Privacy Policy

Purpose of this Policy

This policy describes how we collect and use personal data about you, in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act and any other national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK (‘Data Protection Legislation’). This policy only applies to personal information collected or obtained by LoanOnYourCar.co.uk.

What are your rights under data protection laws?

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

• Your right to access
  You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. To access your personal records and information that we hold about you, please send a written request to info@loanonyourcar.co.uk or by post , 333 Edgware Road, London, NW9 6TD.

• Your right to rectification
  You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

• Your right to erasure
  You have the right to ask us to erase your personal information in certain circumstances.

• Your right to restriction of processing
  You have the right to ask us to restrict the processing of your information in certain circumstances.

• Your right to object to processing
  You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.

• Your right to data portability
  This only applies to the information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

If we are processing your information for criminal law enforcement purposes, your rights are slightly different.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

If you are not satisfied with any aspect of the way that we process your information or fulfil our obligations, you have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk

What this privacy policy covers

This policy only applies to personal information collected or obtained by LoanOnYourCar.co.uk.

Data anonymisation

Your personal information may be anonymised by stripping any personal data of sufficient elements that mean the individual can no longer be identified. The GDPR does not apply to personal data that has been anonymised.

How long will we keep your information?

The GDPR does not dictate how long you should keep personal data. It is up to us to justify this, based on your purposes for processing. We must store data for the shortest time possible.

Unless we explain otherwise to you, we will hold your personal information for the following periods:

1. Retention in case of queries. We will retain the information that we need to keep in case you have a query;
2. Retention in case of claims. We will retain the information that we need to keep for the period in which you might legally bring claims against us. In practice, this means up to 6 years after your agreement has ended; and
3. Retention in accordance with legal and regulatory requirements. We will retain the information that we need to keep even after the relevant contract you have with us has come to an end for a further 10 years and this will be to satisfy our legal and regulatory requirements.

Confidentiality

We undertake an analysis of the risks presented by our processing and use this to assess the appropriate level of security we need to put in place.

1. We have an information security policy and take steps to make sure the policy is implemented
2. We make sure that we regularly review our information security policies and measures and, where necessary, improve them
3. We use encryption and/or pseudonymisation where it is appropriate to do so
4. We understand the requirements of confidentiality, integrity and availability for the personal data we process
5. We make sure that we can restore access to personal data in the event of any incidents, such as establishing an appropriate backup process
6. We conduct regular testing and reviews of our measures to ensure they remain effective and act on the results of those tests where they highlight areas for improvement
7. Where appropriate, we implement measures that adhere to an approved code of conduct
8. We ensure that any data processor we use also implements appropriate technical and organisational measures

The GDPR outlines six data protection principles that we must comply with when processing personal data. These principles relate to:

1. Lawfulness, fairness and transparency - we must process personal data lawfully, fairly and in a transparent manner in relation to the data subject.
2. Purpose limitation – we must only collect personal data for a specific, explicit and legitimate purpose. We must clearly state what this purpose is, and only collect data for as long as necessary to complete that purpose.
3. Data minimisation - we must ensure that personal data we process is adequate, relevant and limited to what is necessary in relation to our processing purpose.
4. Accuracy - we must take every reasonable step to update or remove data that is inaccurate or incomplete. Individuals have the right to request that we erase or rectify erroneous data that relates to them, and we must do so within a month.
5. Storage limitation - We must delete personal data when we no longer need it. The timescales in most cases aren't set. They will depend on our business’ circumstances and the reasons why we collect this data.
6. Integrity and Confidentiality - We must keep personal data safe and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

What personal information do LoanOnYourCar.co.uk use and when?

In order to process your application, we require to process various pieces of personal information at varying times

1. Title, full name, your contact details, including your email address, telephone numbers;
2. Current home address and past 3 years address history;
3. Date of birth
4. Personal information which we obtain from Fraud Prevention and Ant-Money laundering services
5. Some special categories of personal data such as about your health or if you are a vulnerable customer
6. Your financial details e.g. your salary and details of other income, details of your savings, details of your expenditure, and details of account(s) held with other providers if you repay your loan from those account(s)
7. Bank account details
8. Details about all of your existing borrowings and loans
9. Information about your employment status including whether you are employed, retired or receive benefits
10. Information about your occupier status, such as whether you are a tenant, live with parents or are an owner-occupier of the property in which you live at the time of your application Information which is relevant for your residency and/or citizenship status, such as your nationality, your length of residency in the UK and/or whether you have the permanent right to reside in the UK
11. How you contacted LoanOnYourCar.co.uk

How does LoanOnYourCar.co.uk use your information

The information we collect about you will be used in the following ways:

1. To check your identity and credit standing and to enable us to consider and process your application for a loan
2. To assess your credit history and confirm your employment details
3. To detect, prevent and investigate actual and potential fraud and related activities
4. To collect unpaid loans and debt that may be owed by you to us
5. To develop, manage and market products and services to meet your needs, to contact you for products and services that may be of interest, to determine your eligibility for different products and services that you may be interested in
6. To help us to administer and service your account with us
7. To contact you in connection with your enquiry
8. To extract certain information for the purpose of generating statistics for our own internal purposes (including credit and/or behaviour scoring, and market and product analysis).
9. To update our website to better meet our clients' needs in the future
10. Sharing your information with third parties
11. Sometimes (and with your approval where required), we'll share your information with carefully selected third parties outside our group. We may do this to provide you with a loan; to assist our agents, staff and approved third parties to carry out services for us; to facilitate the processing and collection of payments due from you under the loan agreement, we may also share your personal data with third party payment processing service providers.
12. If you provide us with any debit card details we may keep those details, but will only ever take card payments on your specific authorisation
13. To provide you with information about special promotions and offers
14. To protect us or others, we may share your information with third parties when we believe its necessary to comply with the law or protect our or another person's rights, property, or safety. This includes exchanging information with third parties (such as other lenders, law enforcement agencies and regulatory authorities) to protect against fraud and reduce risks
15. If there is (or is to be) any change in ownership of our business or assets then we may wish
16. to share your information so that the new (prospective) owners may continue to operate our business effectively and continue to provide services to our customers. This may include new shareholders or any organisation that might take an assignment or transfer of any agreements we have entered into with our customers.

How do we collect your information?

We will collect your personal information from you directly. This will include information you provide when you apply, and any additional information provided by you in various ways, including originals and copies of financial and non-financial information for the purposes of affordability assessment, residential and personal identification; publicly available registers (e.g. land registry, bankruptcy registers, electoral register, and AML checks); information we may receive from other organisations, whether in the course of providing products and services to you or otherwise; and information obtained during the course of our business relationship with you. This may also be from the information we gather from your use of, and interaction with, our internet services and the devices you use to access them.

Data protection principles under the GDPR

Data protection principles underpin the General Data Protection Regulation (GDPR). These principles set out obligations for businesses and organisations that collect, process and store individuals' personal data.

Do you have to provide the information to us?

We are unable to provide you with an account or to process your application without having personal information about you. Your personal information is required before you can enter into the relevant contract with us, or it is required during the life of that contract, or it is required by laws that apply to us. If we already hold some of the personal information that we need – for instance, if you are already a customer – we may not need to collect it again when you make your application. In cases where providing some personal information is optional, we will make this clear.

Do we monitor any of your information?

In this section, where we refer to “monitoring” this means any listening to, recording of, viewing of, intercepting of, or taking and keeping records of calls, email, text messages, review web sites, social media messages and other communications.

We may monitor, where permitted by law, and we will do this where the law requires it. Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.

We may conduct short term carefully controlled monitoring of your activities on your account where this is necessary for our legitimate interests or to comply with our legal obligations. For instance, where we suspect fraud, money laundering or other crimes.

Telephone calls between us and you in connection with your account may be recorded to make sure that we have a record of what has been discussed and what your instructions are. We may also record these types of calls for quality control and staff training purposes on a variety of desktop browsers. We do not store passwords or any other information about a visitor in a cookie that could identify them, their location or their preferences.

IP addresses

An IP address in isolation is not personal data under the Data Protection Act, according to the Information Commissioner and is not subject to the GDPR. However, an IP address can become personal data when combined with other information or when used to build a profile of an individual, even if that individual's name is unknown and at that point will be treated under the GDPR. We use this information to investigate abuse of our website and its users, and to co-operate with law enforcement. We share this information with third parties, but only in aggregate.

How does LoanOnYourCar.co.uk legally use your information?

LoanOnYourCar.co.uk does not share information with third parties for marketing purposes. Data protection laws require us to explain what legal grounds justify us using your personal information (this includes sharing it with other organisations). The laws refer to “processing” of information – a term which includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. For some processing, more than one legal ground may be relevant (except where we rely on a consent). Here are the legal grounds that are relevant to us:

1. Processing necessary to perform our contract with you for your account, or for taking steps before entering into it, during the application stage:
   1. Administering and managing your account and services relating to that, updating your records to contact you about your account and doing this for recovering debt;
   2. All stages and activities relevant to managing your account including enquiry, application;
   3. administration and management of accounts and
   4. For some of our profiling and other decision making as described in the relevant section below.
2. Where we consider that, on balance, it is appropriate for us to do so, processing necessary for the following legitimate interests are:
3. Administering and managing your account and services relating to that, updating your records to
4. contact you about your account and doing this for recovering debt;
5. To test the performance of our products, services and internal processes;
6. To adhere to guidance and best practice under the regimes of governmental and regulatory bodies such as the Financial Conduct Authority and the Information Commissioner’s Office;
7. For management and audit of our business operations including accounting;
8. Although not current LoanOnYourCar.co.uk policy, to carry out searches at Credit Reference Agencies pre-application, at the application stage, and periodically after that;
9. To carry out monitoring and to keep records;
10. To administer our good governance requirements (such as internal reporting and compliance obligations);
11. For market research and analysis and developing statistics;
12. For some of our profiling and other decision making, in particular where this does not have a legal effect or otherwise significantly affect you; and
13. When we share your personal information with these other people or organisations;
    1. Any person with power of attorney over your affairs (in each case only if relevant to you);
    2. Our legal and other professional advisers and auditors;
    3. Financial institutions and trade associations;
    4. Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, and the Information Commissioner’s Office;
    5. Tax authorities who are overseas for instance if you are subject to tax in another jurisdiction, we may share your personal information directly with relevant tax authorities overseas (instead of via HMRC);
    6. Other organisations and businesses who provide services to us such as debt recovery agencies,
    7. back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back-office functions;
    8. Actual or prospective buyers or financiers and their professional and other advisers (including providers of insurance or rating agents) in connection with any sale of financing transaction such as a restructuring or sale of our business or assets or any securitisation or other funding transaction;
    9. Credit Reference Agencies (not currently LoanOnYourCar.co.uk policy); and
    10. Market research organisations who help us to develop and improve our products and services.
14. Processing necessary to comply with our legal obligations:
    1. For compliance with laws that apply to us;
    2. For the establishment, defence and enforcement of our legal rights, or those of any other member of our group;
    3. For activities relating to the prevention, detection and investigation of a crime;
    4. To carry out identity checks, anti-money laundering checks, and checks with Fraud Prevention Agencies pre-application, at the application stage, and periodically after that;
    5. To carry out monitoring and to keep records;
    6. To deal with requests from you to exercise your rights under data protection laws;
    7. To process information about a crime or offence and proceedings related to that (in practice this will be relevant if we know or suspect fraud); and
    8. When we share your personal information with these other people
    9. When we share your personal information with other people and organisations if they need to know that you are a vulnerable customer and your relatives, social services, your carer or any person who has power of attorney over your affairs.

How and when can you withdraw your consent?

As set out in the previous section, much of what we do with your personal information is not based on your consent, instead, it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us at a href="mailto:info@loanonyourcar.co.uk">info@loanonyourcar.co.uk. If you do, you should tell us which of the relevant uses you want to withdraw your consent to when you contact us. Withdrawal of your consent will not prevent our using your personal information where we are doing so on one or more of the other legal grounds.

How do we share your information with fraud prevention agencies?

We have systems that protect our customers and ourselves against fraud and other crime. Customer

information can be used to prevent crime and trace those responsible. We’ll share your personal information from your application with fraud prevention agencies. If false or inaccurate information is provided and fraud is identified, details of this fraud will be passed to these agencies. Law enforcement agencies may access and use this information.

What should you do if your information changes?

You should tell us without delay so that we can update our records, by getting in touch at info@loanonyourcar.co.uk.

Links to other sites

This website may from time to time include links to other sites. We're not responsible for their privacy practices or, site content, or the services they offer. Please always check the privacy policies of any linked sites.

Credit Referencing

As a responsible lender, J2P Autos Limited has a legal obligation to take steps to ensure that our customers are creditworthy. We use a variety of methods to try to make sure that we do not lend money to people who are in financial difficulty. One of these is to carry out a credit reference check. In order to do this, we shall pass the personal data that you provide to us in your loan application to a credit reference agency (CRA) called Perfect Data Solutions Limited which trades as LendingMetrics. LendingMetrics provide us with data about a customer's credit history and borrowing habits. You can contact LendingMetrics at 1650 Parkway, Whiteley, Fareham, Hampshire, PO15 7AH in writing to request the information that they hold about you (please note, a small statutory fee may be payable).

Important - Your Personal Information

Credit decisions and also the prevention of fraud and money laundering

We may use credit reference and fraud prevention agencies to help us make decisions. What we do and how both we and credit reference and fraud prevention agencies will use your information is detailed in the section called:

A condensed guide to the use of your personal information by ourselves and at Credit Reference and Fraud Prevention Agencies.

By confirming your agreement to proceed you are accepting that we may each use your information in this way.

A condensed guide to the use of your personal information by ourselves and at Credit Reference and Fraud Prevention Agencies

• When you apply to us to open an account, this organisation will check the following records about you and others (see 2 below)
  1. Our own database;
  2. Those at credit reference agencies (CRAs). When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders. They supply to us both public (including the electoral register) and shared credit and fraud prevention information.
  3. Those at fraud prevention agencies (FPAs).

We will make checks such as assessing this application for credit and verifying identities to prevent and detect crime and money laundering. We may also make periodic searches at CRAs and FPAs to manage your account with us.

• If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together so you must be sure that you have their agreement to disclose information about them. CRAs also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
• Information on applications will be sent to CRAs and will be recorded by them. Where you borrow from us, we will give details of your accounts and how you manage it/them to CRAs. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. Records remain on file for 6 years after they are closed, whether settled by you or defaulted.
• If you give us false or inaccurate information and we suspect or identify fraud we will record this and may also pass this information to FPAs and other organisations involved in crime and fraud prevention.
• If you have borrowed from us and do not make payments that you owe us, we will trace your whereabouts and recover debts.
• Your data may also be used for other purposes for which you give your specific permission or, in very limited circumstances, when required by law or where permitted under the terms of DP Laws.

How to find out more

This is a condensed version and if you would like to read the full details of how your data may be used please visit our website at loanonyourcar.co.uk or phone 0333 577 5000 to ask one of our staff.

You can contact LendingMetrics at Lancaster Court, 81650 Parkway, Whiteley, Fareham, Hampshire, PO15 7AH in writing to request the information that they hold about you (please note, a small statutory fee may be payable).

By ticking the tick box to confirm that you have read and accept the J2P Autos Limited Privacy Policy, you give your consent to your personal data being used in this way.

Open Banking

This section of our Privacy Policy relates to Open Banking and should be read in conjunction with the other clauses in our Privacy Policy. In the event of conflict with any other clauses, this clause shall prevail.

What is Open Banking?

Open Banking is the secure way of providing access to your bank or building society account to providers who are registered for this purpose.

Registered providers and participating banks and building societies are listed under the Open Banking Directory.

Open Banking was set up by the UK Government to encourage more competition and innovation in the financial services sector.

As a forward thinking lender, we support the use of Open Banking as it allows us to process loan applications efficiently, securely and in our consumer’s best interests.

By permitting access to your bank or building society account information we are able to make a better lending decision as we shall be able to verify your income, outgoings and other matters in order to assess what loan terms would be suitable for you based upon what you can reasonably afford to repay.

Further information about Open Banking is available from www.openbanking.org.uk.

How will my personal data be shared and used for the purposes of Open Banking?

By proceeding with your loan application via our website you expressly consent to us sharing your personal, contact and loan application details (“the Shared Personal Data”) with our registered Open Banking partner, Perfect Data Solutions Limited (“PDS”) who are also a credit reference agency. During your loan application we shall safely and securely direct you to PDS’s secure portal (“the Portal”) for the purposes of granting PDS access to your bank or building society account information (“Transaction Information”). As soon as your Transaction Information is received it shall be reported back to us in the form of a completed search in order that we may continue to process your loan application (“the Permitted Purpose”).

Further information about PDS including their registered provider and regulatory status is available from www.lendingmetrics.com.

Is Open Banking secure?

PDS are registered under the Open Banking Directory as an account information service provider and are also regulated by the Financial Conduct Authority as a payment services firm under number 802599. Any data you submit via the Portal will be encrypted and its usage tracked as part of set Open Banking data security standards.

We are responsible for the secure transmission of any Shared Personal Data to PDS, for safely directing you to the Portal and for the safe receipt and usage of your Transaction Information.

You will not be required to share your banking password or log in details with either us or PDS. Once you have given your explicit consent to share your bank account information on the Portal you will be directed to your own bank or building society’s login page where you will enter in your own login details directly.

Save as set out above or elsewhere in this Privacy Policy, we are not responsible for your direct data transmissions with PDS or with your own bank or building society.

How will my Shared Personal Data and Transaction Information be used?

PDS shall, subject to their own terms and conditions and privacy policy, and, if your bank or building society is registered to provide access under the Open Banking Directory, obtain your Transaction Information and submit this back to us for the Permitted Purpose. By way of example, the Transaction Information that we shall receive is likely to include information relating to your income, outgoings and credit worthiness.

PDS shall be entitled to re-access your Transaction Information for up to 90 days from the date of your original search result in order to refresh the search results, obtain a snapshot of your data or gather additional data.

PDS shall hold the Shared Personal Data and the Transaction Information they receive and retain according to their own terms and conditions and privacy policy, available on the Portal, which you will be required to read and consent to once directed their via our website.

As PDS are also a credit reference agency they may also share and keep a record of your Shared Personal Data and Transaction Information.

Will you use my Transaction Information data for any other purpose?

The Transaction Information we receive about you will only be used for the Permitted Purpose. We do not sell or share Transaction Information with any third party.

Save as set out above the information contained in the rest of this Privacy Policy deals with how we collate, use, transfer, store, delete and other terms applicable to your personal data including Shared Personal Data and Transaction Information.

Do I have to provide you with my consent to proceed?

Where your bank or building society have already permitted access to your Transaction Information you shall need to contact them directly in order to withdraw your consent under their particular Open Banking terms and conditions.

Are any of my other rights under this Privacy Policy affected?

Your individual data protection and privacy rights including the right to access, correct, delete, object, restrict, withdraw consent, request transfer and/or make a complaint, continue to apply to relevant personal data we control or process and are dealt with elsewhere in this Privacy Policy.

Under Open Banking as your personal data is shared by your bank or building society and accessed by PDS you may also be able to exercise your individual data protection and privacy rights against either of them pursuant to their own terms and conditions and privacy policies.

About Us

LoanOnYourCar.co.uk (LOYC) is the trading name of J2P Autos Limited, registered office is EC3V 3QQ it is regulated by the Financial Conduct Authority [TBC once approved]; and registered with the Information Commissioner’s Office, in compliance with the Data Protection Act 1988 under registration A8453659. LOYC is committed to protecting the security of your information and takes reasonable precautions to protect it, in accordance with the General Data Protection Regulation (GDPR). LOYC as data controller and our Data Protection Officer can be contacted at info@loanonyourcar.co.uk. Your personal information will be held securely by LOYC. LOYC is the data controller of your information under data protection laws because, in the context of our business relationship with you, we decide how and why it is processed in the ways explained in this policy.

Contact our Data Protection Officer

If you have a privacy concern, complaint or a question for the Data Protection Officer, please contact us by email to info@loanonyourcar.co.uk, or by post to 333 Edgware Road, London, NW9 6TD. We will respond to questions or concerns within 30 days.

Changes to this privacy policy

LoanOnYourCar.co.uk may amend this privacy policy from time to time. This privacy policy was last updated on 5th December 2023 and is version 5.0.