be updated within 72 hours and confirmation provided accordingly (Subject to satisfactory verification of your identity).
Right to Restriction of Processing - Data processing will be restricted whilst any claim of accuracy is being contested by you, or you have challenged the legal basis or legitimate grounds for processing for a specific purpose and to establish, exercise or defend legal claim at your request.
Right to Object - You can object to us processing on the basis this is contrary to your rights and freedoms, any objection relating to direct marketing will be acted upon within 48 hours, other objections will be treated as a complaint and assessed against our documented legal basis.
Right to Erasure - Commonly known as the right to be forgotten, we will adhere to your request ordinarily within 72 hours where legal basis is solely or partially established as consent, any data required for legal, regulatory or legitimate interests maybe maintained in accordance with documented retention schedules. However our team will confirm and discuss your request to ensure your rights and freedoms are observed at all times.
Right to Data Portability - You have the right to receive the personal data that you provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller in a timely manner, generally 72 hours unless evidenced to be unduly excessive or unreasonable.
You have a further right in connection with automated decisions, however this is covered in the relevant section of this statement.
We have established robust policy and procedural requirements to enable your rights as a data subject to be adhered with, however where this is not possible for the reasons outlined we confirm the detail.
In relation to all of these rights, please write to or contact us at the address below. Please note that we will need to verify your identity.
18. Complaints Process
If you have a complaint about how we have handled your personal information you may contact us using the details below and we will investigate your complaint. You also have the right to lodge a complaint with a supervisory authority (i.e. the ICO) once you have tried to resolve the issue with us.
19. Contact Us
If you have any questions about this Privacy Statement, or you think we have incorrect information or you would like a copy of the information we hold about you, you may request details of personal information which we hold about you please do not hesitate to contact us via any of the below
Address:
Data Protection Officer
247 Group
6th Floor
Universal Square
Devonshire Street North
Manchester
M12 6JH
Queries:
info@carfinance247.co.uk
Complaints:
customercare@carfinance247.co.uk
Telephone Queries:
0161 850 4939
Get in touch
Contact usUniversal Square,
Devonshire Street North,
Manchester,
M12 6JH,
* The UK's largest online car finance broker by unique users to the website. Based on Similar Web data – 1,137,647 to CarFinance 247 vs. 753,819 for nearest competitor. January to June 2023.
CarFinance 247 is a trading name of CarFinance 247 Limited. Registered office: Universal Square, Devonshire Street North, Manchester, M12 6JH. Registered in England. (Registration Number 06035525).
CarFinance 247 is authorised and regulated by the Financial Conduct Authority for insurance distribution and credit broking (Firm Reference Number: 653019). CarFinance 247 is registered with the ICO (Registration Number Z1897658).
Finance is subject to status and is only available to UK residents aged 18 and over. Written quotations are available on request.
This site uses cookies so that we can provide you with the best user experience. By continuing to use the site you are consenting for cookies to be used. Further information on cookies and how you can disable them is available on our cookie policy.