Privacy notice

Updated September 2023

1. Introduction

1. In this Privacy Notice (referred to throughout as notice) we, our or us refers to NewDay Ltd, its parent company NewDay Cards Ltd and any other companies in the group to which they belong (referred to throughout this notice as the NewDay Group). You or your refers to anyone whose personal data we process.

2. Details of the products offered by the NewDay Group to whom this notice applies can be found on our website newday.co.uk/who-we-are/brands and newday.co.uk/what-we-do/products. We may change this notice from time to time and we will put any changes on our website www.newday.co.uk and, where appropriate, changes will be notified to you by email or by post. Please check our website frequently to see any updates or changes to our notice.

3. This notice sets out how we will use and look after your personal information. If you are an additional cardholder, please see section 18 of this notice, which explains how we use your personal data and the sections of this notice that are applicable to you.

1. This notice covers the following:

Introduction
Whom should I contact if I have questions about this notice?
What are personal data and special categories of personal data?
Where do we obtain your personal data from?
What personal data do we use and why?
What personal data do we share with third parties and why?
What personal data do we share with CRAs and why?
What is the legal basis that permits us to use your personal data?
What are the consequences of processing your personal data for fraud prevention or anti-money laundering purposes?
What happens if you do not provide information that we request?
How and why do we grant third party providers access to your online servicing account?
How long do we retain your personal data for?
What measures do we have in place to safeguard your personal data?
When do we transfer your personal data overseas?
How do I find out about cookies?
Why do we use credit scoring and automated decision making as part of your application?
How do we use your personal data for profiling?
How do we use your personal data if you are an additional cardholder?
What rights do you have in relation to your personal data?
Your marketing preferences
Why do we need to record phone calls with you?

4. The table at the end of this notice provides an overview of the personal data that we collect, the purposes for which we use that personal data, the legal basis which permits us to use your personal data and the rights that you have in relation to your personal data.

2. Whom should I contact if I have questions about this notice?

Should you wish to contact us about any aspect of this notice you can contact our data protection officer using the following email address dpofficer@newday.co.uk.
NewDay Ltd and NewDay Cards Ltd are registered with the UK Information Commissioner's Office (referred to throughout this notice as ICO). NewDay Ltd's registration number is Z272680X and NewDay Cards Ltd's registration number is Z5599433.
If you are unhappy with the way in which we are processing your personal data you have the right to raise a complaint directly with the ICO. Their contact details are Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call them on 0303 123 1113 or email them on icocasework@ico.org.uk.
For more information about credit reference agencies (referred to throughout this notice as CRAs) and how they use your personal data please read the Credit Reference Agency Information Notice (CRAIN)). CRAIN covers the activities of Experian, Equifax and TransUnion. We also use credit reference services provided by Crediva. You can find a copy of Crediva's privacy notice here. For a hard copy of this notice please call Customer Services (see Section 20.2).
For more information about fraud prevention agencies (referred to throughout this notice as FPAs) and how they use your personal data please contact us by calling our Compliance Team on 0371 522 5146.

3. What are personal data and special categories of personal data?

Personal data is any information that tells us something about you. This could include information such as name, contact details, date of birth, medical information and bank account details.
Special category personal data is any information relating to your ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data used to uniquely identify you, health data or your sexual life. This personal data is more sensitive and we need to have further justifications for collecting, storing and using this type of personal data. There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal conviction data.

4. Where do we obtain your personal data from?

1. We get personal data about you from a number of sources as set out below:

Personal data you provide when you request a quote directly from us or via a price comparison, aggregator or similar website or if you apply to us for a card and/or one of our products;
Personal data you give to us in emails, letters, via online servicing (including via chat and chatbots), during phone calls (including any phone numbers that you use to contact us on) and when registering for services such as our account management services or Aqua Coach services;
Personal data we obtain about the IP address, operating system, devices and browser that you use, including the location of any devices used by you;
Personal data we obtain about you from the software we use to prevent fraud when transactions are made using your account, or attempts are made to log onto your online account manager or your online banking app;
Personal data you give when you participate in surveys, promotions or competitions;
Personal data we receive when making a decision about your quote, application or account, including personal data we receive from enquiries and searches made at CRAs and FPAs, or from publicly available sources, for example the electoral roll;
Personal data we continue to exchange about you with CRAs on an ongoing basis. For more information about the information that we share with CRAs and how CRAs use your personal data in this manner please see Section 7.4 or read the Credit Reference Agency Information Notice;
Personal data we have about any account you have with us including details of transactions and payments;
Personal data we collect using analytics tools to track website page content and click/touch, movement, scroll, and keystroke activity; and/or
Personal data from card insurers or other organisations that you use to search for credit products, including price comparison, aggregator or similar websites that you visited before clicking through to any of our websites.
Personal data we get through open banking services. This involves us accessing account information that is held by other financial institutions, such as your bank account statements. We get open banking information through third party service providers. We refer to this information as “open banking data”. For more information about how we use open banking data please see Section 16.4

5. What personal data do we use and why?

1. We are a controller for the personal data that we obtain when providing your card and/or product.

2. We hold and use the following personal data about you:

Personal data such as your name, address, address history, phone numbers, email address, date of birth, passport information, driving licence information employment details, identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address, browser type, device data (which includes information about the type of device you use, approximate location and the specific device ID that is linked to the devices that you use to access our services), behavioural biometric data (which includes how you hold your device, your key strokes and mouse movements) and financial information such as your bank account details, income and expenditure and other information necessary to assess your financial status. We use this information in order to verify your identity, operate your account and for the purposes of preventing fraud and money laundering;
Personal data relating to your demographic (which can include information such as age, gender, place of residence, and can include socio-economic factors such as occupation, family status, or income), lifestyle, how you use your card and/or product and consumption habits for example how you use your card and/or product. We use this information to improve our card and/or products;
Personal data relating to any additional cardholders or financial associates on or linked to your account. A “financial associate” is someone with whom you have a personal relationship that creates a joint financial unit in a similar way to a married couple. You will have been living at the same address at the time. It is not intended to include temporary arrangements such as students or rented flat sharers or business relationships. CRAs may link together the records of people that are part of a financial unit. They may do this when people are known to be linked, such as being married or have jointly applied for credit or have joint accounts. They may also link people together if they, themselves, state that they are financially linked. For more information about how CRAs use your personal data in this manner please read the Credit Reference Agency Information Notice;
Personal data that we obtain when you use any of our services, including details of other services you have through us, such as Aqua Coach or our eligibility checking services you have subscribed to, or any card insurance provided to you by any other third party;
Any other personal data we need to operate your account, make decisions about you or fulfil our legal or regulatory obligations.

3. In addition to the purposes stated above, we use the personal data we hold for the following purposes:

To make credit decisions about you, assess lending risks and to validate the details that you have provided to us;
To operate and manage your account, any application(s), any agreement(s) or handle any correspondence you may have with us and to conduct financial reviews (for example assessing your eligibility for credit line increases, balance transfer offers, money transfer offers or to monitor your account for fraud);
To enable us to perform other administrative and operational purposes including the testing of systems, auditing and other compliance related activities to ensure that we are complying with our legal and regulatory obligations;
To monitor and analyse our business, including customer and declines modelling and statistical trend and transactional analysis, to identify, develop or improve products that may be of interest to you, and to carry out market research;
To provide you with cards, products and services and tell you about changes to these products and services;
To send you marketing in accordance with the provisions of Section 20;
To trace your whereabouts in the event we are unable to contact you in relation to the products or services we provide to you;
To recover any debt you owe us;
To provide information on an anonymised or aggregated basis to independent external bodies such as government departments and agencies, universities and similar to carry out research;
To comply with our legal and regulatory obligations and to identify, prevent, detect or tackle fraud, money laundering, terrorism and other crimes; and/or
To create anonymised data sets that can be used for big data analytics by ourselves and third parties. For example, we might create an anonymised dataset that shows in which shops on the high street customers have spent money in the last 12 months.

4. We and members of our group, may send you information directly in the form of service messages related to your card and/or product where this relates to features or benefits of your card and/or product. We want to make sure that we provide excellent customer service and we use various means of communication to do this including phone, post, email, push notifications and SMS.

5. If NewDay receives any funds from a third party which have been incorrectly attributed or applied to your account, NewDay has a regulatory obligation, upon request, to provide all your available relevant information (including personal information such as your name and contact details) to the third party's payment service provider (for example their bank) to assist them with recovering such funds. If there is an incorrect payment and the third party's payment service provider is not able to recover the funds, the payment service provider may share your information directly with the third party to enable them to recover the funds.

6. When we are managing your account it is not our intention to routinely process special categories of personal data. However, in certain circumstances, (for example if you are unable to make re-payments to your account or if you are incapacitated) we may be provided with special categories of personal data about your health or medical information which we will hold and process to operate and deal with your account. Additionally, where we receive open banking data about you, this may contain information which is special category data. For example, if we obtain bank statement information, this could include details about payments made to medical service providers, which may tell us something about your health. We never use health data or any other type of special category data as part of our credit assessment (except as part of a general assessment of the amount of your expenditure) and we take steps to delete such data promptly if we receive it.

1. We will keep your personal data confidential and only share it with other third parties for the purposes explained below:

With any third parties who carry out services on our behalf to help us operate our business, to provide services, to collect payment or to recover debts. All these third parties have a contract with us and have agreed to keep your personal data confidential and secure and only to use it for the purposes that we allow.
With any person working within the NewDay Group to enable us to perform our obligations in relation to the provision of the services or products to you;
With any price comparison, aggregator or similar website that you visit before clicking through to any of our websites. This personal data will be shared regardless of whether or not you provided any price comparison, aggregator or similar website that you visit (or visited before clicking through to our website) with any personal data at that time. We use the personal data provided to us via this route to determine any payments due to such price comparison, aggregator or similar website and assess your eligibility for any NewDay products and/or services that you have applied for or have agreed to receive marketing for. The personal data that we share with such sites for this purpose is anonymised. Please note that you can withdraw your consent to receive marketing from us at any time by contacting Customer Services, using the unsubscribe link in any email we send you or on your online account management page. Please see Section 17 for more information about how we use your personal data for profiling, Section 19 about the right to object to the processing of your personal data and Section 20 about where we rely on your consent to process your personal data;
With any firm, organisation or person together with whom we provide products and services. When we share your personal data with such parties they may also be a controller for the personal data they process. You should therefore read their privacy notices very carefully to understand how they process your information;
With any payment system provider we may use to enable us to process payments in relation to the services and/or products provided to you;
With any firm that provides analytical, market research or similar services to us;
With any insurers with whom you have any policy related to your card and/or product so that they may administer your policy;
With your close relative, carer or helper, where you are unable to handle your own affairs because of mental capacity, ill health or other similar issues and we have been provided with authority to disclose your personal data;
With any third party you have authorised to talk to us about your account (which could include additional cardholders whom you have added to your account or Debt Management Companies);
With any regulators, including the Financial Conduct Authority (referred to throughout this notice as FCA), the ICO, the Financial Ombudsman Service and other authorities including law enforcement agencies and tax authorities, (including those overseas), where we are required to disclose any personal data in order to comply with our legal or regulatory obligations;
With any third parties or authorities including any CRAs and/or FPAs for the purposes of undertaking checks for preventing or detecting fraud and money laundering, or crime or to verify your identity or to rectify any inaccurate personal data. When personal data is shared with a CRA and/or FPA, the CRA and/or FPA may share your personal data with other third parties (including law enforcement agencies) for the purposes set out in the Credit Reference Agency Information Notice and as described in Crediva's privacy notice. We and FPAs may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime;
With Mastercard Europe SA for the purposes of providing us with advisory consulting services, managed services and/or data analytical services;
With social media sites and digital advertising networks (for example Google) for online targeted marketing as well as broadcast channels (for example TV) for targeted marketing; Please see Section 17 for more information about how we use your personal data for profiling, Section 19 about the right to object to the processing of your personal data and Section 20 about where we rely on your consent to process your personal data;
With any potential buyer, transferee, or merger partner and their advisers in relation to any business transfer or re-organisation if we decide to sell, transfer or merge part or all of our business or assets, or any associated rights or interests or to acquire another business. If we disclose your personal data for this purpose, we will ensure that your personal data is kept confidential and only used it in relation to the possible transaction(s). If the transaction(s) go ahead, the purchaser, transferee or merger partner may use your personal data in the same way as set out in this notice or provide you with a new privacy notice explaining how your personal data will be used by them;
With any debt purchaser in the event that we sell your debt. If we disclose your personal data for this purpose, we will enter into a contract with the third party debt purchaser requiring them to keep your personal data confidential and process it in accordance with the terms of this notice. Following the sale of your debt, the debt purchaser will become a controller of your personal data and you can request information from them detailing how your personal data will subsequently be used. On the sale of your debt you will be provided with the debt purchaser's contact details as part of our other regulatory obligations; and
Where we have acquired your account from another creditor, with the previous creditor for administrative, regulatory and legal purposes and to help us deal with any complaints or other issues relating to your account.

1. In order to process your quote or application (which includes applying for a balance transfer or a money transfer), we will perform credit and identity checks on you with one or more CRAs. Where you take financial services from us, we may also make periodic searches at CRAs to manage your account with us. Where you have been declined for a credit product and have decided to appeal the decision, we will perform another search with certain CRAs. A "soft search" allows us to make a check on your credit file and will leave a footprint so that you can see that we made the check, but the search will not show up to other lenders and will not affect your credit rating. We use soft searches when we carry out eligibility checks, in order to provide quotes and where you have appealed a decline decision. If you make an application for one of our products, we perform a "hard search" with certain CRAs. These searches are visible to other lenders and may affect your credit rating.

2. To do this, we will supply your personal data to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

3. We will use this personal data to:

Assess your creditworthiness and whether you can afford to take the product;
Verify the accuracy of the data you have provided to us;
Where you are applying for a balance transfer, to check whether the account from which the balance is transferring is registered to the same address as the address that you have provided to us;
Prevent criminal activity, fraud and money laundering;
Manage your account(s);
Trace and recover debts; and
Ensure any offers provided to you are appropriate to your circumstances.

4. We will continue to exchange personal data about you with CRAs while you have a relationship with us. We will also inform some CRAs about your settled accounts. If you borrow and do not repay in full and on time, some CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

5. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

6. If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. The CRAs we share data with will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

7. The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal data, data retention periods and your data protection rights with the CRAs are explained in more detail:

In relation to TransUnion, Equifax and Experian: in their Credit Reference Agency Information Notice at http://www.experian.co.uk/crain/index.html. CRAIN is also accessible from each of these three CRAs – clicking on any of these three links will also take you to the same CRAIN document: TransUnion www.transunion.co.uk/crain; Equifax www.equifax.co.uk/crain; Experian http://www.experian.co.uk/crain;
In relation to Crediva in their Privacy Notice at https://www.crediva.co.uk/crediva-processing-notice

8. What is the legal basis that permits us to use your personal data?

1. We are only permitted to use your personal data and special categories of personal data if we have a legal basis for doing so as set out under data protection legislation. We rely on the following legal bases to use your personal data:

Where we have your consent (Consent);
Where we need information to enter into a contract, or perform the contract we have entered into, with you (Contractual Performance);
Where we need to comply with a legal or regulatory obligation (Legal Obligation); or
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (Legitimate Interest);

2. In more limited circumstances we may also rely on the following legal bases:

Where we need to protect your interests (or someone else's interests) (Vital Interest); or
Where it is needed in the public interest or for official purposes (Public Task).

3. When we and FPAs process your personal data, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify your identity, in order to protect our business and to comply with laws that apply to us.

4. The table at the end of this notice provides more detail about the personal data that we use, the legal basis that we rely on in each case and your rights.

5. Some information is classified as special categories of personal data under data protection legislation. We may process special categories of personal information and criminal conviction information in the following circumstances:

In limited circumstances with your explicit consent, in which case we will explain the purpose for which the information will be used at the point where we ask for your consent; and
We will use information about your physical and mental health or disability status to comply with our legal obligations, including to ensure we are complying with our obligations to treat you fairly and to assess your ability to repay your debt.
We will use behavioural biometric data to help us to confirm your identity when you log into your online account manager or your online banking app. This is necessary to prevent or detect crime.

9. What are the consequences of processing your personal data for fraud prevention or anti-money laundering purposes?

1. If we, or a FPA, determine that you pose a fraud or money laundering risk, we may refuse to provide a card and/or product to you, or we may stop providing existing products to you.

2. A record of any fraud or money laundering risk will be retained by the FPAs, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us by calling our Compliance Team on 0371 522 5146.

10. What happens if you do not provide information that we request?

1. We need some of your personal data in order to perform our contract with you. For example, we need to know your address and phone number in order to operate your account. We also need some information so that we can comply with our legal obligations. For example, we need to know your credit history so we can assess your ability to repay the balance on your card and/or product to ensure that we are lending responsibly.

2. Where personal data is needed for these purposes, if you do not provide it we will not be able to perform our contract with you and may not be able to offer you a card and/or product. If you do not provide the requested information, we may continue to process your personal data for other purposes as set out in this notice.

11. How and why do we grant third party providers (TPP) access to your online servicing account?

1. A TPP is a third party service provider that is authorised or registered with the Financial Conduct Authority or another European Economic Area regulator or otherwise permitted by law to carry on certain activities on your instruction. These include:

accessing information about your account held with us if it is accessible online; and
initiating payments from your account held with us if it is accessible online.

2. If you choose to use a TPP, please ensure you understand how their services work, such as how they access your account with us and how they will protect your information including your personal data. Please also be aware that:

If you use a TPP, the terms of your card and/or product will still apply.
If a TPP is only asking for information about your account (and is not initiating a payment from your account with us), we will assume you have given your consent to us providing the information to that particular TPP and we will provide the information immediately.
If the TPP is a card issuer who asks us to confirm whether you have sufficient credit for it to initiate a card payment from your account, we will only do so if you have given us your explicit consent to provide information to that particular TPP.
Although you must not, generally, give your security details to anyone else, you may give them to a TPP if it is necessary to do so.
We may refuse to allow a TPP to access your account if we are concerned about unauthorised or fraudulent access by that TPP. If we do this, we will tell you why (unless doing so would compromise our reasonable security measures or otherwise be unlawful).
You must check the information provided to you by the TPP, to ensure that they are authorised or permitted by law to provide payment services to you. If we become aware that an unauthorised third party is using your security details, we may block access to your account.

12. How long do we retain your personal data for?

1. We will only retain your personal data for as long as it is required in relation to the purposes it was obtained for by us as detailed in this notice. The periods for which we hold your personal data are set out below:

When you have an account with us; we only keep details of your personal information and details of your account for such period of time as is necessary to permit us to comply with any legal or statutory obligations after your account is closed and as may be required to enable us to establish or defend any legal claims that may arise in relation to your account.
When you apply for an account but are declined credit; we will keep your personal data for statistical analysis, fraud prevention and credit scoring purposes. If you have consented to receiving marketing from us, in the event your application is declined, we will continue to retain your personal data in order to send marketing to you. Please note that you can withdraw your consent to receive marketing from us at any time by contacting Customer Services, using the unsubscribe link in any email we send you or on your online account management page. Please see Section 17 for more information about how we use your personal data for profiling, Section 19 about the right to object to the processing of your personal data and Section 20 about where we rely on your consent to process your personal data;
FPAs can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years by them. For more details about how long FPAs hold your personal data please contact us by calling our Compliance Team on 0371 522 5146.

13. What measures do we have in place to safeguard your personal data?

1. We know how important it is to keep your personal data secure. We protect your personal data when being transferred and when stored in IT systems.

2. A variety of technologies are employed to protect the systems that are used to store and manage personal data. To protect our systems and networks from attack we use firewalls, encrypted hard drives, antivirus software, host based intruder detection software and authenticated access protection solutions. Our security solutions are designed in line with industry standards to protect the personal data we store or transmit.

3. Access to personal information is strictly controlled. We ensure access to personal data is restricted to individuals on a need to know basis. Training is provided to individuals working within the group who need to access personal data to ensure that personal data is managed securely.

4. When we share your personal data with third parties and organisations as set out in Section 6 we undertake appropriate due diligence with them to ensure they are complying with the terms of their contract.

14. When do we transfer your personal data overseas?

1. We and third parties with whom we share personal data with may transfer your personal data overseas so that we can manage your account and provide other services from countries within the European Economic Area (EEA) (where similar data protection standards apply as in the UK) and countries outside the EEA. When personal data is transferred to countries outside of the UK and the EEA those countries may not offer an equivalent level of protection for personal information to the laws in the UK. Where this is the case we and those third parties will ensure that appropriate safeguards are put in place to protect your personal information. For example, whenever FPAs transfer your personal data outside of the UK and the EEA, they impose contractual obligations on the recipients of that personal data to protect your personal data to the standard required in the UK. They may also require the recipient to subscribe to 'international frameworks' intended to enable secure data sharing.

2. When we transfer personal data to Mastercard, Mastercard have binding corporate rules in place to safeguard your personal data. A link to the Mastercard binding corporate rules is found here.

3. We may process payments through other financial institutions such as banks and the worldwide payments system operated by the SWIFT organisation. These external organisations may process and store your personal data abroad in order to fulfil any payment instructions for example when you use your card and/or product. Additionally, the SWIFT organisation has to disclose your personal data to overseas authorities to help them to prevent and detect crime and terrorism. If these authorities are outside the UK and the EEA, your personal information may not be protected to the same standards as in the UK.

4. The countries to which your personal data is transferred and the safeguards in place where personal data are transferred outside the UK and the EEA are set out below:

1. United Kingdom
2. Germany (EEA)
3. Ireland (EEA)
4. Netherlands (EEA)
5. Poland (EEA)
6. USA
7. India
8. Canada
9. Australia
10. France (EEA)
11. Spain (EEA)
12. South Africa
13. Iceland (EEA)

The safeguards that we rely on to protect personal data that is transferred outside of the UK and the EEA include:

13. European Commission approved model contract clauses. Further details about the model contract clauses is available here.

15. How do I find out about cookies?

1. We are committed to protecting your personal data (anonymous or otherwise) that we collect about you online. Our Cookies Notice explains how we use cookies, why, and how this allows us to improve our service. It also tells you how you can manage what cookies are stored on your device. Please read the Cookies Notice to find out more.

16. Why do we use credit scoring and automated decision making as part of your application?

1. When you check your eligibility with us or apply to us for credit we may use an automated system known as credit scoring to help us decide whether to lend to you. It is a way of assessing how much you are able to afford to borrow and how you are likely to manage your account. Most lenders use credit scoring to help make fair and informed decisions about lending.

2. Credit scoring takes account of information from three sources:

The information you give us on your application;
Information provided by CRAs and FPAs, including information about how you manage similar accounts; and
Information that may already be held about you by us.

3. We may contact you to offer you the opportunity to have a credit limit increase eligibility check based, in part, on open banking data. We will assess how much you are able to borrow before deciding whether to increase your credit limit. In this situation the credit scoring will take account of information from four sources:

The information you give us on your application;
Information provided by CRAs and FPAs, including information about how you manage similar accounts;
Information that may already be held about you by us; and
Open banking data held by other financial institutions.

4. Following a credit limit increase eligibility check under section 16.3, the open banking data referenced at 16.3.4 will be used as part of any further eligibility checks for a reasonable period of time.

5. Credit scoring methods are regularly reviewed to ensure they remain fair, effective and unbiased. Using credit scoring helps us to lend responsibly.

6. You have rights in relation to automated decision making. Please see Section 19 for more details of these rights.

17. How do we use your personal data for profiling?

1. We use various profiling techniques to assist us with running our business. By “profiling” we mean the automated analysis of personal data about an individual to evaluate certain things about that individual - basically drawing conclusions about an individual based on a statistical model.

2. We use these techniques for instance in the course of evaluating applications for cards and/or products, undertaking credit limit increase eligibility checks, to manage your account, to guard against fraud and for marketing and targeted advertising purposes.

3. You have a right to object in relation to profiling. Please see Section 19.1.7 for more details of this right.

18. How do we use your personal data if you are an additional cardholder?

1. If you are an additional cardholder, we will ask the primary cardholder to provide us with your name, date of birth, email address, phone number and confirmation that you are 18 or over and live at the same address as the primary cardholder. We use this information to issue and send out your card and PIN and to verify your online transactions. The legal basis that we rely on to process your personal data is because it is in our legitimate interests to obtain your information to enable us to issue a card to you.

2. We will keep your personal data confidential and only share it with other third parties and organisations for the purposes explained below:

With any third parties who carry out services on our behalf to help us operate our business and to provide services. All these third parties have a contract with us and have agreed to keep your personal data confidential and secure and only to use it for the purposes that we allow.
With any person working within the NewDay Group or the retailer group to enable us to perform our obligations in relation to the provision of the services or products to you;
With any firm, organisation or person together with whom we provide products and services for example where we are providing a card and/or product to you on behalf of a retailer. When we share your personal data with such parties they may also be a controller for the personal data they process. You should therefore read their privacy notices very carefully to understand how they process your information;
With any firm that provides analytical, market research or similar services to us;
With any regulators, including the Financial Conduct Authority (referred to throughout this notice as FCA), the ICO, the Financial Ombudsman Service and other authorities including law enforcement agencies and tax authorities, (including those overseas), where we are required to disclose any personal data in order to comply with our legal or regulatory obligations;
With any potential buyer, transferee, or merger partner and their advisers in relation to any business transfer or re-organisation if we decide to sell, transfer or merge part or all of our business or assets, or any associated rights or interests or to acquire another business. If we disclose your personal data for this purpose, we will ensure that your personal data is kept confidential and only used it in relation to the possible transaction(s). If the transaction(s) go ahead, the purchaser, transferee or merger partner may use your personal data in the same way as set out in this notice or provide you with a new privacy notice explaining how your personal data will be used by them; and
Where we have acquired your account from another creditor, with the previous creditor for administrative, regulatory and legal purposes and to help us deal with any complaints or other issues relating to your account.

3. Please also see the following sections of this notice that are applicable to additional cardholders:

1.Whom should I contact if I have questions about this notice?
2.What are personal data and special categories of personal data?
3.How long do we retain your personal data for?
4.What measures do we have in place to safeguard your personal data?
5.When do we transfer your personal data overseas?
6.How do I find out about cookies?
7.What rights do you have in relation to your personal data?
8.Why do we need to record phone calls with you?

19. What rights do you have in relation to your personal data?

1. You have a number of rights in relation to your personal data, these include the right to:

Information - Be informed about how we use your personal data;
Access - Obtain access to your personal data that we hold;
Rectification - Request that your personal data is corrected if you believe it is incorrect or incomplete;
Erasure - You do not have a blanket right to ask for deletion of your data. A request that we erase your personal data is only valid in the following circumstances:
1. If we are continuing to process personal data beyond the period when it is necessary to do so for the purpose for which it was originally collected;
2. If we are relying on consent as the legal basis for processing and you withdraw consent;
3. If we are relying on legitimate interest as the legal basis for processing and you object to this processing and there is no overriding compelling ground which enables us to continue with the processing;
4. If the personal data has been processed unlawfully (i.e. in breach of the requirements of the data protection legislation); or
5. If it is necessary to delete the personal data to comply with a legal obligation
Restriction - Ask us to restrict our data processing activities where you consider that:
1. Personal data is inaccurate;
2. Our processing of your personal data is unlawful;
3. Where we no longer need the personal data but you require us to keep it to enable you to establish, exercise or defend a legal claim; or
4. Where you have raised an objection to our use of your personal data.
Portability - Request a copy of certain personal data that you have provided to us in a commonly used electronic format. This right relates to personal data that you have provided to us that we need in order to perform our agreement with you and personal data where we are relying on consent to process your personal data.
Objection - Object to our processing of your personal data where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful. If you raise an objection, we will carry out an assessment to determine whether we have an overriding legitimate ground which entitles us to continue to process your personal data. If you object to us using your personal data for marketing purposes, we will always stop such use of your data.
Automated decisions - Not be subject to automated decisions which produce legal effects or which could have a similarly significant effect on you.
1. As part of the processing of your personal data, decisions may be made by automated processes. This means we may automatically decide that you pose a fraud or money laundering risk if:
  1. our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct; or is inconsistent with your previous submissions; or
  2. you appear to have deliberately hidden your true identity.
2. If you apply to us for credit but we are unable to offer you credit, you can contact us within 21 days of the date of your application to ask to have the decision reconsidered.

2. We will always tell you about the outcome of a request you have made in relation to the rights discussed above (except in relation to changes in marketing preferences, which are mostly automated).

3. If you would like to exercise any of your rights or find out more, please contact our data protection team at dpofficer@newday.co.uk or customer services team on 0333 220 2691*. The table at the end of this notice provides more details about the personal data that we use, the legal basis that we rely on in each case and your rights.

4. In addition to the rights above, you also have a right under the Consumer Credit Act 1974 to request a CRA to provide you with information they hold about you. A fee is payable. For more information about the fees charged please read the Credit Reference Agency Information Notice.

20. Your marketing preferences

1. As part of the application process for a card and/or product or to check your eligibility for one of our cards and/or products, we will ask you if you wish to receive marketing from us. We will not send marketing to you if you ask us not to. We conduct marketing via direct mail, phone, email, SMS and online, including via social media and other digital advertising channels (for example Google), broadcast channels (for example TV) and our mobile apps.

2 If you agreed to receiving marketing from us, but no longer wish to receive marketing from us you can opt-out in a number of ways as follows:

Writing to Aqua Customer Services, PO BOX 173, Sheffield, S98 1JW; or
Phoning us on 0333 220 2691*; or
Clicking on any unsubscribe link which will be provided on all marketing emails or using any unsubscribe functionality in any text messages from us; or
Following the instructions in any other form of marketing you have received from us; or
Changing your marketing preferences on your online account management page.

21. Why do we need to record phone calls with you?

1. We may monitor or record phone calls with you in case we need to check that we have carried out your instructions correctly, to resolve queries or issues, for regulatory purposes, to help improve the quality of our service, to manage your account and to help detect or prevent fraud or other crimes. Conversations may also be monitored for staff training purposes.

* Calls are charged at a standard national rate. Call costs from mobiles and other operators may vary so please check before calling. Calls may be recorded and monitored for training and security purposes and to help us manage your account.

Part 1 - Quick check of NewDay's use of your personal data (including processing undertaken where NewDay relies on legitimate interests)

Purpose	Type of personal data used	Legal basis for processing	Which rights apply?^
Assessing credit risk for credit applications to ensure that NewDay meet its regulatory obligations to lend responsibly and to enter into a contract with you	Application data including bank account details full name, date of birth, current and past addresses, phone number and email address, employment information including salary, residential type, marital status and details of financial associates	Contractual Performance and Legal Obligation	The generally applicable rights plus the right to data portability
Assessing credit risk for credit limit increases with the use of open banking data	Bank account details full name, date of birth, current and past addresses, phone number and e-mail address, employment information including salary, residential type, marital status and details of financial associates and open banking data Please note that you can withdraw your consent to this processing at any time by contacting Customer Services, or on your online account management page.	Consent	The generally applicable rights plus the right to object
Account management to enable NewDay to operate and manage your account including sending service messages via post, SMS, email, WhatsApp, push notifications and via your online Account Manager	Transaction data, customer communications, customer service records, complaint records and associated documentation, current addresses, phone number and e-mail address	Contractual Performance	The generally applicable rights plus the right to data portability in relation to transaction data
Supporting debtor tracing and debt collections to enable NewDay to recover any unpaid monies from you	Contact details, including full name, date of birth, current and past addresses, phone number and e-mail address and account data (including details of financial associates) and transaction data	Legitimate Interest	The generally applicable rights plus the right to object
To sell or transfer your debt to another third party	Application data including bank account details full name, date of birth, current and past addresses, phone number and e-mail address, employment information including salary, residential type, marital status and details of financial associates and transaction data	Legitimate Interests	The generally applicable rights plus the right to object
Promoting responsible lending and helping to prevent over-indebtedness	Application data including previous application details and account data and details of financial associates, transaction data and open banking data	Legal Obligation	The generally applicable rights plus the right to object
Helping prevent and detect crime and anti-money laundering services and verify identity including compliance with Politically Exposed Persons (PEPS) and Sanctions Regulations	Application data including previous application details, account data and transaction data	Legal Obligation	The generally applicable rights
Helping prevent fraud in order to protect us and you against any fraudulent activity on your account	Application data including previous application details, behavioural biometric data, account data, device data and transaction data	Legitimate Interest	The generally applicable rights plus the right to object
Complying with and supporting compliance with legal and regulatory requirements to which NewDay is subject	Application data including previous application details, transaction data, customer communications, customer service records, complaint records and associated documentation	Legal Obligation	The generally applicable rights
Business analytics including system testing	Application data, contract details including previous application details, information from business partners e.g. Experian, information from marketing information providers, transaction data, customer communications, customer service records, complaint records and associated documentation Open banking data. Please note that you can withdraw your consent to this processing at any time by contacting Customer Services, or on your online account management page.	Legitimate Interest Consent	The generally applicable rights plus the right to object
Marketing purposes including direct mail and targeted digital marketing to send you offers about our goods and services	Previous application details, information from business partners e.g. Experian, information from marketing information providers, names, addresses, account data	Legitimate Interest	The generally applicable rights plus the right to object
Electronic marketing purposes including, SMS and email, targeted marketing to send you offers about our goods and services	Previous application details, information from business partners e.g. Experian, information from marketing information providers, names, addresses, email address, phone number and account data	Consent or legitimate interests depending on the sign up journey that you followed when applying for your card	The generally applicable rights plus the right to object
Information generated by Cookies	Browser data	Consent	The generally applicable rights plus the right to object
Assessing your ability to repay any credit owed to us	Sensitive categories of personal data including details relating to your health, criminal convictions or alleged offences. Information from business partners e.g. Experian.	Legal Obligation	The generally applicable rights
To add additional cardholders and enable processing of transactions by additional cardholders	Name, date of birth, email address, phone number, address and confirmation that the additional cardholder is 18 or over.	Legitimate interests	The generally applicable rights plus the right to object

^The following generally applicable rights always apply: right to be informed, right of access, right to rectification, right to erasure, right to restriction and rights in relation to automated decision making. Please see the “What rights do you have in relation to your personal data?” Section 19 above for more details of your rights and how to exercise them or go the Information Commissioner's website at www.ico.org.uk.