Privacy Notice

1. Why do we have a Privacy Notice?

We are giving you this notice because we want you to feel confident about the privacy and security of your personal information and because we would like to explain how we will use and process it. Shelby Finance Ltd, trading as ‘Dot Dot Loans’ (“we”, “us”, “our”, “Shelby Finance”), is the controller under applicable data protection laws. Shelby Finance is a subsidiary of Morses Club Limited.

When we refer to "personal information" in this Privacy Notice, we mean information which identifies you as an individual (whether on its own or in connection with other information that we hold about you). For example, your name, address, email address, phone numbers, and some less obvious details like a list of payments you already make and the IP address relevant to you as a visitor to our Dot Dot Loans website. More details can be found below.

We have a Data Protection Officer who can be contacted by email at [email protected], by telephone on 0333 240 6215 or by post at:

Data Protection Officer
Shelby Finance Ltd
Building 1, The Phoenix Centre
1 Colliers Way
Nottingham
NG8 6AT

In addition, please refer to the ‘Contact Us’ section (below).

Please read this Privacy Notice carefully.

2. What does this Privacy Notice cover?

This Privacy Notice applies to how Shelby Finance Ltd deals with your personal information which is collected through our www.dotdotloans.co.uk website. We will collect and process personal information about you when you visit the website. We process your personal information when you apply for one of our financial products and afterwards (whether your application is successful or not) and when we are otherwise in contact with you (for instance when you call us or email us). It does not apply to any other organisation or to any other organisation’s website even if you access them through our website. If you disclose your personal information to other companies your information will be dealt with according to their own privacy policies and practices.

3. What personal information do we collect about you, and when do we collect it?

We collect the following personal information about you:

Category of Personal Data:	Collected From:
Your full name and initials*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your postal address(es)*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your date of birth*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your marital status* and your title, e.g. Mr/Mrs/Miss/other title.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your contact telephone numbers (daytime and evening – this will include mobile telephone numbers and/or fixed line numbers depending on which you choose to give)*	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your email address*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Your IP Address*.	From your use of our website.
Your country of location*.
The amount of time your device spends on our website.	From your use of our website.
Device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. This is your personal information because it all links to your IP address. Hotjar stores this information on our behalf in a pseudonymized user profile. For more information about the processing of this personal information – see references to Hotjar at the end of the table in Section 5 below.	From your use of our website.
Your employment details*.	You - Completing an application form or contacting us.
Your salary details (including pay date frequency)*.	You - Completing an application form.
Details of your non-salary income.	You - Completing an application form or contacting us.
Details of your regular or one-off expenses*.	You - Completing an application form or contacting us.
Your requested loan amount and term*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
The reason for your loan*.	You - Completing an application form or contacting us, or from brokers and other providers of financial products.
Details of your payment history for previous or active Shelby Finance products*.	Our records of your previous or active products with us.
Your credit status and credit history (including the information set out in Section 7 below)*.	Credit reference agencies and fraud prevention agencies.
Your history of name changes*.	You - Completing an application form or contacting us. We will also receive information about your history of name changes from credit reference agencies (see “Credit Checking and Account Management” below).
Your postal address history*.	You - Completing an application form or contacting us. We will also receive information about your history of name changes from credit reference agencies (see “Credit Checking and Account Management” below).
Bank account details*.	You - Completing an application form or contacting us.
Bank account balance and incoming and outgoing transactions for the last six months*.	From a third-party income and expenditure verification service via Open Banking, where your application is referred for further checks. This third party is called consents.online (see “Our use of Open Banking” below).
Debit Card Details*.	You - Completing an application form or contacting us.
The number of children or dependents in your household.	You - Completing an application form or contacting us.
Your residential status (whether you own or rent your home)*.	You - Completing an application form or contacting us.
Details of whether you have any special needs, health conditions, or are otherwise vulnerable - if you choose to make us aware of these, or in the event we are otherwise made aware of these via someone else.	You - Completing an application form or contacting us. Third parties such as your friend, partner, relative or other person who contacts us on your behalf.
Your marketing preferences.	You - Completing an application, or where you otherwise contact us to inform us of your marketing preferences.
Your signature*.	You - Completing an application form or contacting us.
Your comments or other information entered into via our “Contact Us” page, any customer satisfaction surveys and/or in any correspondence between us.	You - Completing an application form or contacting us.
Your voice. Transcripts of customer service interactions through email, secure messaging and Live Chat.	You – When discussing your loan account via telephone.

* The processing of these categories of personal data is mandatory in order to assess your eligibility for one of our financial products and to enable us to administer it during its term. A failure to provide this information may result in us being unable to offer our products to you.

If we have purchased your account from another provider, we will have obtained your personal information from that other provider (instead of from you). This will have been explained to you in the ‘welcome letter’ we addressed to you.

4. Cookies relevant to Dot Dot Loans

We use cookies to ensure our website works properly and to help us improve our service. We also use cookies to collect data to understand how people use our site and to personalise content.

Please read the Cookie Policy on our website for more information about which cookies we use. A link to our Cookie Policy is presented to you when you first visit our website, so that you can decide whether to consent to non-essential cookies.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit: http://www.allaboutcookies.org/

5. For what purposes do we use your personal information?

We will use your personal information in the following ways:

Purpose	Categories of personal data	Lawful basis for processing
To verify your identity. To enable us to consider and process your application for our products and services. To verify your credit standing. To verify your income and expenditure. To comply with the Financial Sanctions regime. To check against the list of Politically Exposed Persons.	All categories of personal data set out in Section 3 above except your marketing preferences.	This processing is necessary for the performance of our contract with you. This processing is necessary for compliance with legal obligations to which we are subject. In relation to verifying your credit standing and income and expenditure, our processing is also necessary for our legitimate interest of making sure that we enter into loan agreements with customers whose credit history does not expose our business to undue risk and our legitimate interest of acting as a responsible lender or service provider. In relation to Financial Sanctions, our processing is also necessary for our legitimate interest of making sure that we meet the expectations of the Financial Conduct Authority (FCA) by having systems and controls in place to guard against the risk of financial crime. We must not carry out transactions with, or provide any financial services to, any person who is subject to a financial sanctions order from the government. We will check you are not subject to a financial sanctions order. We will screen all existing and new customers against the HM Treasury (HMT) list of financial sanctions orders. We will check for any updates to the HMT list. In relation to Politically Exposed Persons/high-risk customers our processing is also necessary for our legitimate interest of making sure that we meet the expectations of the Financial Conduct Authority (FCA) by having systems and controls in place to guard against the risk of having a customer who is a Politically Exposed Person (PEP). We will check you are not on the list of PEPs and that you are not an immediately family member or close associate of a PEP. A PEP is an individual whose prominent position in public life may make them vulnerable to corruption.
To assess your credit history and confirm your employment details (as explained further in Sections 6 and 7).	All categories of personal data set out in Section 3 above and Sections 6 and 7 below - except your marketing preferences.	This processing is necessary for the performance of our contract with you. This processing is necessary for compliance with legal obligations to which we are subject. In relation to assessing your credit history, our processing is also necessary for our legitimate interest of making sure that Dot Dot Loans enters into loan agreements with customers whose credit history does not expose our business to undue risk and our legitimate interest of acting as a responsible lender, or service provider.
To perform actions in line with the contract we have with you (the agreement) including administering and servicing this agreement and setting up payments, if necessary. In addition, sending you customer service communications and replying to questions you ask/enquiries you make in relation to our contract with you. For example, from time to time we need to let you know about certain things that are happening with your account, for example, to alert you to a failed payment or following a request to reset your password. We may also need to correspond with you if you contact us for assistance. We’ll usually (though not always) send these communications to you by email or within your online account. We may occasionally call you by telephone for this purpose. In addition, sending you legal and regulatory information in relation to our contract with you. For example, when we need to tell you about changes to our policies, terms or conditions. We’ll usually (though not always) send these communications to you via email or as a message within your online account. We may also occasionally need to send these to you by post.	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for the performance of our contract with you. This processing is necessary for compliance with legal obligations to which we are subject.
To collect unpaid amounts that may be owed by you in relation to any Dot Dot Loans.	All categories of personal data set out in Section 3 above except your marketing preferences.	This processing is necessary for the performance of our contract with you.
To develop and manage our products and services in order to meet your needs and those of our customers more generally, and to determine your own eligibility for the different ranges of products and services from Shelby Finance (current products and products to be offered in the near future) which we consider you may be interested in. ‘Products and services’ here means financial ones – such as loans, credit, accounts. This processing is unlikely to happen if you defaulted or have an arrears history in relation to a Dot Dot Loans product, or if we consider you to be a fraud risk based on your current or historic activity in relation to a Dot Dot loan. What we have described above means we will be carrying out some profiling, i.e. looking at your behaviour, including in an automated way, in relation to the products and services you have from us, to see if you could be a potential customer for other products and services from us.	All categories of personal data set out in Section 3 above.	This processing is necessary for our legitimate interests of creating new or updated products and services to improve our service offering to existing and potential new customers and our legitimate interests in finding out which of our customers could be a potential customer for other products and services from us.
To notify you about changes to our website, our services or our products (this means service communications – not marketing communications).	All categories of personal data set out in Section 3 above.	When we notify you about changes to our website, the app, or services or our products, this will be for the performance of our contract with you.
For us to communicate with you to provide you with marketing information about our own products and services that you request from us or our other products and services (see above where we call this ‘cross marketing’), or about products and services from Morses Club Limited. To share your name and contact details with Morses Club Limited for its own marketing.	All categories of personal data set out in Section 3 above.	For our own marketing to our own customers about our own existing and new products and services - the processing of your personal information is necessary for our legitimate interests of promoting those products and services. We would explain how to opt-out of our marketing. We would remind you of how to opt-out in each marketing communication. For our own marketing to our own customers about existing and new products and services from Morses Club Limited – the processing would be with your opt-in consent. You can withdraw that type of consent at any time. For marketing from Morses Club Limited about its own existing and new products and services – and our sharing of your name and contact details to that end – the processing would be with your opt-in consent. You can withdraw that type of consent at any time. For our own marketing based on legitimate interests we need to tell you about a balancing test we have performed. We have balanced our legitimate interests in promoting our business and our own products and services to you as against your own rights and freedoms which require us to protect your personal information and we have carefully determined that your own rights and freedoms will not be overridden when we send you our marketing. We will not send you an excessive number of marketing messages over any given period; we will respect any request from you asking us to stop our marketing within a reasonable period; we will only be marketing our own products and services which are similar to those you already hold (i.e. all are financial products); we will suppress your contact details in our marketing database where we have identified you as a vulnerable customer, or being in arrears or default on any Dot Dot loan; and by making sure you know how to stop our marketing. We would remind you of how to opt-out in each marketing communication. In all cases you can object at any time to our direct marketing or stop our marketing. For the simple way to stop our marketing see section 15 below. You can also find out about how to object by using your rights under data protection law. See section 12 below. You can object to or stop marketing from Morses Club Limited at any time and to do this you should use its own contact details which will be in the marketing communication itself.
Customer research or satisfaction surveys to monitor and improve the quality of our product and service offerings (which may involve using your data in quality and performance training).	Your full name and initials; postal and correspondence address(es); contact telephone numbers; e-mail address; comments or other information provided via our “Contact Us” page; any customer satisfaction surveys and/or in any correspondence between us.	This processing is necessary for our legitimate interests in requesting information to help us monitor and improve our products and services.
To undertake market analysis, forecasting, business planning and auditing exercises in connection with our business.	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for our legitimate interests of management planning and forecasting in relation to our business.
To contact you in connection with any enquiries that you raise.	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for our legitimate interests of responding to questions and comments raised by individuals that contact us.
To detect, prevent and investigate fraud and money laundering. We may use information provided by fraud prevention agencies as part of this, as well as social media sites, to check information you have supplied to us if you have made your profile on those sites public/viewable by others based on your privacy settings	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for compliance with legal obligations to which we are subject. Our legitimate interests in taking steps to protect our business from the risk of fraud and money laundering, is also relevant.
To comply with laws and our regulatory requirements.	All categories of personal data set out in Section 3 above.	This processing is necessary for our legitimate interests of complying with laws and regulatory requirements.
To, establish, defend, exercise, enforce or to protect our rights, property or safety, or that of our customers, employees or other persons with whom we have a business relationship.	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for our legitimate interests of establishing, defending, exercising, enforcing or protecting our rights and others with whom we have a business relationship.
For monitoring and recording of telephone calls and email communications where necessary for compliance with regulatory rules or self-regulatory practices or procedures relevant to our business, to prevent or detect crime, for quality, training and security purposes.	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for our legitimate interests of complying with regulatory rules and ensuring we are implementing quality checking and compliance processes.
To assist you with our products and services in the event we become aware you require additional support, have special needs or are otherwise vulnerable because of a physical or mental health issue.	All categories of personal data set out in Section 3 above - except your marketing preferences.	In most cases this processing is necessary for reasons of the substantial public interest of safeguarding your economic wellbeing if we become aware you are at economic risk as a result of a physical or mental injury, illness, health condition or disability. In exceptional cases, we may have to do this processing to protect a customer’s vital interests or those of another person and when the customer is incapable of giving a valid consent. Vital interests mean there is a threat to the customer’s life or someone else’s life, or a real risk of very serious harm to a customer or another person. We will only ask for your explicit consent where we cannot rely on one of the lawful reasons mentioned directly above. At the same time, this processing is necessary for our legitimate interests of complying with regulatory requirements about the fair treatment of vulnerable customers. We have balanced this against your own rights and freedoms, and they are not overridden in this context because this processing is what is necessary to enable us to treat you fairly and protect your own economic well-being. This information will only be available to people in our business who need to know it. We will duly observe the principle of data minimisation and will therefore only process this information where we reasonably believe it is necessary. Sometimes (in rare cases) this processing will be necessary for our compliance with legal obligations (for example, if you have a disability which has to be noted and dealt with so that we can comply with legislation).
To anonymise your personal data for market research, statistical and analytical purposes, including producing statistical research and reports	All categories of personal data set out in Section 3 above - except your marketing preferences.	This processing is necessary for our legitimate interests of creating anonymous data sets that we can use for research, statistical and analysis purposes.
To collect information from your browser and device when you access our website. To do this, we use software provided by a third party called Hotjar. Hotjar uses cookies and other technologies to collect data about how visitors use our website and their devices. Hotjar is contractually forbidden to sell any of the data collected on our behalf. We have configured the Hotjar service so that it does not collect key personal data you provide when submitting a loan application such as your name, address, bank account details and information about your employer. You may opt-out of Hotjar collecting your information when visiting our website at any time by visiting Hotjar’s opt-out page at https://www.hotjar.com/opt-out and clicking 'Disable Hotjar'. You will need to do this on each browser you use. Alternatively, you can prevent Hotjar from collecting your information by activating the “Do Not Track” setting in your browser, which will also opt you out of similar services that use this setting to disable tracking.	Device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. This is your personal information because it all links to your IP address.	This processing is necessary for our legitimate interests of analysing users’ activities on our website and their devices (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like). This allows us to build a better user experience and service. As Hotjar uses cookies which are not essential for our website, we will ask for your consent to place those cookies on your device. Consent is also the lawful reason we rely on under data protection laws to collect your personal information through those cookies. When we subsequently use that personal information to improve our service and the user experience, we do not rely on consent as our lawful reason under data protection laws. Please see above where we refer to our legitimate interest. For more information on cookies, please refer to our Cookie Policy.

Where we process any special category data about you, for example any health information you provide us with, we will process this only:

• where you have given explicit consent to the processing of such data (we will only ask for this if we cannot rely on the alternatives below); or
• for the establishment, exercise or defence of legal claims; or
• where the processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of social security and social protection law; or
• where you have manifestly made public that personal data; or
• where the processing is necessary for reasons of substantial public interest, this means safeguarding (protecting) your economic wellbeing when a physical or mental injury, illness, health condition or disability you have made us aware of or which we otherwise become aware of puts you at economic risk, making it difficult for you to make repayments on your Dot Dot loan. As you can see from the table above, this is the lawful basis we will use in most cases where we process our customers’ special category data. We will usually explain this in more detail at the point (or shortly after the point) we are first made aware of a health issue that is affecting your economic wellbeing.

6. Automated systems and processing of personal information

We will use credit scoring and other automated systems:

• to assess your application,
• to verify your identity,
• to prevent and detect fraud and money laundering; and
• to check you are not on the HM Treasury Financial Sanctions list or the Politically Exposed Persons list

Automated Decision Making

Our automated systems are used to make a recommendation about whether you should be accepted for a Dot Dot loan. These automated systems compare the information in your application form and information from a credit history check which is gathered from credit reference agencies (“CRAs”). In this way we can assess the risk of non-payment if we were to grant you a Dot Dot loan (see Section 7 for more details about what we obtain from CRAs). The personal information processed in our automated systems for this purpose includes your name, address(es), date of birth, employment status, salary, details of your non-salary income, details of your regular or one-off expenses, requested loan amount, reason for your loan, previous payment history, credit status and credit history. We compare the information provided by the CRAs in an automated way against our customer database to evaluate whether you are likely to be able to repay your requested Dot Dot loan amount. Further details below.

When you make an application for a Dot Dot loan, we will decide whether to offer you the product applied for using automated processes. This enables us to ensure that our decisions are made fairly and quickly and that our required criteria are consistently applied. As part of this process we need to: (i) verify your identity and assess your ability to meet the terms of the product applied for, (ii)verify that there is no record held with the fraud prevention agencies linking to information you have provided during your application; and (iii) check whether you are on the HM Treasury Financial Sanctions list or the Politically Exposed Persons list. To do this we automatically request third party searches.

In relation to (i) above: we use the information obtained from the Credit Reference Agencies which we refer to in Section 7 and analyse the results received. The factors considered during this decision-making process are:

• the information provided by you on the application form
• information about any previous applications you have made or attempted to make
• information we hold regarding the account history of any products you have previously had from us
• information about your credit history which is obtained from credit reference agencies
• information about your identity which is obtained from credit reference agencies

In relation to (iii) above: we use the information obtained from our third-party provider of HM Treasury Financial Sanctions list and Politically Exposed Persons list screening services. We simply take account of whether you are on the HM Treasury Financial Sanctions list or the Politically Exposed Persons list. If you are on either one of those lists, or both, your application will be automatically declined.

We regularly test our decision-making process to ensure it remains fair, effective and unbiased. We explain this in more detail below:

Step 1 - only relevant to previous customers and applicants: If you have previously applied for a Dot Dot loan and been declined within a period of 30 days prior to your current application, our systems will decline your application. If you are a previous customer of Dot Dot Loans, we will check our database to see whether you made your repayments as required. If you did not make your repayments on a previous loan as required, your application will be declined. If you did make your repayments, your application will pass to Step 2.

Step 2 - relevant to all customers and applicants: Our automated systems gather information from Credit Reference Agencies (see section 7) about your credit score and credit history (for example, how you have repaid other loans with other providers and whether you have defaulted). The systems check this information against what we call scorecards (more details below about these below) to generate a suitability score for your application (this means we grade you based on how likely you are to repay the Dot Dot loan amount which you have applied to have and whether the information available to us indicates you can afford the loan). If you do not meet the minimum suitability score, then your application will be declined. If you exceed the minimum suitability score, the systems will use the credit score and credit history information, as well as repayment history information relating to any previous loan you have had from us, to determine the maximum loan value that Dot Dot Loans will be able to offer you.

Scorecards are mathematical models which attempt to provide an estimate of the probability that a customer will display a defined behaviour (e.g. default on their loan) with respect to their current or proposed borrowing. Credit scoring typically uses observations and data from customers who fell into arrears or defaulted on their loans plus observations and data on a large number of customers who did not. This model can be used to predict the probability of arrears or default for other customers (this means you if you are applying for a Dot Dot loan) using the same observation characteristics (e.g. age, income, homeowner etc.). The probability of you falling into arrears or defaulting are then scaled to a "credit score." This score ranks customers by riskiness without explicitly identifying their probability of default.

Additionally, the personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found at www.cifas.org.uk/fpn.

If your application satisfies Step 1 and Step 2, a final decision as to whether to accept your loan application and the value that Dot Dot Loans may loan to you is made in an automated way, i.e. without any lending decisions being made by a human.

You have a right to request that your application is reviewed by a member of our team, to express your point of view on the automated decisions that we make about you and to contest our decisions. This is the case for all of the automated decisions we mention above (i.e. identity verification, credit scoring, checks of the HM Treasury Financial Sanctions list and the Politically Exposed Persons list). If you would like us to reconsider any decision made automatically, please contact us (as set out in the “Our Contact Details” section below). If you ask us to complete a manual review following an automated decision, we will do so but please note this means we will not be able to consider your application within our normal timescales.

7. Credit Reference Agencies

If we need to verify your identity, we will share your personal information with CRAs and use information obtained from CRAs, which will include information about you taken from the electoral register. We will also do a credit history check with CRAs. See below for more details. We do not ask CRAs for information about associated persons such as your spouse or partner, though other companies may do that and for this reason the CRAs require us to tell you about this activity. That is why ‘financially linked records’ held at the CRAs are mentioned below.

More information about credit history checks

If you are applying for a Dot Dot loan, CRAs supply us with details of your credit history and associated information. When CRAs receive a credit history check request from us (this is what we refer to as a ‘credit application search’ below), they will record the details of the request and place a search ‘footprint’ on your credit file. That footprint will be seen by other lenders and persons unrelated to us (i.e. the other customers of the CRAs) if they undertake credit checks on you in the future in connection with their own financial products and services. We will provide information about your agreement with us for your Dot Dot loan and your repayment performance to the CRAs. We report to these third parties at least once a month, including details of the payments you make, payments that you do not make on time and details on any default against this agreement. Our records will remain on your credit file for 6 years after they are closed, whether settled by you or defaulted by us.

Here is more information about how we carry out this activity in practice. If you apply for one of our credit products (this means a Dot Dot loan), we will firstly carry out a quotation search with the credit reference agency TransUnion. This is also known as a “soft search” and is not visible on your credit file to other lenders. This search provides us with information relating to your credit history and other associated information. We will then carry out a further soft search with the CRA to verify your identity and residence which, again, is not visible to other lenders. This search includes us being provided with information about you from the electoral register. If we make an offer to you and you accept this, we will carry out a credit application search and this will be visible on your credit file to other lenders.

If you take one of our credit products, we will provide information about this agreement and your repayment performance to the CRAs. We report to these third parties at least once a month, including details of the payments you make, payments that you do not make on time or fail to make, any repayment arrangement you may agree with us and details of any default against this agreement as a result of non-payment. This information will remain on your credit file for 6 years from the date your account is closed, whether settled by you or defaulted by us. During the life of your Dot Dot loan, we will need to conduct a further soft search with the CRAs every 12 months to comply with anti-money laundering laws; this search is not visible on your credit file to other lenders and will only be relevant if you have an open Dot Dot loan for 12 months or longer.

The personal data that we will share with CRAs includes:

• Your current full name
• Your current postal address
• Your date of birth
• Your mobile phone number
• Your bank account number and sort code
• Your monthly income
• Your postal address history
• Details of your payment history in relation to the credit product(s) you have with us

The CRAs can also share your information with other organisations (more details in the paragraph below).

The CRAs will provide us with the following information relating to you:

• Your name and aliases
• Your date of birth
• Your address and previous addresses
• Your financial details including details of your income/debts and repayment history
• Confirmation of bank account ownership
• Any court judgments that have been issued against you
• Any Bankruptcy, Individual Voluntary Arrangement (IVA), Debt Relief Orders (DRO) or other forms of insolvency / similar events relating to you
• Fraud prevention indicators
• "Gone away indicators" (which indicate whether you have left an address, partially settled your account or are deceased)
• Search footprints where enquiries have been made about you
• Your credit scores and ratings
• Flags and triggers, for example where you may be flagged as subject to fraud, and indicators of the certainty of the information they provide
• Any Politically Exposed Persons (PEPs) and Sanctions data

We and those other companies (meaning the other customers of the CRAs if they undertake credit checks on you in the future in connection with their own financial products and services) will use these records and other information to make credit decisions about you. The CRA records will also be used by those other companies (meaning the other customers of the CRAs) to make credit decisions about your current spouse, partner or other individual that has been financially linked or associated with you (for example if you have a joint account with them). Those other companies will: search, link and/or record information at CRAs about you both; link any individual identified as your financial associate, in their own records; take both your and their information into account in future applications by either or both of you (as relevant), and continue this linking until one of you notifies those other companies or the CRAs that you are no longer linked; links between all such persons will remain on your and their files at the CRAs until such time as you or the other relevant person successfully files for a disassociation with the CRAs. If your circumstances change such that you are no longer a financial unit with another person, you should contact the CRAs directly using the contact details in the “How to find out more about Credit Reference Agencies” section below.

8. How to find out more about Credit Reference Agencies

More information about CRAs and how they use personal data is available at the following links:

• For Experian: www.experian.co.uk/crain
• For Equifax: www.equifax.co.uk/crain
• For TransUnion: www.transunion.co.uk/crain

You can contact the CRAs as per the following:

• Post: Experian, PO Box 9000, Nottingham, NG80 7WF. Phone: 0115 828 6738
• Post: Equifax Ltd, Customer Service Centre, PO Box 10036, Leicester, LE3 4FS. Phone: 0333 321 4043 or 0800 014 2955. Email: [email protected]. Visit: https://www.equifax.co.uk/Contact-us/Contact_Us_Personal_Solutions.html
• Post: TransUnion, One Park Lane, Leeds, West Yorkshire, LS3 1EP. Phone: 0330 024 7574. Email: [email protected]. Visit: www.transunion.co.uk/consumer/consumer-enquiries

9. Our use of Open Banking

In some instances, your application for a Dot Dot loan may be subject to additional checks in order for a lending decision to be made. If this is the case, you will need to agree to our use of consents.online, a third-party Account Information Service Provider (AISP)for the purpose of them supplying some of your financial information to us. Consents.online is an FCA authorised and regulated service that lets you grant us permission to view the transactional information relating to the bank account you specified within your application through “Open Banking”. This is a paper-free way of you sharing your income and expenditure information with us so that we can thoroughly and fairly assess whether you can afford to take out a loan. It also removes the need for you to send bank statements, pay slips or other income and expenditure-related information to us.

You are not automatically opted into Open Banking and we will only use it in relation to your application if we decide it is required and you give permission to consents.online. This is what we mean by ‘consent’ throughout this section 9. If you give consent for this, consents.online will share your personal information (further details below) with Shelby Finance Ltd, trading as Dot Dot Loans. It is important to understand that ‘giving consent’ is in the context of consent under Open Banking regulations and is not the same thing as ‘giving consent’ in the context of consent under the General Data Protection Regulation (GDPR). The consent you give to consents.online means you are giving your permission to them so that they can share your personal information with Shelby Finance Ltd in accordance with the contract they have with you. When you look at the privacy notice of consents.online you will see that they share your personal information with providers like us based on the GDPR lawful basis of it being necessary to administer the contract which they have with you. In turn, we then use this personal information for our legitimate interest of doing what we describe at the end of the paragraph directly above.

As part of the Open Banking process, we will direct you to consents.online, who will ask you to provide your first and last name, email address and phone number. You will then be asked to select which bank/building society you hold your current account with before being asked for your consent to access the following account information and share it with Shelby Finance Ltd, trading as Dot Dot Loans:

• Name of your bank/building society
• Your account name, number, and sort code
• Your account balance
• Incoming transactions for the last six months
• Outgoing transactions for the last six months

Once you have given consent to consents.online, a secure, encrypted connection will be made with your bank/building society, and you will be asked to authenticate yourself in the same way as you would to access your online banking log in. Your bank/building society will then ask you to confirm that you would like to share your account information with consents.online before this is passed to them, who will then share it with us.

You will only be providing consent to consents.online accessing this information and sharing it with us on a one-off basis and we will be limited to read-only access and cannot make any changes to your bank account. We will not ever share this information with any other third party.

You can withdraw your consent to this service at any time by contacting consents.online by email at [email protected] or telephone on 0800 180 8570. This means withdrawing your permission – this is not the same thing as withdrawing a GDPR consent and we have explained why above. Withdrawing your consent means that consents.online will delete their record of your statement data and we will no longer be able to access it, though we will retain a record that we referred to consents.online in order to make a lending decision regarding your loan.

We will use this information as part of our credit and affordability checking processes, which includes verifying your income and expenditure, in order to decide whether we can offer you a loan. We will notify you of the outcome of this review within one working day.

If you do not agree to consents.online supplying us with your bank account information via Open Banking where we request this, you will not be able to complete your application and we will not be able to provide you with a loan.

When consents.online uses your personal information, it will be acting as a controller of that information. It will process your information in its own name as it has the sole mandate for that (which means it takes all decisions in relation to its own use of your personal data and we have no control over its use of your personal data). Please read consents.online’s privacy notice for more information about how it will process your personal data as a data controller. You will be able to view this once we direct you to consents.online’s website towards the end of your application.

10. Do we share your personal information with anyone else?

As part of our usual business activities we may share your details with:

• Debt collection agencies, if your Dot Dot loan falls into arrears, to enable them to contact you (whether in person, by post, email, or telephone) and recover the sums owed.
• Our market research provider to enable them to conduct customer research or satisfaction surveys on our behalf to monitor and improve the quality of our product and service offerings (see the table above for more details about what personal information is shared for customer satisfaction surveys).
• Our professional legal, accountancy and other advisors and auditors based in the United Kingdom in order to obtain legal, accountancy and other professional advice.
• Our IT service providers based in the United Kingdom that provide network and storage infrastructure and/or software programs and support to us in connection with the operation of our business
• Fraud prevention agencies.
• Mail houses to enable them to print and send non-marketing communications to you via post on our behalf.
• Our third-party provider of HM Treasury Financial Sanctions list and Politically Exposed Persons list screening services.
• Our third-party provider of identity verification and credit scoring checks.
• Our third-party payment providers to enable us to process debit card transactions or Direct Debits when you make any repayments in relation to a Dot Dot loan.
• Where we have received your personal details from a third-party broker of financial products, we will notify them of whether you are eligible to apply for one of our products and whether you have subsequently obtained a product from us. We do not obtain lists of information from brokers for any marketing purpose – this is only about dealing with their referral to us about you as a potential customer.
• We will disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any laws, regulations or good governance obligations, or in order to enforce or to protect their rights, property or safety, or that of our customers or other persons with whom we have a business relationship. These third parties will include (without limitation) the Courts, the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, the police, Action Fraud, the National Crime Agency, HMRC, HM Treasury and the Department of Work and Pensions. Our disclosures of your personal information to the Courts, to government departments and to regulatory bodies who have the power to compel that disclosure because of their statutory functions, and to the police in cases where they have obtained a Court order for information from us, will be for compliance with our legal obligations. In all other cases, the disclosures described in this paragraph will be for our legitimate interests in dealing with requests for information from these third parties or for the legitimate interests they have in seeking information from us to perform their own functions.
• We may share your personal data with others (such as emergency services and law enforcement authorities) where that is necessary to protect your vital interests including to protect you from harm/help to ensure your own safety.
• In the event that we sell any part(s) of Shelby Finance Ltd or Morses Club Limited (our parent company), we will also disclose your personal data to actual or potential purchasers of parts of its business or assets, and their respective advisers and insurers for our legitimate interest of restructuring our business in that particular way and also for the potential purchaser’s legitimate interests of:
  • enabling potential purchasers to complete due diligence on, and value, the business and/or assets;
  • transferring the personal data in connection with any relevant sale and the transfer of our contractual rights and/or obligations; and
  • the use of such personal data by a purchaser for the operation of its business.

11. Transfers outside the European Economic Area (EEA)

We will not transfer your data out of the European Economic Area (EEA) to any country that has been deemed (by the European Commission) to have inadequate data protection controls, except where such transfers are lawful under data protection law, including where we use appropriate safeguards in relation to the transfer, such as EU Commission’s Standard Contractual Clauses (SCCs), or their UK equivalents (you can contact us for copies or more details).

12. For how long does Shelby Finance keep personal information?

We will retain your personal data for the period during which any balance remains outstanding and thereafter until the expiry of a period of six years.

If you apply for one of our products and your application is unsuccessful, your personal data will be held by us for up to 18 months for our legitimate interests of fraud prevention, internal analysis and responding to applicant queries and requests, for example in relation to CRA search information.

If you complete a customer satisfaction survey, your personal data in relation to that survey will be held by us for a period of up to 6 months from the date that you submitted the survey response.

If you raise a complaint or there is a dispute between us, your personal data will be held by us for a period of up to six years following the resolution of the complaint or dispute.

If you raise a general enquiry with us (which does not involve a complaint or dispute), your personal data in relation to that enquiry will be held by us for a period of up to one month.

When we communicate with you by phone, your call will be recorded. This data will be kept for 6 months.

We will retain your personal data for longer than the periods specified above if required by law, to defend or exercise legal rights (such as defending legal claims) or to comply with regulatory obligations.

13. What rights do I have to my personal data?

It is important to us that you are aware of the rights you have under data protection legislation regarding your own information. As a result, we would like to make you aware of the rights that you have as a data subject:

Rights in relation to automated decisions making which have a legal effect or other significant effect on you.
You have the right to request that a human review the automated decision.

The Right of Access. You may request access to or copies of the personal information that we hold about you (known as a “Data Subject Access Request”) as set out in the “How can I find out what personal information Shelby Finance holds about me?” section below. If you would like to exercise this right, please contact us (as set out in the “Our Contact Details” section below).

The Right to Rectification. You have the right to have inaccurate information about you corrected. For more information, see the “How can I change the personal information Shelby Finance holds about me?” section below.

The Right to Erasure. You may request that your personal information be deleted where it is no longer necessary for the purposes of which it is being processed and provided there is no other lawful basis for which we may continue to process such personal information. If you would like to exercise this right, please contact us (as set out in the “Our Contact Details” section below).

The Right to Data Portability. Where you have provided us with your personal information that we process using automated means, you may be entitled to a copy of that personal information in a structured, commonly used and machine-readable format. If you would like to exercise this right, please contact us (as set out in the “Our Contact Details” section below).

The Right to Object. In some circumstances, you may, on grounds relating to your situation, object to our processing of your personal information. We will consider any objections to processing on the circumstances relating to each case. This includes, for example, the right to object to your personal information being used for direct marketing by us. If you would like to exercise this right, please contact us (as set out in the “Our Contact Details” section below).

The Right to Restrict Processing. You may also request that we restrict the processing of your personal information to that to which you have consented or for the establishment, exercise or defense of legal claims or the protection of the rights of another person:

• whilst we verify your data as set out in “The Right to Rectification” above;
• pending verification of our legitimate grounds for processing your personal information. This is relevant, for example, if we rely on legitimate interests, after giving you an opt-out opportunity, as our lawful reason for using your personal information for direct marketing; or
• if the processing is unlawful or no longer necessary but you wish for us to retain your personal information for the purposes of establishing, exercising or defending legal claims.

If you would like to exercise this right, please contact us (as set out in the “Our Contact Details” section below).

You have the right to withdraw consent. This is only relevant when we rely on consent as our reason to process your personal information. If you would like to exercise this right against Shelby Finance please contact us (as set out in the “Our Contact Details” section below).

You also have the right to lodge a complaint with the Information Commissioner’s Office, who is the UK’s independent regulator of information rights. More information can be found at https://ico.org.uk/make-a-complaint/ or by contacting them by phone or letter using the details below:

Address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

As mentioned in Section 6 you also have the right to ask for a person to review an automated decision taken about you during the application process.

14. How can I find out what personal information Shelby Finance holds about me?

Your right to access, as detailed above, or to obtain copies of your personal information may extend to (but is not limited to) some or all the following items below.

• Copy of your Agreement
• Your application details
• Your payment history with us
• Statement of account
• Account notes
• Any charges applied to your account
• Telephone calls recorded for quality and training purposes

We will endeavor to fulfill your request within one month of receiving the request, though this timescale may be extended if your request is particularly large or complex.

A Data Subject Access Request is free, however, where a request is manifestly unfounded or excessive, we may require a reasonable administrative fee or refuse to act on the request. This will be based on the true administrative cost and will be discussed with the requester on application.

You can make a Data Subject Access Request or exercise your other rights by contacting us (as set out in the “Our Contact Details” section below).

15. How can I change the personal information Shelby Finance holds about me?

Please tell us if your personal information, including contact details or address, change at any time so that we can update our records. If some of the information we hold about you is inaccurate (for instance because you have changed your marital status or name, moved address, or changed your telephone number or email address) or incomplete, please contact us (as set out in the “Our Contact Details” section below. We will take steps to seek to correct or update any information if we are satisfied that the information, we hold, is inaccurate or incomplete. In certain circumstances, you may also request that we restrict our processing.

16. How can I manage how Shelby Finance contacts me for marketing purposes?

We usually capture your marketing preferences when you submit your name and contact details through our website, or when you apply for a Dot Dot loan, or when we write to you.

We may contact you by post, SMS, telephone, or email for marketing purposes. In addition, we may place marketing messages about our own products and services in banners or pop-ups on our website. You might see these after you have logged in as a customer – unless you have opted-out of our marketing.

To change your marketing preferences, you can contact us using our contact details (set out in our Contact Us page below). We will process your request within a reasonable period.

Any marketing communication by email or SMS which are from us will also include details of how you may unsubscribe.

17. How do we protect the security of your personal information?

We are serious about guarding the security of your personal information and the details of any transactions or applications made. We keep your information confidential by using systems that store and transfer your data under strict security controls. We ensure your data is only accessed by appropriate personnel that have a justified reason to see your data. We also ensure that our systems and software are kept up to date and perform well to allow you to access your data when you need to. The systems and controls we have in place also help us protect against unauthorised or unlawful processing, accidental loss, destruction of, or damage to, your personal information.

18. How do you obtain copies of our Privacy Notice?

If you require a printed copy of this Privacy Notice or a copy in another format such as audio or Braille, then please contact us using the contact page.

19. Our contact details

You can contact us by phone on 0333 240 6215, by email at [email protected], or by writing to us at Dot Dot Loans, Building 1, The Phoenix Centre, 1 Colliers Way, Nottingham, NG8 6AT.

Last updated: 12/06/2023