Privacy Notice

1. At The Cumberland Group, your privacy is really important to us and you can find out more here about your privacy rights and how we gather, use and share your personal information. This includes the personal information we already hold about you now and the further personal information we might collect about you, either from you directly or from a third party. How we use your personal information will depend on our relationship with you and, if you are a customer, the products and services we provide to you
2. This Privacy Notice provides up to date information about how we use your personal information and will update any previous information we have given you about using your personal information (also referred to as personal data). We will update this Privacy Notice if we make any changes affecting how we use your personal information. In the event of a significant change to how we use your personal information we may contact you to let you know about the change.

2. We are the ‘data controller’ of personal information we gather and use. When we say ‘we’ or ‘us’ in this Privacy Notice, we mean Cumberland Building Society. Cumberland Building Society is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register No. 106074). Credit facilities other than regulated mortgages and regulated credit agreements are not regulated by the Financial Conduct Authority.
3. Cumberland Building Society has a subsidiary company, Borderway Finance (Company No. 03048466) which provides vehicle finance products and services. Borderway Finance Limited is regulated by the Financial Conduct Authority (Financial Services Register No. 670091). When we say ‘Group’, we mean this company too. If you are a customer of Borderway Finance, when we say ‘we’ or ‘us’ we mean that company instead. Borderway Finance is the ‘data controller’ of the personal information gathered and used in it’s operations.

3. If you have any questions about this Privacy Notice or our privacy practices (including exercising any of your other privacy rights set out in Section 4), you can contact our Data Protection Officer (DPO), who makes sure we look after your personal information properly. Our DPO can be contacted by:
   • emailing DPO@cumberland.co.uk;
   • calling 01228 403141; or
   • writing to Group Data Protection Officer, Cumberland Building Society, Cumberland House, Cooper Way, Parkhouse, Carlisle, CA3 0JF.
4. If you are exercising any of your privacy rights, please make requests in writing, and provide us with evidence of your identity. It helps us to deal with your request if you can also provide your:
   • full name;
   • date of birth; and
   • address and postcode.
5. Where you have given us consent to receive marketing, you can withdraw consent, and update your marketing preferences by:
• emailing us at help@cumberland.co.uk;
• calling us on 01228 403141;
• visiting any Cumberland branch; or
• writing to us at Cumberland Building Society, FREEPOST, Cumberland House, Cooper Way, Parkhouse, Carlisle, CA3 0JF.

It would help us deal with your request if you let us know, which of our group companies you are contacting us about. We will update your preferences as soon as possible.

4. Under data protection law you have rights we need to make you aware off. You have the right to object to how we use your personal information. You also have the right to see what personal information we hold about you. In addition, you can ask us to correct inaccuracies, delete or restrict personal information or to ask for some of your personal information to be provided to someone else. We have described your rights and the circumstances in which they apply in the table below at 4.4 of this Privacy Notice.
5. You can make a request to exercise any of your rights in this Privacy Notice free of charge by contacting a local branch or our DPO. We will respond to your requests in accordance with our obligations under data protection law.
6. You can make a complaint about how we have used your personal information to us, by visiting your local branch or by contacting our DPO. You can also make a complaint to a supervisory authority – in the UK, this is the Information Commissioner’s Office. Visit their website at https://ico.org.uk/concerns/.
7. Your Rights:

Rights	Description
Your right of access	You can request access to a copy of your personal information that we hold, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for, whether it has been used for any automated decision making and, when we have obtained it from someone other than you, where we obtained it from.
Your right to rectification	You can ask us to change or complete any inaccurate or incomplete personal information held about you.
Your right to erasure	You can ask us to delete your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
Your right to restriction of processing	You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.
Your right to object to processing	Where we are processing your personal information for direct marketing purposes or on the basis of a legitimate interest, you can object to our processing of your personal information, by contacting our DPO with details of your objection.
Your right to data portability	You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
Your right to withdraw consent	If you have given us your consent to use personal information, you can withdraw your consent at any time and, update your marketing preferences.

5. If you are a customer, we obtain personal information:
• directly from you, for example when you fill out an application; and
• by observing how you use our products and services, or those of other members of our Group, for example from the transactions and operation of your accounts and services.
6. We may also collect more limited information from you before you become a customer, when you are considering or applying for our products and services.
7. Sometimes where we ask for your personal information needed to enter into a contract with you or to meet a legal obligation (such as a credit check), we will not be able to provide some products or services without that personal information.
8. If you are not a customer or a prospective customer, the personal information we collect from you will depend on the type of relationship you have with us. This may be as a guarantor or referee or as the occupier, tenant or purchaser of a property or as the dependent of a customer.
9. We also may obtain some personal information from monitoring or recording calls and when we use CCTV. We will record or monitor phone calls with you for regulatory purposes, for training and to ensure and improve quality of service delivery, to ensure safety of our staff and customers, and to resolve queries or issues.
10. We use a variety of personal information depending on the products and services we deliver to you or the type of relationship we have with you. We categorise this information into broad types which we have noted below.
    
    Further information about how we categorise the personal information our Group collects from you
    
    

    Personal	Contact	Transactional	Documentary
    Name Previous Names Date of Birth Nationality NI Number Marital Status	Address Email Address Telephone Numbers	Account Transactions Payment Requests Insurance Claims Complaints Fraud Data	Passport Driving Licence Utility Bills Birth Certificate Marriage Certificate Bank Statements

    
    

    Financial	Social	Recordings & Online Identifiers	Special
    Financial Status Financial History Credit Score Residential Status Bank Details Employment Details Income & Expenditure Tax Information	Family Dependents	Call Recordings CCTV IP Address	Political Opinions Health Criminal Convictions

    
    
11. We use personal and contact information for all customers and others. For other types of information, it will depend on which company in our Group you are a customer of or have provided your data to.
    
    Further information about the personal information Cumberland Building Society collects from you
    
    Customers
    
    

    	Savings & Current Accounts	Mortgages	Insurance	Business Finance
    Personal	✔	✔	✔	✔
    Contact	✔	✔	✔	✔
    Transactional	✔	✔	✔	✔
    Documentary	✔	✔	✔	✔
    Financial	✔	✔	✔	✔
    Recordings & Online Identifiers	✔	✔	✔	✔
    Social		✔
    Special	✔	✔	✔	✔

    
    
    Others
    
    

    	Applicant	Guarantor	Referee	Occupier	Family, Friends or Dependents	Third Party Loan Providers
    Personal	✔	✔	✔	✔	✔	✔
    Contact	✔	✔	✔	✔	✔	✔
    Transactional
    Documentary	✔	✔
    Financial	✔	✔				✔
    Recordings & Online Identifiers	✔	✔
    Social	✔			✔	✔
    Special	✔	✔

    
    
    Further information about the information Borderway Finance collects from you Customers
    
    Customers
    
    

    	Vehicle	Personal Loans
    Personal	✔	✔
    Contact	✔	✔
    Transactional	✔	✔
    Documentary	✔	✔
    Financial	✔	✔
    Recordings & Online Identifiers	✔	✔
    Social
    Special

    
    
    Others
    
    

    	Applicant	Indemnifier
    Personal	✔	✔
    Contact	✔	✔
    Transactional
    Documentary	✔	✔
    Financial	✔	✔
    Recordings & Online Identifiers	✔	✔
    Social
    Special

    
    
    

6. We may obtain personal information about you from other organisations, this may include, but is not limited to:
1. credit reference, fraud and financial crime prevention and tenant reference agencies;
2. other regulated firms, within Schedule 9 of the Proceeds of Crime Act 2002, in compliance with information sharing provisions in the Economic Crime and Corporate Transparency Act 2023.
3. any referees you have provided to us;
4. government bodies and agencies;
5. HM Revenues & Customs and tax authorities;
6. regulators;
7. professionals acting on your behalf, such as solicitors, accountants and intermediaries;
8. people who have legal authority to act on your behalf, such as deputies and those with lasting power of attorney; and
9. other people who know you including joint account holders and people you are linked to financially.

7. We only use your personal information where this is permitted by the laws that protect your privacy rights. We only use personal information when:
1. we have your consent (if consent is needed);
2. we need to use the information to comply with our legal obligations;
3. we need to use the information to perform a contract with you;
4. it is fair to use the personal information either in our interests or someone else’s interests, where there is no disadvantage to you – this can include where it is in our interests to contact you about products or services, market to you, or collaborate with others to improve our services;
5. processing is necessary in the vital interests of protecting someone’s life; and/or
6. processing is necessary for performance of a task in the public interest.
8. Where we use your personal information based on your consent, you have the right to withdraw it. We will let you know how to do that at the time we gather your consent.
9. Special protection is given to certain kinds of personal information that are particularly sensitive. This is information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sex life or sexual orientation, genetic or biometric identifiers, trade union membership or criminal convictions or allegations. We will only use this kind of personal information where:
1. we have a legal obligation to do so (for example to protect vulnerable people);
2. it is necessary for us to do so to protect your vital interests (for example if you have a severe and immediate medical need whilst on our premises);
3. it is necessary in carrying out our obligations in the field of employment;
4. it is made public by the data subject;
5. it is in the substantial public interest;
6. it is necessary for the prevention or detection of crime;
7. it is necessary for insurance purposes; or
8. you have specifically given us explicit consent to use the information.




Further information about how we use your personal information and our basis for doing so

We will only use and share your information where it is necessary for us to carry out our lawful business activities. Your information may be shared with and processed by other Group companies. We want to ensure that you fully understand how your information may be used. We have described the purposes for which your information may be used in detail in a table below:




Contract

We may process your information where it is necessary to enter into a contract with you for the provision of our products or services or to perform our obligations under that contract. This may include processing to: assess and process applications for our products and services; provide and administer our products and services; operate your accounts; and/or communicate with you about your accounts.

Legal Obligation

We are required by law to collect and process certain personal information about you. This may include processing to: check and verify your identity; carry out credit checks; provide regulatory reports; prevent and detect crime; comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption, immigration and international sanctions; provide mandatory communications; investigate and resolve complaints, remediate errors occurring on your account or service and manage any reimbursement; carry out audits; protect our staff; ensure the resilience and reliability of our service; and/or assist law enforcement.

Legitimate Interests

We may process your information where it is in our legitimate interests do so as an organisation and without prejudicing your interests or fundamental rights and freedoms. This may include processing to: compile internal reports; defend legal claims and disputes; test our systems; monitor, maintain and improve our services; prevent financial crime, fraud and other criminal activities; to provide and administer our products and services; to promote and market our products and services; ensure that we are offering appropriate products and services; and/or assess and process applications for our products and services.

Consent

We may process your information where you have provided us with clear and specific confirmation of your consent to do so. This may include processing to; check and verify your identity; tailor information and products to you; and/or provide direct marketing to you.

Sometimes we use your personal information in automated processes to make decisions about you, such as credit scoring or for the prevention of fraud. We might also use automated processes to create a profile of you for these purposes. We do this to help ensure decisions are made accurately, fairly and efficiently and to offer you products and services tailored to you and to reduce the risk of fraud.

Further information on when we use automated processes and the logic, significance and consequences of these processes for you.

Credit scoring

We use automated decision making using your personal information to create a profile of you for credit scoring – a method which predicts your credit worthiness based on your financial profile.

To carry out credit scoring we use information you give to us, information we obtain from credit reference agencies, and details about how you have used other products and services you have with us or the Group (for example how you are making repayments on other credit products). In some cases we will also use external data sources for credit scoring. See 9.2 of this Privacy Notice for a list of credit reference agencies we use. We analyse this information to identify a credit score based on how likely it is that debts will be re-paid.

We use credit scoring to make the following decisions about you:

• whether we enter into a contract to provide a product or service to you;
• whether to adjust products or services you have (such as an increasing or decreasing credit limits);
• to pre-approve future products or services for you;
• to authorise overdraft limits; to authorise payments from you; and
• in some cases where we need to recover a debt from you.

Profiling for marketing

We want to ensure that you get the most relevant information about our products and services at the right time. The most effective way for us to do this is to use automated processes to create a profile of you for marketing.

We use processes to analyse your personal information to decide what products and services to offer to you and to prioritise the marketing messages you receive by:

• assessing your eligibility for those products and services;
• assessing how likely they are to be useful for you; and
• deciding how likely you are to respond.

9. We will only share your personal information with other organisations for the reasons detailed in this Privacy Notice.
10. In order to process your application and to provide our products and services to you, we will share your personal information with credit reference agencies both at the time of your application and for as long as you are a customer. They also will give us information about you.
    

    Further information about credit reference agencies.

    The data we exchange with credit reference agencies can include the following categories:

    • Personal
    • Contact
    • Product
    • Financial

    We will use this information to:

    • manage and take decisions about your account; including to assess your creditworthiness and whether you can afford to take the product;
    • check your identity and verify the accuracy of the data you have provided to us;
    • prevent criminal activity, fraud, financial crime and money laundering;
    • manage your account(s);
    • trace and recover debts; and
    • ensure any offers provided to you are appropriate to your circumstances..

    We will also inform the credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, credit reference agencies will record the outstanding debt. This information may be supplied to other organisations by credit reference agencies.

    When credit reference agencies receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

    If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. Credit reference agencies will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the credit reference agencies to break that link.

    If false or inaccurate information is provided and/or fraud or financial crime is identified or suspected, details will be passed to fraud and financial crime prevention agencies. Law enforcement agencies and other organisations may access and use this information. Fraud and financial crime prevention agencies may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud and financial crime prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

    If we, or a fraud and financial crime prevention agency, determine that you pose a fraud, financial crime or money laundering risk, we and others may refuse to provide the services and financing you have requested, to employ you, or we may stop providing existing services to you.

    A record of any fraud, financial crime or money laundering risk will be retained by the fraud and financial crime prevention agencies, and may result in others refusing to provide services, financing or employment to you. Fraud and financial crime prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud, financial crime or money laundering risk, your data can be held for up to six years.

    The identities of the credit reference agencies, their role also as fraud and financial crime prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the credit reference agencies are explained in more detail by each of the three credit reference agencies at the links below:

    • www.transunion.co.uk/legal/
    • www.equifax.co.uk/privacy-hub/crain;
    • www.experian.co.uk/crain
11. We will also share personal information within our Group where we need to do so and have a lawful basis to do so. Examples of such instances may include sharing your personal information between our Group companies to ensure that we can make products and services available to you, market products and services to you, meet or enforce a legal obligation or where it is fair and reasonable for us to do so.
12. Who we share your personal information with depends on the products and services we provide to you and the purposes we use your personal information for. For most products and services we will share your personal information with our own service providers such as our IT Suppliers.
    
    Further information about others (outside our Group) we share your personal information with.
    
    All Group Companies
    
    

    Type of Recipient	Industry	Location
    Professional Consulting Provider	Financial Services	UK, US, India
    Credit Reference Agencies	Financial Services	UK
    Digital Security Provider	IT	UK
    Regulatory Compliance Management Provider	Risk Management	UK
    Document Storage & Archive Management Provider	Storage & Archiving	UK
    Confidential Waste Disposal	Data destruction & Recycling	UK
    External Auditors	Audit Services	UK
    Rating & Review Platform	Business Insights	UK

    
    
    Cumberland Building Society
    
    

    Type of Recipient	Industry	Location
    Financial Regulators	Regulator	UK
    Financial Ombudsman	Regulatory	UK
    Payment Service Providers*	Financial Services	UK, US
    Banking Services Providers	Financial Services	UK, US
    Digital Printing Provider	Financial Services	UK
    Digital Security Provider	Financial Services	UK, EEA, US
    MIG Providers	Financial Services	UK
    SMS Fulfilment Platform	IT	UK
    Software Providers	IT	UK, US, Australia, EEA, New Zealand
    Data Analytics Provider	IT	UK
    Digital Security Provider	IT	UK
    IT Service Provider	IT	UK
    Financial Data Analyst	Data	UK
    Mailing Houses	Print & Logistics	UK
    Valuers	Property	UK
    Conveyancing Partner	Legal	UK
    Lawyers & Estate Agents	Legal	UK
    Insurance Partners	Financial Services	UK
    Environmental Risk Assessors	Property	UK
    Fraud and Financial Crime Prevention Services	Financial Services	UK
    Environmental Impact Tracking	Financial Services	UK
    Broker Portal Provider	Financial Services	UK
    Customer Engagement Specialists	Financial Services	UK

    
    
    Borderway Finance
    
    

    Type of Recipient	Industry	Location
    Financial Regulators	Regulatory	UK
    Loans Management Platform	IT	UK, EEA
    Online Application Platform	IT	UK
    Accounting Software Provider	IT	UK
    SMS Fulfilment Platform	Mobile Technology	UK
    Payment Services Provider*	Financial Services	UK

    We may also share personal information with a third party who purchases the whole or part of our business or that of any member of our Group. We will notify you of the details of the third party if this happens and ensure that you are provided with their privacy notice.

    *Worldpay is a data controller in respect of personal data gathered by the Group for this Type of Recipient. A copy of Worldpay’s Privacy Statement can be obtained from their corporate website or by clicking the following link https://www.worldpay.com/en-gb/privacy-policy

10. We may need to transfer your information outside the UK to service providers, agents, subcontractors and regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the European Economic Area, such as the USA.
11. We will only transfer your personal information outside the UK where either the country has been deemed to provide an adequate level of protection for your personal information, or we have put in place appropriate safeguards to ensure adequate security as required by data protection law.
12. In addition to ensuring that your personal information is kept safe by carrying out strict security checks on our overseas partners and suppliers we back this up with strong contractual undertakings approved by the relevant regulators which may include implementing an International Data Transfer Agreement, reliance on approved Standard Contractual Clauses or reliance on Binding Corporate Rules.
13. You can find out more information about standard contractual clauses as detailed by the ICO. Visit their website at https://ico.org.uk and search for ‘International transfers’.

11. Retention periods for your personal information are determined based on the type of record and the products and services we deliver to you.
12. In some circumstances we will hold personal information for longer where necessary for active or potential legal proceedings, to resolve or defend claims, making remediation payments and where we cannot delete it for technical reasons.
13. Retention periods may be changed from time to time based on business or legal and regulatory requirements.

Further information about how long we keep your personal information for.

You can obtain more specific information about how long we retain particular documents and personal information by contacting our DPO using the details above.

12. What are cookies?
    
    A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer or electronic device which allow us to distinguish you from other users of our site. Cookies recognise your preferences, provide personalised content, security and enable our site to function more efficiently. To find out more about cookies visit www.allaboutcookies.org.
    
13. The categories of cookies we use on our site are known as:
    
    Essential cookies: These cookies are always on and are essential for our website to work. They cannot be disabled.
    
    Analytical cookies: These cookies help improve our website by collecting and reporting information on how you use it. Analytical cookies are only enabled if you give consent.
    
    Marketing cookies: These cookies help us understand your interests and show you relevant adverts. Marketing cookies are only enabled if you give consent.
14. The table below details the cookies we use and why:
    
    

    Category	Host(s)	Name	Purpose	Duration
    Essential	banking.cumberland.co.uk	JSESSIONID	Used to maintain session anonymity	Session
    Essential	cumberland.co.uk	incap_ses_1183_874499	Used to maintain existing session	Session
    Essential	cumberland.co.uk	visid_incap_874499	Used to identify previous sessions	12 months
    Essential	www.cumberland.couk	XSRF-TOKEN	Used to maintain site security	Seconds
    Essential	www.cumberland.co.uk	ICFUSERSESSION	Used to allow the online enquiry forms to operate fully. This cookie is set upon arrival to any Cumberland website (excluding Cumberland Internet Banking).	Session
    Essential	cumberland.co.uk borderwayfinance.co.uk	visid_incap	Used by Imperva to identify users as a user of the website, forms part of the website’s security	12 months
    Essential	cumberland.co.uk borderwayfinance.co.uk	cookiecontrol	Used to manage cookie preferences on the website	Session
    	www.cumberland.co.uk	laravel_session	Used by Laravel to track user sessions, this cookie is used then users are accessing the Mortgage Calculator	Expires on session end
    Analytical	banking.cumberland.co.uk www.cumberland.co.uk www.borderwayfinance.co.uk	_ga	Used to calculate visitor, session and campaign data for analytics	24 months
    Analytical	www.cumberland.co.uk	_hjsession_	Used by Hotjar to track mouse position, mouse clicks and other interactions with the website.	Session
    Marketing	www.cumberland.co.uk	_fbp	Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers.	3 months
    Marketing	www.cumberland.co.uk	MUID	Used by Microsoft to store and track visits across the website	12 months
    Marketing	www.cumberland.co.uk	sa-user-id-v2	Used by StackAdapt to record information about website activity	12 months
    Marketing	www.cumberland.co.uk	_uetvid	Used by Bing Ads to store and track visits across the website	13 months
    Marketing	www.cumberland.co.uk	sa-user-id sa-user-id-v3 MSPTC _uetsid incap_ses_ _hjsessionUser_	Used by HubSpot to store and time of visits to the website	13 months
    Marketing	www.cumberland.co.uk	AEC	Used by Google to detect spam, fraud and abuse to help ensure advertisers are not incorrectly charged for fraudulent or otherwise invalid impressions or interactions with ads.	6 months
    Marketing	www.cumberland.co.uk	APSISID SAPISID	Used by Google to display personalised advertisements on Google sites. They allow Google to collect user information for videos hosted by YouTube	2 years
    Marketing	www.cumberland.co.uk	SID	Used by Google as a security cookie to authenticate users, prevent fraudulent use of login credentials and protect user date from unauthorised parties	2 years
    Marketing	www.cumberland.co.uk	SIDCC	Tracks how users use the website and any advertisements the user may have seen before visiting the website	2 years
    Marketing	www.cumberland.co.uk	HSID	Used by Google to encrypt entries of the users Google account and the last login time to protect against attachs and data theft from form entries	2 years
    Marketing	www.cumberland.co.uk	NID	Used by Google to create a unique Google ID which is used to remember a users preferences and other information	1 year
    Marketing	www.cumberland.co.uk	ar_debug	Used by Google, this cookie debugs the advets which it serves	1 year
    Marketing	www.cumberland.co.uk	receive-cookie-deprecation	Used by Google, this cookie is used for advertising and analytics	1 year
    Marketing	www.cumberland.co.uk	MR	Used by Microsoft as a unique identifier to support user tracking.	1 week
    Marketing	www.cumberland.co.uk	__Secure-1PAPISID __Secure-1PSID __Secure-1PSIDCC __Secure-3PAPISID __Secure-3PSID __Secure-3PSIDCC	Used by Google to build a profile of the users who visit the website, this includes their interests in order to show relevant and personalised Google advertising	1 to 2 years

15. How do I change my cookie settings?
    
    You can change your cookie settings at any time by clicking here. Alternatively, you can restrict the use cookies within your browser or device. However, please note that certain parts of our website may not work if you disable or restrict cookie usage in your browser.
    
    Find out how to manage cookies on popular browsers:
    
    
    • Google Chrome
    • Microsoft Edge
    • Mozilla Firefox
    • Microsoft Internet Explorer
    • Opera
    • Apple Safari
16. Our use of Google Analytics Advertising Features
    
    We use Google Analytics Advertising Features to generate further information on users age, gender and interests, and to segment and target them for remarketing. If you wish to opt out of Google Analytics Advertising Features this can be done by visiting https://tools.google.com/dlpage/gaoptout/ and https://adssettings.google.com/