Privacy Policy
Introduction
This Privacy Statement will help you understand what data we collect from you, why we collect it and what we do with it. This policy explains how we store and use your personal information when you use or interact with our website, or where we otherwise obtain or collect your personal information. This Privacy Statement applies to all services offered by us, except where otherwise noted.
This statement also explains how we protect any personal data we obtain directly or passively from you or which we obtain indirectly from other sources.
We have done our best to present the information in this policy in clear and plain language, and we have structured it in a way to allow you to quickly find information that is most important to you.
We reserve the right to change our privacy statement from time to time. We will update the Privacy Statement page content and last modified data on our website.
Privacy Statement
We are committed to keeping your personal data safe and to ensuring the integrity and security of any personal data we may process.
You should read this privacy notice very carefully as it contains important information on the way in which we will process your personal data, in particular:
- The personal information we collect about you
- Our legal bases for processing your personal information
- What we do with your personal information
- Who your personal information may be shared with
- Your rights as a data subject under the Data Protection Regulation
If you have any questions about this Privacy Notice, please contact the subsidiary company that you are dealing with for further information.
Who we are
Chilton Williams Limited is a company incorporated and registered in England with company number 06585064. Chilton Williams Limited is the controller of personal data relating to individuals within its client firms and prospective client firms for the purposes of providing products and services, relationship management, marketing and business development.
What personal data do we collect about you?
We collect personal data about you when you apply to buy our goods and/or services. This data will relate to personal identifiable information (such as name, date of birth), contact information (such as telephone number, address, email), and financial information (salary, bank statements, financial accounts and credit referencing information). We may also process special categories of personal data (sensitive data) such as data about your health or medical conditions. Prior to processing special category data, we will gain your informed and explicit consent. For more information on consent click here.
Our legal basis for processing your personal data
We may rely on a number of legal basis for collecting and further processing your personal data, which are:
- Contractual Necessity
- Legal Obligation
- Legitimate Interest
- Consent
Contractual Necessity
We collect personal information about you when you request our products or services. We will ask you to provide some information about yourself.
We will also collect personal data for the purposes of the performance of a contract with you, such as:
- Providing you with our products
- Providing you with access and use of our services
- Administering your account with us
- Communicating with you about our products and services
- Communicating with you about your account with us (including call recording/monitoring)
Legal Obligation
We may also process your personal information to allow us to comply with certain legal obligations to which we are subject. We will also work co-operatively with the national data protection authority, the ICO, in relation to any data protection matters. Where we are subject to regulation or national law enforcement, we may process your data to meet our legal and regulatory requirements.
Legitimate Interest
We may use your personal data for our legitimate business interests, whilst carefully considering and balancing any potential impact on you and your rights as a data subject under the relevant data protection regulation. This may include processing your personal data to allow us to provide the best services and customer experience and to ensure our service remains relevant and tailored to your needs.
We will always ensure that our legitimate interests will never override your rights and freedoms under the data protection regulation.
As an example, we may rely on our legitimate interest to process your personal data for the following purposes:
- For Direct Marketing, relating to products and services that are compatible with the original purpose for which we originally gained the information
- To communicate with you, including newsletters and marketing materials
- To communicate important updates about our products or services, which we think may be of interest to you
- For evidential purposes to effectively manage and maintain records of our relationships/communications with you
- For business development related activity such as contacting you by telephone or email to arrange meetings with our experts in relation to work or knowledge sharing
- To enhance, modify, personalise or otherwise improve our services and communications for the benefit of you
- To determine the effectiveness of promotional campaigns to inform marketing strategy
In addition, we may use legitimate interests to perform statistical and other analysis on the personal data we collect, to help us understand and improve how people use our products or services.
Please note, you have the right to object to the processing for which we rely on legitimate interest as the legal basis. You can do so and update your marketing preferences by opting out of future marketing materials as they arrive or by contacting the subsidiary company you are dealing with.
Consent
We are required to gain your explicit consent prior to processing your data for any other purpose other than the original purpose for which it was gained.
Where we require such consent, we will provide you with sufficient information to allow you to make an informed decision. We will ensure that we only gain consent via a clear and affirmative act, freely given by you that indicates your consent to specific purposes.
You have the right to withdraw your consent at any time and can do so by opting out of future marketing materials as they arrive or by contacting the subsidiary company you are dealing with.
Your rights as a data subject
As a data subject you can exercise certain rights in relation to the processing of your personal data, under the relevant data protection regulation. These are:
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to object
- The right to data portability
- The right to lodge a complaint with the ICO
- The Right to Understand the Source of data gained indirectly
- The Right to be advised of any Automated Decision-making
If you want more information about your rights, you can find it here:
Your Right |
What this means |
How you can exercise this right |
The right of access |
You have the right to confirmation on whether or not we are processing your personal data and, where that is the case, access to that data, including the following information:
We shall provide a copy of the personal data being processed free of charge. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing with. |
The Right to Rectification |
You shall have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing with. |
The Right to Erasure |
In some circumstances you have the right to have your personal data erased and no longer processed where:
We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing with. |
The Right to Restrict Processing |
You have the right to obtain the restriction of processing where one of the following applies:
Where you have obtained restriction of processing you have the right to be informed by us before the restriction of processing is lifted. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing with. |
The Right to Object |
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interest. We will respond to your request within one month of your request. We will advise any other recipients to whom the personal data has been disclosed. |
To object to us processing your personal data for all other legitimate To object to us processing your personal data for direct marketing purposes please unsubscribe from direct future communications by selecting the opt out button. This may take a maximum of two |
The Right to Data Portability |
You have the right to receive the personal data concerning you, which you have provided to us and have the right to transmit those data to another controller without hindrance from us to which the personal data have been provided, where:
Where feasibly possible, you also have the right to have the personal data transmitted directly to another controller. We will respond to your request within one month of your request. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing with. |
The Right to Lodge a Complaint with the ICO |
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO). |
The contact details of the ICO are: Website: www.ico.org.uk Helpline: 0303 123 1113 |
The Right to Understand the Source of Data Gained Indirectly. |
You have the right to be informed of the source of any personal data that are not collected directly from you. |
You can request this information at no charge from us by contacting the subsidiary company that you are dealing |
The Right to be Advised of Appropriate Safeguards for the Transfer of Personal Data to a Third |
Where personal data is transferred to a third country (outside of the EU) or to an international organisation, you shall have the right to be informed of the appropriate safeguards relating to the transfer. |
We will advise you of this prior to any such processing taking place. |
The Right to be advised of any Automated Decision- making |
Unless the information is necessary for entering into a contract with us, or you have given your explicit consent, you shall have the right not to be subject to a decision based solely on automated processing, which produces legal effects that affect you. |
You can request this information at no charge from us by contacting the subsidiary company you are dealing with. |
How will we use your personal data?
We will only process your data where we have a legal basis to do so. We use data collected to communicate with you and to offer you our products or services. We may use your data to improve or maintain the services we offer to you. We will never share your data with any other third party, other than those stated in this policy, nor use your data for any other purpose, unless we firstly gain your explicit consent to do so.
You have the right to restrict the processing of your personal data. For more information click here. You can choose which promotional communications you wish to receive and how you would like to receive them.
Who we share your data with?
We share your data with approved third-party providers that have adequate data protection measures in place that align with the requirements of the data protection regulation, such as:
Third-party provider |
Legal basis |
Systems/CRM providers |
Performance of a Contract |
Auditors |
Performance of a Contract |
Funders |
Performance of a Contract |
Insurance Firms |
Performance of a Contract |
Collections Agents |
Performance of a Contract |
Solicitors |
Performance of a Contract |
Credit Reference Agencies |
Performance of a Contract |
Insolvency Practitioners |
Legal Obligation |
For all customers, sharing of your personal data in this way also allows Chilton Williams Limited to monitor and manage any concentration risk or credit risk exposure to its business.
We do not share information outside the EU.
Credit Reference Agencies (CRAs)
To process your application, we will perform credit referencing and identity checks on you using one or more CRAs. If you are accepted for one of our products, we will also make periodic searches to enable us to manage your account with us. To do this, we will share your personal information with CRAs, and they will give us information about you. This will include:
- Identity and contact data
- Information from your credit application
- Information about your financial situation and financial history
- Public information (including electoral register)
- Shared credit details
- Fraud prevention information
We will use this information to:
- Assess your creditworthiness and whether you can afford to take the product we are offering
- Verify the accuracy of the data you have provided to us
- Prevent criminal activity, fraud and money laundering
- Manage your account with us
- Trace and recover debts
- Ensure any offers provided to you are appropriate to your circumstances
We will continue to share information about you with CRAs while you hold a relationship with us. We will also inform the CRAs when you settle an account or if you fail to repay an account in full or on time. This information may also be supplied to other organisations by CRAs. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the CRA information notice (CRAIN) which is accessible here.
Retention period
We will only keep personal data for as long as necessary for the purposes for which it was gained and only where we continue to have a legal basis for doing so. We will review the personal data we hold on you in line with our retention policy, to check for accuracy and relevancy and to ensure we continue to have a legal basis for processing. If the personal data is no longer necessary, or where we no longer have the legal basis for processing, we will delete or fully anonymise the data we hold on you, in line with our Data Protection Policy. If your data becomes inaccurate, we will update it accordingly. Otherwise, we will retain your personal data for the following periods:
Firm Name |
Retention Period |
Chilton Williams Limited |
6 years from the termination of the contract to which you are party |
Security and Confidentiality
We are committed to transparency, ensuring that your privacy is protected and that your data is used and retained fairly, transparently and in compliance with the data protection regulation. We will make sure that we have appropriate technical and organisational measures in place to keep your personal data secure and to protect against accidental or unlawful destruction, loss, alteration, disclosure or access. We will provide a level of security appropriate to the risk presented by the nature of the processing we do.
Help keep your personal data accurate and up to date
This privacy statement details the standards that Chilton Williams Limited will apply when processing your personal information. In return, it is important that you help keep your information, accurate, reliable and up to date. Any changes to your personal data, such as a new address can be notified to the subsidiary company that you are dealing with.
Data Champion
Each of our subsidiary companies has a local Data Champion who can be contacted if you have any queries or requests concerning this privacy notice, or your personal information and how we process it. Data Champions can be contacted through email on: dataprotection@chiltonwilliams.com
Alternatively, requests and queries can also be sent to:
Senior Compliance Manager
Chilton Williams, 2nd Floor, St James House, The Square, Lower Bristol Road, Bath, BA2 3BH
Phone: 01225 474230
Email: dataprotection@chiltonwilliams.com
Complaints
We will be more than happy to help should you have any complaints about the processing of your personal data. Please contact the subsidiary company you are dealing with, or the Senior Compliance Manager.
You have the right to lodge a complaint with the Supervisory Authority, the Information Commissioner Officer (ICO), who are the national authority responsible for the protection of personal data. A complaint can be made to the ICO via their website or through their helpline (0303 123 1113).