The Offa Privacy Notice

We want to make sure you are in the know about how we at Offa collect, use and look after your personal information. This Privacy Notice therefore sets out how we will process any personal information we collect from you, or which you provide to us, whether over the phone, through our website, in person or in any application form you submit to us. It also applies to your personal information as provided to us by someone acting on your behalf, such as a financial adviser.

This is an important document as it allows us to explain to you what we will need to do with your personal information and the various rights you have under data protection laws in relation to your personal information.

This Privacy Notice applies to you in your capacity as a customer. Where you interact with Offa in another capacity, such as a supplier, investor, director or shareholder, a separate privacy notice may apply.

Who we are

When we refer to Offa in this Privacy Notice we are referring to:

• Offa Operations Ltd (company number 11609468)
• Offa Finco 1 Limited (company number 12222819)
• Offa Finco 2 Limited (company number 14262691)
• Offa Finco 3 Limited (company number 13753107)
• Offa Finco 4 Limited (company number 15957570)
• Offa Finco 5 Limited (company number 15957668)
• Offa Finco 6 Ltd (company number 11774710)
• Offa Mezz 1 Ltd (company number 14374352)
• Offa Bridge Limited (company number 15305915)
• Offa Money Limited (company number 11770367)
• Offa Money Too Limited (company number 14947156)

each with its registered office at First Floor, Dominion Court, 39 Station Rd, Solihull, B91 3RT, trading as Offa.

Offa Money Limited is authorised and regulated by the Financial Conduct Authority (FCA), FRN 1000573, for Home Purchase Plans; other Offa group products are not regulated by the FCA and do not benefit from FCA regulatory protections.

Separately, the following entities also act as data controllers in relation to certain products or services and may act as joint controllers where applicable:

• Offa BTL Ltd (company number 15267037) (joint controller)
• Registered office: C/O Trustmoore (Uk) Ltd 120 Pall Mall, 4th Floor, London, United Kingdom, SW1Y 5EA
• Offa PGN SPV Limited (company number 16283201) (joint controller)
• Registered office: C/O Tmf Group 13th Floor, One Angel Court, London, United Kingdom, EC2R 7HJ

Each of the listed entities is registered with the Information Commissioner’s Office (ICO) as a data controller and may act as a controller of your personal information depending on the product or service provided. Where more than one entity is involved, they may act as joint controllers. Details of their respective responsibilities are available on request.

The personal information we collect

When we refer to personal information in this document we mean any information that relates to you personally. This includes information which identifies you directly, such as your name, postal address, email address or national insurance number. It also includes information which might identify you indirectly, such as your date of birth, employment circumstances or other information that may be associated with you.

When we provide you with assistance in relation to your financial requirements or discuss our products and services with you, the personal information we may process may include:

• Names, date of birth, gender, nationality, marital status, contact details, addresses and details of documents such as your passport or driving licence that are necessary to verify your identity.
• Employment and remuneration information, (including salary/bonus schemes and other benefits), employment history.
• Bank account details, loans and credit commitments, tax information, personal credit history, sources of income and expenditure, family circumstances and details of any dependents.
• Health status and history, medical reports where relevant (see also the section below relating to special category data such as health information).
• Information about actual or alleged criminal convictions if this information is needed in order to assess your suitability for products or services.
• Any pre-existing financial and similar products and their terms and conditions.

How we collect your personal information

We may obtain information from you directly. For example you may give us information during the course of meetings with us to establish your circumstances and needs and preferences in relation to our products and services. You may also provide us with information when you correspond with us by email and in other ways, and when you fill in forms.

Your telephone calls with us may be monitored or recorded for training, compliance and evidential purposes.

We may also obtain some information from third parties, for example information from your employer and searches of information in the public domain such as the electoral roll, or if we carry out credit checks (we provide further information about this below).

We also collect personal information automatically when you use the website and when you navigate through the website. Information collected automatically may include:

• Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet and your browser type and version,

• Information about your visit, including the URL used to click to, through and from our site (including date and time), products you viewed or searched for, IP addresses and other data collected through cookies and other tracking technologies.

For more information on our use of these technologies, see our Cookie Notice (https://offa.co.uk/policies/our-cookies-policy/) which explains how you can opt out of certain non-essential cookies.

How we use your personal information

We use your personal information for the following purposes:

• To provide the services you have requested, including identifying and assessing your suitability for our products and other products and services provided by selected third-party organisations. We will share your personal information with these organisations to enable them to provide their services to you.
• To contact you about other products and services which are similar to ours which we think you may be interested in. You can opt out of receiving these messages at any time by getting in touch with us at Opt-out@offa.co.uk, or by following the instructions we provide to you alongside the relevant message.
• To communicate with you in relation to our services. For example, to tell you about changes to terms and conditions or to our privacy policy.
• To improve our services and the way we do business, and to ask you for feedback. We may also share your personal information with a potential investor in, or buyer of, our business, provided that they are subject to appropriate obligations of confidentiality.
• In order to carry out identification, anti-financial crime, compliance and credit checks.
• To comply with any legal or regulatory obligations, requirements, or requests.
• To protect, defend or enforce our legal rights, or those of others.

Under data protection law we are allowed to use your personal information only if we have a proper reason to do so. The law says we must have one or more of these reasons:

• to allow us to take actions that are necessary in order to provide you with our services (to perform our contract with you);
• where necessary to allow us to comply with our legal obligations,
• where necessary for our or your legitimate interests (further details about this are set out below);
• where we have your consent to do so. We only ask for your consent in relation to specific uses of personal information where we need to (for example if we use certain special categories of personal information or to send you marketing messages) and, if we need it, we will collect it separately and make it clear that we are asking for consent; or
• in the case of special categories of personal data, that it is in the substantial public interest.

The main reason we will use your personal information is to allow us to provide you with the products and services you have requested (perform the contract). We will therefore use your information to:

• assess your suitability for products and provide advice to meet your needs and circumstances;
• introduce you to a range of product and service providers in order to meet your requirements;
• process applications and administer our services to you;
• communicate with you in relation to our services. For example, to tell you about changes to terms and conditions or to our Privacy Notice.

We may also process your information where necessary in order to meet our legal and regulatory obligations. These may include:

• complying with the requirements of the Financial Conduct Authority and other applicable regulators;
• preventing financial crimes such as money laundering and fraud by passing your details to other relevant bodies such as the police and National Crime Agency where required;
• to comply with a court order.

We may also process your personal data where necessary for our or your legitimate interests. Typically, these would be limited to:

• analysing our business operations to assess how we can improve our services to customers;
• reviewing the work we have carried out for you to ensure we continue to comply with the regulations and meet quality standards;
• providing customer support services and responding to customer questions;
• keeping our records up to date;
• dealing with and monitoring for financial crime;
• developing new ways to meet customer expectations and needs and grow our business;
• managing risk for our business and customers;
• ensuring we are able to exercise legal rights or defend legal challenges.

Where we rely on legitimate interests as a lawful ground for processing your personal information, we balance those interests against your interests, fundamental rights and freedoms.

Please also read the section below headed Identity and Credit Checks for a fuller explanation of how and why we use your personal information for these purposes.

Special categories of personal information

Where necessary, we may collect special category personal data such as information relating to health, ethnic origin, or medical history to assess and support the suitability of products and services or where required for regulatory, legal, or fraud prevention purposes.

We process special category personal data only where a condition under Article 9 of the UK GDPR applies, together with a condition under Schedule 1 of the Data Protection Act 2018, including:

• Explicit consent (Article 9(2)(a)), where you provide such information voluntarily; and/or
• Substantial public interest (Article 9(2)(g)), including Schedule 1 conditions relating to fraud prevention, regulatory compliance, and the prevention of unlawful acts.

Where we rely on these conditions, we apply appropriate safeguards including data minimisation, access restrictions, and staff controls.

We only use special category personal data for the purposes for which it is collected, unless otherwise permitted by law.

Failing to provide your personal information

Please make sure you provide us with certain information when requested as if you don’t we may not be able to perform the contract we have entered into with you (such as to provide you with products or services). In this case, we may have to cancel a product or service you have with us.

Applications on behalf of others

If you are making an application on behalf of another person, they must have authorised you to act on their behalf. This means you are allowed to provide their personal information with consent for us to use it, as described above. A copy of this Privacy Notice will be emailed to all applicants where an email address is provided.

Identity and credit checks

The personal information we have collected from you will be shared with Credit Reference Agencies (CRAs) who may check the details supplied against any particulars on any databases (public or otherwise) to which they have access. They may also use the details in the future to assist other companies for verification purposes. A record of the search will be retained. The identities of the CRAs, their role (also as fraud prevention agencies) and further details of how your information will be used are explained in more detail at:

• https://www.equifax.co.uk/privacy-hub/crain 
• https://www.experian.co.uk/legal/crain/ 
• https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference

Please note that credit reference agencies will keep a record of each search. This could affect your ability to get credit elsewhere within a short period of time. Details about this application (whether or not it goes ahead) will be recorded at the credit reference agencies.

A financial link between joint applicants or between you and any named partner or spouse will be created at the credit reference agencies. This will link your financial records, where each will be taken into account in all future applications by either or both of you. If you already have a financial association, your application will be assessed on this basis. This situation will continue until one of you successfully files for a ‘disassociation’ at the relevant credit reference agencies.

We will pass details about you and how you manage your account (if your application is successful) to credit reference agencies including recording if payments are not made in full and on time.

We may use automated methods to assess your application, including credit scoring and affordability checks. These processes use information such as your financial history, income and expenditure, credit reference data, and other relevant information. We use statistical models and risk-based scoring to assess the likelihood of meeting obligations under the product. The outcome may determine whether your application is accepted, declined, or referred for further review, and may also affect the terms offered.

Where a decision is made solely by automated means that produces legal or similarly significant effects, you have the right to request human intervention, express your views, and contest the decision. You may also request a manual review by contacting us.

In addition, the personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your information and that of individuals connected or associated with you will be used by us and these fraud prevention agencies, and the data protection rights of individuals whose personal information we control or process, can be found at https://www.cifas.org.uk/fpn

If you have made a joint application, you must be entitled to disclose information about your joint applicant and anyone else whose personal data you provide; and acknowledge that we will search, link or record information at CRAs and fraud prevention agencies about you and anyone referred to by you in the application. If you provide personal data about another person to us, you must provide them with this information concerning the processing of their personal information before providing the information to us.

We may also make periodic additional searches at credit reference and fraud prevention agencies to help manage your account with us.

Sharing your personal information

From time to time your personal information will be shared with:

• anyone you appoint to administer or operate your account;
• regulatory bodies; 
• our external auditors;
• finance companies, investment providers, insurers, reinsurers, guarantors, funders, cash managers, security trustees, hedge counterparties and their respective advisers, associated companies and agents, including solicitors, valuers, debt recovery agents, letting agents, ratings agencies and market research agencies, for any purpose relating to any product or service you are interested in;
• companies to which we may transfer your finance and related agreements (for example if we securitise our assets);
• our third party service providers, such as those companies we engage to service our products, host and maintain our IT systems and website, companies assisting us with email marketing campaigns, analytics companies who help us optimise our website;
• third parties where reasonably required to protect our rights, customers, systems and services (e.g. legal counsel and information security professionals);
• third parties where we have a duty to or are permitted to disclose your personal information by law including for fraud and crime prevention purposes (e.g., government agencies including HMRC, the Home Office (for immigration status checks), law enforcement, courts and other public authorities);
• any past/present employer, accountant, financier or bank in order to assess whether to accept your application and also at periodic stages during the term of your product;
• any other person or organisation where you have given consent.

We may, from time to time, expand, reduce or sell our business, and this may involve the transfer of certain divisions or the whole business to other parties. Personal information relating to you will, where it is relevant to any division so transferred, be transferred along with that division to other Offa group companies, prospective buyers and the new owner or newly controlling party will, under the terms of this Privacy Notice, be permitted to use personal information relating to you for the purposes described in this Notice.

Before we disclose personal information to a third party, we take steps to ensure that the third party will protect personal information in accordance with applicable privacy laws and in a manner consistent with this Notice. Where required by law third parties sign a data processing agreement with us. They are required to restrict their use of this personal information to the purpose for which the information was provided.

International transfers of personal information

We may transfer and process your personal information outside the United Kingdom where this is necessary for the purposes described in this Privacy Notice. This may occur where we use group entities, third-party service providers, or systems and infrastructure (including cloud-based services, identity verification platforms, AML and compliance tools, and IT service providers) that are located or operated outside the UK.

Where such transfers take place, we ensure that appropriate safeguards are implemented in accordance with UK data protection law. These safeguards may include transfers to countries recognised by the UK Government as providing an adequate level of protection for personal information, the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and completion of a transfer risk assessment together with any required supplementary technical, organisational, and contractual measures.

Where personal information is shared with group companies or third-party service providers outside the UK, they act under written contractual arrangements and are required to process personal information only on our documented instructions, implement appropriate security measures, and comply with UK GDPR-aligned data protection obligations.

We take reasonable steps to ensure that international transfers do not reduce the level of protection afforded to your personal information and that it is processed securely and lawfully at all times.

How long we keep your personal information

We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to meet legal and regulatory requirements.

In most cases, we retain personal information for up to 6 years after the end of our relationship with you, in line with regulatory obligations.

We may retain information for longer where required to comply with legal obligations, resolve disputes, prevent financial crime, or enforce our agreements.

Where personal information is no longer required, it will be securely deleted or anonymised.

Your rights in relation to your personal information

It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes so that our records can be updated.

Data protection law grants you a number of specific rights in respect of your personal information in addition to the broad and general right to have your data protected. We have set out some information in respect of each of those specific rights below:

• Right to be informed about how your personal information will be processed. This enables you to receive information about how we use your personal information. We have set this information out in this policy.
• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information (commonly known as the “right to be forgotten”). This enables you in certain circumstances to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes and to withdraw any consent that you have provided for processing.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of certain of your personal information to another party.
• Not to be subject to a decision solely based on automated processing. We have highlighted in the ‘Identity and Credit Checks’ section above where automated decisions may be made in relation to your application. If we ever make a decision about you automatically by a computer or an algorithm without human intervention you can ask us to have that decision reviewed by a human.

If you want to exercise any of the rights set out above, please contact us using the contact details set out below.

For more information

For general enquiries, please contact us at generalenquiries@offa.co.uk or by telephone on 0121 667 7291.

For further information about how to exercise your data protection rights, please contact us at compliance@offa.co.uk.

If you are unhappy about how your personal information has been used, please refer to our complaints policy. You also have a right to complain to the Information Commissioner’s Office which regulates the processing of personal information. For more information visit www.ico.org.uk.

Contact details

Offa
First Floor,
Dominion Court,
39 Station Rd,
Solihull
B91 3RT

Telephone: 0121 667 7291
General enquiries: generalenquiries@offa.co.uk
Data protection: compliance@offa.co.uk