HOW WE USE THE INFORMATION WE HOLD ABOUT YOU This policy applies to information we hold about you. In this policy, ‘Multipass’, ‘we’, ‘us’, and ‘our’ mean Multipass International Ltd, registered number 09110802. Our trading address is at Level39, One Canada Square, London, E14 5AB, United Kingdom. ‘You’ means any person, firm, company, corporation, government, agency, association, trust or partnership, wherever located or incorporated, whom the information relates to. This policy applies to information held about our customers and possible future customers, suppliers and possible future suppliers, contacts and all other people we hold information about. By ‘information’ we mean anonymised or personal about you that we collect, use, share, process and store. It includes information about any Multipass products and services (or products and services provided by our partners) you currently have, you’ve applied for or you’ve had in the past. WHERE THIS INFORMATION COMES FROM We collect, use, share, process and store information about you to provide you with the services you have asked us for, and to share information with you about services or products that may be of interest to you. You may provide this information direct to us, for example by the way you communicate or do business with us, such as: ■applying for our products or services; ■using our websites or mobile applications; ■writing to us; ■entering competitions or promotions; ■downloading any of our mobile applications or using our websites or digital services; ■providing us with your location to help find nearby services or companies; ■using and managing your accounts; and ■giving information to us at any other time, including through social media. This information may also come from other organisations or people, other organisations you have a relationship with, joint account holders, credit reference agencies, employers, fraud prevention agencies or other organisations. If you do not provide the information that we ask for, this may mean that we are unable to properly provide you with our services or carry out all our obligations under our agreement with you. HOW WE USE YOUR INFORMATION We use this information: ■to provide our services to you; ■help us develop new and improved products and services to meet our customers’ needs; ■to carry out checks for security purposes, to prevent fraud and money laundering, and to confirm your identity before we provide services to you; ■for training; ■to communicate with you; ■to meet the obligations we have by law and under any regulations that apply; ■where we have a legitimate interest in using your information, for example to protect our business interests or to prevent fraud; and ■to keep you informed about products and services you hold with us and to send you information about products or services (including those of other companies) which may be of interest to you. Under data protection laws, whenever we process your personal information, we must meet at least one set condition for processing. These conditions are set out in data protection law and we rely on a number of different conditions for the activities we carry out. Specifically, we may use your information for the following purposes and under the following legal bases. To provide and manage your accounts and our relationship with you: ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you. ■Where the law requires this. ■Where it’s in our legitimate interests to make sure that our customer accounts are well-managed, so that our customers are provided with a high standard of service, to protect our business interests and the interests of our customers. To give you statements and other information about your account or our relationship with you: ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you. ■Where the law requires this. To handle enquiries and complaints: ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you: ■Where the law requires this. ■Where it’s in our legitimate interests to make sure that complaints are investigated, for example, so that our customers receive a high standard of service and so that we can prevent future complaints. To provide our services to you: ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you. ■Where the law requires this. For assessment, testing and analysis, including credit or behaviour scoring (or both), statistical, market and product analysis and market research: ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you. ■Where the law requires this. ■Where it is in our legitimate interests to develop, build, implement and improve our business models, systems, products and services, and to ensure we continue to be competitive and provide a high standard of service. To evaluate, develop and improve our services to you and other customers: ■Where it’s in our legitimate interests to continually evaluate, develop or improve our products as well as the experiences of users of our sites, so that we provide our customers with a high standard of service. To protect our business interests and to develop our business strategies: ■Where it’s in our legitimate interests to protect our people, business and property and to develop our strategies. ■Where necessary to carry out our agreement or to take steps to enter into an agreement with you. ■Where the law requires this. ■Where you agree, if we are using sensitive information, such as medical details. To contact you, by post, phone, text, email and other digital methods: ■Where we have agreed to contact you in our agreement. ■Where the law requires this. ■Where you agree. ■Where it’s in our legitimate interests to share information with you about products or services that may be relevant and beneficial to you. Where we send you marketing messages, you can always tell us if you no longer want to receive them. To make sure any marketing messages we send you are more relevant to you: ■Where we have a legal basis to send you marketing messages as set out above, because it’s in our interests to make sure that our marketing messages are relevant to you, and where you agree. To collect any debts you owe us: ■Where it’s in our legitimate interests to collect any debts you owe us. To prevent, detect, investigate and prosecute fraud and alleged fraud, money laundering and other crimes, and to check your identity: ■Where the law requires this. ■Where it’s in our legitimate interests to prevent and investigate fraud, money laundering and other crimes, and to check your identity in order to protect our business and to keep to any laws that apply to us. ■Where must process your information under the contract for the services or financing you have asked us to provide. To assess any application you make, including checking for fraud and money laundering, confirming your identity, and carrying out any other regulatory checks: ■Where you have made the information public. ■Where it’s in our legitimate interests to protect our business interests. ■Where the law requires this. To monitor, record and analyse any communications between you and us, including phone calls: ■Where it’s in our legitimate interests, to check your instructions to us, to prevent and detect fraud and other crime, to analyse, assess and improve our services to customers, and for training purposes, to improve the services we provide to our customers and to protect our business interests. To check that your mobile phone is in the same place as your payments are being made from: ■Where it’s in our legitimate interests to prevent fraud. To share your information with UK or other relevant tax authorities, credit reference agencies, fraud prevention agencies, and UK and overseas regulators and authorities: ■Where the law requires. ■Where we have a legitimate interest in carrying out certain credit checks so that we can make responsible business decisions. ■Where we have a legitimate interest in helping to prevent and detect fraud and other crime. To share your information with our partners and service providers: ■Where necessary to carry out our agreement. ■Where we have a legitimate interest in using other organisations to provide some services for us or on our behalf. Data protection law allows us to use personal information for our genuine and legitimate reasons as long as we respect your rights and freedoms. This lawful basis for using your information is called ‘legitimate interests’. When we rely on our legitimate interests as the legal basis for processing your personal information for the purposes set out above, we will carefully consider and balance any possible effect this may have on you and your rights. SENSITIVE INFORMATION We will occasionally need to use sensitive information about you in the following ways. We will use information about your health if this is relevant for us to help you if you are struggling with a debt, it is relevant to a complaint you are making about us, it is relevant to how you want us to contact you, or it provides us with relevant information about how you are spending your money. We will also use sensitive information about you if this is considered to be in the public interest (for example, to support you if you are a vulnerable customer) or if you agree. We may also process some information that relates to criminal convictions if this is in the public interest (for example, to prevent or detect financial crime). AUTOMATED DECISION-MAKING If you apply to us for a product or service, we have an automated decision-making process which will carry out fraud, credit and affordability assessment checks to decide whether we will accept your application. The automated processes may decline or refer your application. If your application is referred, this means we will manually review your application before making a final decision. We will also use automated decision-making to: ■decide credit, spending or affordability limits; ■detect and prevent fraud by monitoring transactions (we may contact you to check that you were carrying out these transactions); ■carry out automated financial crime checks; and ■carry out our agreement, take steps to enter into an agreement with you, or where required or authorised by law. How the automated processes make decisions Affordability: the processes will consider your income, spending and credit history to decide how easily you will be able to manage repaying credit. We may compare you with other people in a set (for example, people who are in a certain age bracket may be more likely to be able to manage credit). Regulatory assessment: certain details in your information may suggest that you are likely to become financially vulnerable and we may need to help you. Financial crime checks: the processes will compare your details with the details of countries, organisations and people who sanctions apply to, to decide whether we are prevented from doing business with you under sanctions law. This means that we may automatically decide that you present a fraud or money-laundering risk, or risk of breaking financial sanctions, if the processing reveals your behaviour to be consistent with money laundering or known fraudulent behaviour, is inconsistent with information you have previously provided, or you appear to have deliberately hidden your true identity. SHARING YOUR INFORMATION WITH OTHERS We’ll keep your information confidential, but we may share it in certain circumstances, for the purposes set out in this policy, with: ■other companies who provide a service to you, for example if you use our products to make a purchase or payment; ■any company we are providing services with or whose name or logo appears on our products; ■our service providers and agents, including their subcontractors; ■anyone we transfer or may transfer our rights, duties, debts or assets to; ■credit reference agencies; and ■fraud prevention agencies. The people and organisations listed above will also have to keep it secure and confidential. We may be required to share your information as follows: ■with UK and overseas regulators and authorities in connection with their duties (such as preventing crime); ■with any other person or organisation after a restructure, sale or takeover of our company or debt, as long as that person or organisation uses your information for the same purposes as it was originally given to us or used by us (or both); ■if we have a duty to reveal it, if it is needed to manage your accounts, or if a law or regulation allows us to do so for legitimate business purposes or with your permission; ■when checking your details and credit history and confirming your identity; ■when recovering debt; ■when making enquiries when you ask for any lending products or investment products and to help us manage your account. Information about other people If you give us information about other people (such as people who depend on you financially or additional cardholders), which we will use to provide services as set out in this policy, you are confirming that you have provided those people with a copy of this policy. Your information may be linked to people who are associated with you, such as your partner or other members of your household. These linked records are called associated records. If we contact a credit reference agency with an enquiry about you, they may answer it by referring to the records of anyone associated with you. HOW LONG WE WILL KEEP YOUR INFORMATION We will keep your information for as long as is needed for the purposes set out above or as required by any laws that apply. If you close your account, if we refuse your application for an account or product, or you decide not to go ahead with your application for an account or product, we’ll still keep your information. We may also continue to collect information from credit reference agencies to use after your account is closed. We’ll do this for as long as we’re allowed to for legitimate business purposes, to help prevent fraud and other financial crime, and for other legal and regulatory reasons. YOUR RIGHTS You have rights relating to the way that we use your information. You have the right to: ■ask us to send you (or someone you nominate) a copy of the information we hold about you; ■ask us to correct or delete any incorrect or incomplete information we hold about you (we will correct any information we believe is incorrect or incomplete); ■ask us to stop using your information (we will stop using your information if there is no legal reason for us to continue to hold or use it); ■object to any automated decision-making; ■ask us to transfer certain personal information to you or to another organisation, including service providers, in a format they can use where this is technically possible (known as the ‘right to data portability’); ■ask us to transfer a copy of some of your information to you or to another organisation, including service providers, where this is technically possible; ■withdraw any permission you have previously given to allow us to use your information; ■ask us to stop or start sending you marketing messages. You can exercise your rights at any time by: ■logging in to your account and updating your preferences; ■contacting us with your request via our website at www.multipass.co.uk. We analyse your personal information to allow us to send you personalised offers, discounts or recommendations based on various things, such as your credit history, the way you use your account and the products you hold with us. We will stop using your personal information for these purposes if you ask us to stop sending you all types of marketing messages. If you have any concerns about the way we use your information, you have the right to complain to the Information Commissioner’s Office, which regulates the use of personal information in the UK. You can contact them by: ■going to their website at https://ico.org.uk; ■calling them on 0303 123 1113; or ■writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. From time to time we may make changes to this policy and how we use your information in the future. If we do this, we’ll post an updated version of this policy on our website or make it available through our mobile application. You can find the current version of this policy, which explains how we’ll use your information, by visiting our website at www.multipas.co.uk.