How we use your information

Under data protection law, an organisation that decides how the personal information it collects and holds is used is called a ‘data controller’. We call this use of personal information ‘processing’.

The Mortgage Works (UK) plc is a subsidiary company of Nationwide Building Society and part of the Nationwide Group. If you’re a customer of The Mortgage Works (UK) plc, the data controller of your personal information is The Mortgage Works.

The Mortgage Works and Nationwide Building Society has a number of subsidiary companies and overseas branches and is a member of various limited liability partnerships. These include Nationwide Covered Bonds LLP, E-Mex Home Funding Ltd, Derbyshire Home Loans Ltd, UCB Home Loans Corporation Limited and Home Propositions Limited.

In some cases, one of these companies or partnerships will be the data controller. In this notice, when we say ‘The Mortgage Works’, ‘we’, ‘us’ or ‘our’, we mean The Mortgage Works business that is the data controller of your personal information.

The information we might collect and hold about you includes:

• Personal information to identify and contact you, such as your name, address, contact details and date of birth. This could also include biometric information, like your fingerprint. Read more about this in the special category data section.
• Information about your work or profession, your nationality, education and social and economic demographic.
• Details of the accounts and products you hold and/or previously held with us, and how you use them.
• Information about your financial position and history, which may include source of funds and wealth.
• Details of products with other providers that you’ve told us about or we’ve sold to you.
• Personal information gathered from when you’ve applied for a product or service, including where an application was declined.
• Details of when you contact us and when we contact you.
• Details of the type of device you are using (e.g. whether it’s an Apple phone or a Windows computer).
• Information on your location, gathered from your mobile phone or other devices, where you access the internet or where you make a payment.
• Details of how you use our website and online services.
• Details you make public on social media e.g. Facebook/Twitter.
• Information about your interactions with The Mortgage Works online or by telephone.
• Other information that you supply to us or that we obtain from our relationship with you. For example, your marketing preferences. This could include sensitive information (e.g. something you tell us about your health – we call this special category data.

When we talk about ‘information’ throughout this page, we’re referring to all of these items.

Most of the information we hold about you comes directly from you. This includes information you give us when you:

• apply for our products or services
• update your information (such as when you change your address)
• speak to us on the phone (we may record some calls for training and quality purposes)
• use our websites or web chat services
• send us letters, emails or other documents.

Sometimes, we might use other information in addition to this. For example, information about your account activities (e.g. details of payments you’ve made). In certain situations, we may use information that you’ve made public such as tweets or social media content too (e.g. when you interact with our social media profiles, like referencing The Mortgage Works in a tweet).

We might collect or receive information from certain third parties too. These include:

• Credit reference agencies
• Government bodies and agencies
• HM Revenue & Customs and other tax authorities
• Regulators
• Law enforcement agencies
• Fraud prevention agencies
• Insurers
• The Electoral Roll and other sources of publicly available information (e.g. Sanctions list, media)
• Our service providers
• Companies and organisations that introduce you to us
• Financial advisers
• Land agents
• Card associations
• Comparison websites
• Market research providers
• Tracing and debt recovery agents
• Organisations providing data services to support us in managing our relationship with you and operating our business.

Sometimes, we’ll need to collect information from people acting on your behalf. This could be from a joint applicant on an account you hold, a broker, or someone who holds a Power of Attorney. If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

In the event that you’re providing information about another individual, we’ll assume that you have told them that you are sharing their details and where they can find more information on how we may process their details.

We collect and use your information so we can open and manage your mortgage accounts, provide services and also operate our business. Examples of how we use your information include:

• Checking your identity and confirming that it is you.
• Managing your mortgage accounts and relationship with us.
• Checking your credit reference and making sure products are affordable.
• Confirming your income and outgoings.
• Preventing and detecting fraud and financial crime.
• Providing products and services of our partners.
• Helping you in challenging times and for debt recovery.
• Enhancing your experience of our products and services.
• Sharing relevant marketing about our products and services.
• Meeting our legal and regulatory obligations.
• Testing our systems and processes.

We’re able to use your information for the purposes outlined above, where one of the following applies:

• We use the information to carry out our obligations to you, as part of an agreement between you and The Mortgage Works.
• We must use the information to comply with the law or in the public interest.
• We use the information to carry out our legitimate business interests.
• You have given us consent to use the information.
• We use your information to protect your vital interests (e.g. in very exceptional circumstances when we believe it’s in your best interests).

You can find out more about how we use your information in the next sections.

We collect and use your personal information to check your identity when you open a mortgage account, product or service with us, and from time to time throughout our relationship.

How do we use your information in this way?

We use your information to check that it’s you when you open a mortgage account. To do this, we collect and share your information with databases held by credit reference and fraud prevention agencies. This is so that we can verify your identity.

Why do we use your information in this way?

It’s all about keeping your personal details safe. We check your identity to:

• Make it harder for criminals to use false names and addresses, steal the identities of innocent people and access financial products and systems by pretending to be you.
• Help prevent fraud and stop money laundering.
• Uphold our legal obligations and complete necessary due diligence checks to make sure we know our customers.

You can find out more on why we check your identity and the types of documents we’ll need to do this on our proving your identity page.

We may also check your identity for our legitimate business interests. For example, to follow guidance and best practice set by our regulators. However, we’ll always make sure that the way we process your information is not unfair to you.

In certain circumstances, you have the right to object to us processing your personal information. Discover more about this, and your other rights, on the Your information rights page.

We need to use your personal information to keep in touch with you and take care of your mortgage accounts, products and services.

In managing your accounts and relationship with us, we may use information we already hold about you (e.g. your address and contact details). This is so we provide you with the best experience (e.g. by pre-populating sections on certain application forms, so you don’t have to) and ensure that we hold consistent and correct information about you across our systems.

We’ll process your information in this way when it’s required as part of the terms and conditions agreed between us, and also when you ask us to carry out activities that need your authorisation.

When do we process your information?

• When you apply for a product or service with us, either directly or through an intermediary
• When providing the services and benefits offered as part of your relationship with us, for example, when we’re administering payments on a mortgage account
• To send you communications to service your account
• To manage your queries and complaints
• To assess and accommodate our service to meet customer needs
• To make sure the information we hold about you is accurate and of good quality.

When you apply for a product or service with us, either directly or through an intermediary

Why do we process your information?

It’s part of your agreement with us that you’ll provide us with certain information before we can offer you a product.

When applying for a mortgage, decisions are often made through automated means. This is so that we can work out your eligibility and whether we’re able to enter into an agreement with you. You’ll find more information on this under the Automated Decision Making section.

Who might we share your information with?

• Credit reference agencies, fraud prevention agencies
• Referees, intermediaries and your employer, for example, when confirming your income as part of a mortgage application
• Other financial providers
• People or organisations acting on your behalf.

When providing the services and benefits offered as part of your relationship with us

Why do we process your information?

It’s part of your agreement with us that we will provide you with these services. We use your information and profiling when providing your services to ensure:

• you can maintain access to your products
• you continue to meet the eligibility requirements for the account
• your product remains appropriate.

This allows us to be fair and consistent in the way we treat our customers, provide you with your information in a clear and concise way and ensure you receive the level of service you would expect.

There may be activities you request that we complete in relation to your account where we require your authority to continue.

Who might we share your information with?

• HMRC and other government agencies, such as DWP
• Credit reference agencies and fraud prevention agencies
• Suppliers acting on our behalf
• People or organisations acting on your behalf
• Payment processors such as BACS, and card associations such as Visa
• Organisations providing data services to support us in managing our relationship with you and operating our business
• Other banks and building societies, so that those making payments to your account can confirm the name they have for you matches the account name we have in our records

To send you communications to service your account

Why do we process your information?

As part of your agreement with us, we need to send you certain communications, such as your statement and confirmation of interest rates.

We also have legitimate interests to send certain service communications, where necessary. This is due to our obligations as a responsible lender, our regulators’ guidance and best practice. We’ll make sure the way we process your information is not unfair to you.

Who might we share your information with?

Suppliers acting on our behalf.

To manage your queries and complaints

Why do we process your information?

We have legitimate interests to use your information where necessary to investigate and respond to any complaints you have raised with us.

This is because we’re committed to resolving any queries and complaints in a timely manner and will need to process your information to do so. We also have to comply with our regulatory obligations and guidance. We will make sure the way we process your information is not unfair to you.

Who might we share your information with?

• Financial Ombudsman Service and regulators, such as the Information Commissioners Office (ICO)
• Third parties on your behalf and with your authority, such as your MP, solicitor, claims management company
• Intermediaries, where your complaint relates to services provided to you by a broker or intermediary.

To assess and accommodate our service to meet customer needs

Why do we process your information?

We have legitimate interests to collect and use your personal data to work with you through challenging times and ensure it is easy for everyone to use our products and services. We’ll make sure the way we process your information is not unfair to you.

This is because of our obligations as a responsible lender in line with regulators’ guidance and best practice. We also have obligations to comply with the Equality Act 2010 and ensure our services are accessible to all.

You may provide us with special category data, such as health information, so that we can understand your specific circumstances and provide you with the service and/or additional support that may be required.

In most cases, we will ask for your consent when collecting this information. However, if you contact us by post or online we will assume you are happy for us to record the information unless you tell us not to.

Who might we share your information with?

• When necessary, we’ll provide information to our service providers to administer the request on our behalf
• Third parties on your behalf and with your authority, such as a family member, the Citizens Advice Bureau and Macmillan Cancer Support

To assess and accommodate our service to meet customer needs

Why do we process your information?

We have legitimate interests to analyse the quality and completeness of our data and the information we hold about you, where necessary. We will use profiling as part of this activity.

This is because data quality is vital to us. And we’re required by law to provide reports to our regulators, ensure that data is in line with Business Validation rules and can be used to make strategic decisions. We’ll make sure the way we process your information is not unfair to you.

Who might we share your information with?

• Suppliers acting on our behalf
• Aggregated level information will be disclosed to regulators

You have the right to object to us using your information for legitimate interests. Find out more about this on the Your information rights page.

Sometimes, we’ll need to share your personal information with a credit reference agency to check that a product or service is right for you. We do this to:

• Assess your creditworthiness, once you are over 18, and consider whether we believe you can afford to take out a product or service.
• Check the information you’ve provided to us is accurate.
• Prevent criminal activity and financial crime including fraud and money laundering.
• Manage your ongoing relationship with us.
• Trace and recover debts.
• Make sure any offers we propose are appropriate (when we have the right to do so).

Four things you need to know about credit referencing:

1. When we ask a credit reference agency to do a search on our behalf, this may leave a search footprint on your credit file that may be seen by other lenders. This happens whether or not you, or The Mortgage Works, choose to proceed with the application.
2. The number of searches carried out may have an impact on credit decisions made by us and other lenders.
3. If you’re making a joint application, your credit records will be linked together. This creates what’s known as a ‘financial association’ at credit reference agencies. So, you should always discuss and agree this with other applicants before disclosing their information to check that they’re happy to proceed.
4. Information about any financial associations will be shared with other lenders if either of you make a credit application in the future – whether it’s in just your name or together with someone else. The Mortgage Works may receive and use information about your existing financial associations as part of our decision-making process.

Why do we share your information with credit reference agencies?

We’ll share your information with a credit reference agency when it’s necessary in line with the terms and conditions agreed between us. This could be when you’re applying for a product or as part of our ongoing relationship with you.

We also collect and use your information to help us improve our credit risk systems and policies to make sure we meet the needs of our customers. Discover more about this in our enhancing your experience of our products and services section.

As a responsible lender, it’s in our legitimate business interests to make sure the products we provide you are affordable and suitable for your circumstances. So, we share your information with credit reference agencies to check that we have sufficient data to make well-informed decisions about offering credit – decisions that don’t put you at risk. It also helps to make sure other lenders have a clear picture of your credit history and how you manage your accounts, so they can assess the affordability of their products and services.

We believe it’s in the interests of you, The Mortgage Works and other lenders to allow fair decisions to be made when offering credit.

You have the right to object to us using your information for our legitimate interests. Find out more about this on the Your information rights page.

More about credit reference agencies

There are three key credit reference agencies that we use. Take a look at their Credit Reference Agency Information Notices (CRAINs) to find out more about them, the data they hold (and for how long), the way they use and share your information, how they prevent fraud and your data protection rights. The three agencies are:

• TransUnion (opens in a new window)
• Equifax (opens in a new window)
• Experian (opens in a new window).

At The Mortgage Works, our customers’ safety is our number one priority. And that’s exactly why we collect and use your information to confirm that you are who you say you are, and to help stop financial crime including fraud and money laundering.

How do we use your information in this way?

We share your personal information with fraud prevention agencies to help prevent financial crime. If required for fraud or criminal investigation reasons, we (and the fraud prevention agencies) may also allow law enforcement agencies to access and use your information.

What information do we share?

The personal information we might need to share in this way includes your:

• name
• address
• date of birth
• financial information
• employment details
• identifying information (such as your IP address).

We’ll share your information in this way when it’s necessary as part of the terms and conditions agreed between us, either when you’re applying for a product or as part of our ongoing relationship.

Why do we share your information in this way?

We have a legitimate business interest to check people’s identity, and identify and prevent financial crime including fraud and money laundering. Sharing your information in this way, when necessary, allows us to protect your financial security as well as that of our other customers. It also makes sure that we’re complying with the law.

You have the right to object to us processing your information in line with our legitimate interests. Find out more about this in our Your information rights page.

A little bit about automated decisions

Sometimes when processing people’s personal information, we might use technology that makes automated decisions about our customers. This means that we may automatically decide that someone poses a financial crime risk if:

• The information processed reveals behaviour that indicates financial crime.
• The information provided is different to information previously given.
• Someone appears to have deliberately hidden their true identity.

You have rights related to automated decision making. You can find out more about these by taking a look at our Your information rights page.

What happens if a financial crime risk is detected?

We take financial crime seriously. And if we, or a fraud prevention agency, believe that someone poses a financial crime risk then we may refuse to provide the services that they’ve asked for. We can also stop providing services they already have with us.

If they apply for a job with us, and financial crime is detected, we may not employ them. Or, if they work for us already, we may stop their employment.

A record of any fraud risk will be kept by the fraud prevention agencies and this could mean that other providers refuse to offer services, finances or employment. Fraud prevention agencies can hold onto someone’s personal data for different periods of time, depending on the situation. If someone is considered a fraud risk, their data can be held for up to six years.

If fraud prevention agencies transfer your personal information outside of the European Economic Area (EEA), they impose contractual obligations on the recipient to protect your personal information to required standards. They may also ask the recipient to subscribe to international frameworks that enable data sharing.

Any questions?

If you have any questions about financial crime prevention, and how we use your information in this way, don’t hesitate to get in touch.

Sometimes, we might need to collect and use your information to provide, introduce or distribute products and services from our partners.

How do we use your information in this way?

We’ll share necessary information with our partners when:

• Discussing any queries or complaints that may arise.
• To help them provide products and services to us.
• We need to update them about a change to your address or contact details.

Our partners will also collect and use your information to manage the products and services that you have with them. As this then makes them the ‘data controller’, they’ll provide more details on how they process your information at the time when it’s collected by them or shared by The Mortgage Works.

When selecting our partners, we take appropriate steps to make sure that they have adequate protection in place and that they follow data protection legislation.

Why do we need to use your information for this?

We’ll use your personal information to meet the promises we’ve made in the terms and conditions of your product or service. We also use your information to understand your needs so that we can accurately advise on the products and services that are right for you.

We may also use it for our legitimate business interests. For example, when we need to make sure that the terms you’ve agreed to will be upheld, or to follow best practice from regulators.

We’ll always keep your best interests at heart and make sure that the way we process your information isn’t unfair to you.

You have the right to object to us using your information for legitimate interests. Find out more about this in our Your information rights page.

We may also need to ask for ‘special category data’ (such as information about your health) from time to time, to check whether certain products and services are suitable. You’ll find out more about this in our special category data section.

When do we process your information in this way?

We collect and use your personal information to:

• Assess the likelihood that your circumstances have changed.
• Work with you through challenging times, understanding and supporting your needs.
• Recover any outstanding money owed to us (this could include trying to locate you).
• Help us decide on any further action we may need to take in order to recover money owed (e.g. whether we need to consider legal action or using a debt recovery agent).

Why we process your information in this way?

As part of our legitimate business interests, we might need to use your information and profiling to identify customers who might be experiencing financial difficulty. We’ll do this using information we have on our own records and information collected from credit reference agencies.

We do this so that we can lend responsibly and follow best practice guidance from our regulators. We’ll always make sure that the way we process your information isn’t unfair to you.

As part of your agreement with us, we have the ability to recover any outstanding debts (e.g. if you miss a payment).

We have a legitimate business interest to use your information to provide a tailored and personal approach to accommodate your needs and specific circumstances, when necessary.

In carrying out these activities, you may provide us with special category data, such as health or criminal information, so we can provide you with the service and/or additional support that may be required.

In most cases, we’ll ask for your consent when collecting this information. However, if you contact us by post or online we will assume you are happy for us to record the information – unless you tell us not to.

When we ask for ‘special category data’, you have the right to withdraw your consent. Find out more about this on our Your information rights page. This won’t affect any use we have made of the information before you withdrew your consent.

Who might we share it with?

• People acting on your behalf - including individuals or organisations such as Citizens’ Advice Bureau or Step Change.
• Credit reference agencies:
  • For managing your ongoing relationship with us.
  • If you miss a payment.
  • If we have agreed a repayment plan or debt management plan with you.
  • When we are trying to locate you.
• Suppliers acting on our behalf.
• Debt recovery and tracing agents that we’ve instructed. They may contact credit reference agencies.
• Government bodies and agencies where we are required or permitted to do so – including local government, Dept. of Work & Pensions.
• The Land Registry, in the event that we choose to put a charge on a property.
• Other lenders and financial services providers who have an interest in a property.
• Solicitors acting on our behalf and courts in the event that we enter into litigation.
• The Insolvency Service if we’re notified you are declared bankrupt or have entered into an IVA.

You have the right to object to us processing your information for our legitimate interests. You can find out more about this, and your other rights, in our Your information rights page.

Information about defaults

We’ll always look to work with you if you get into financial difficulty, so please do get in touch with us first if you’re struggling to make repayments.

If we fail to reach an agreement to repay the debt, we’ll issue a notice that gives you 28 days to bring your payments up to date. If you don’t bring your payment up to date by then, we’ll record a default with credit reference agencies and this will remain on their records for up to 6 years.

How do we use your information in this way?

We want you to get the most out of your relationship with The Mortgage Works. One of the ways we might help you do this is by using the contact details you’ve supplied us to send you marketing information about products or services we think you’ll find interesting. For example, it might be a monthly e-newsletter keeping you updated on what’s happening with the buy to let market.

We also collect and use your information to help us plan and tailor the delivery of our marketing campaigns. Discover more about this in our enhancing your experience of our products and services section.

Our marketing on websites and social media

We want you to get the most out of your relationship with The Mortgage Works. So we use social media and websites to let you know about the products and services we offer that might be of interest to you.

One of the ways we do this is by matching the personal details we hold about you, such as your email address, with the details social media companies or websites hold about you. This is done in a controlled, anonymous way so your identity is never revealed.

By doing this, social media and websites can share tailored marketing messages with you about our products and services.

We have strict processes in place to keep your personal information safe and we won’t use it in a way that’s unfair to you.

We keep your information safe by:

• Never sharing any other personal information about you with social media companies or websites.
• Making sure your information doesn’t give your identity away by making it anonymous in a secure and controlled environment.
• Using carefully selected social media companies and websites. We take steps to make sure the information we share with them about you will not be used for any reason other than showing you marketing messages from us that we think you’ll be interested in.
• Never agreeing to social media companies or websites sharing or selling your information to third parties.
• Making sure that social media companies or websites securely delete any information we give them about you.

You have the right to object to us using your information for legitimate interests. You can find out more about this, and your other rights, in our Your information rights page.

Just so you know, if you do submit a ‘right to object request’ we will stop sending you marketing messages tailored to you. However, you might still see some general marketing messages from us, but these won’t be targeted to you.

If you want to control the adverts you see on social media platforms, you can manage your marketing preferences through their settings page. In some cases, you can opt out of receiving targeted marketing messages. You’ll still see adverts, but these won’t be tailored to you.

Managing your marketing preferences if you are a business customer

We want you and your business to get the most out of your relationship with The Mortgage Works. So if we have your name down as a contact or director or shareholder, we may send you marketing information from time to time about products or services we think could be of interest – or that could help you grow your business.

We have a legitimate business interest to use your information in this way due to the relationship you have with us as someone associated with one of our products. We‘ll only use this information in a way which is fair to you.

And don’t worry, even if you’d rather not get marketing messages, we’ll still make sure you always receive important information about your accounts.

We’ll never pass on your details to anyone else for their marketing purposes either.

At The Mortgage Works, we’re required to collect and use your personal information in a number of circumstances to meet our legal and regulatory obligations.

These include using your personal information to carry out a range of activities that ensure we comply with the requirements set out by our regulators (e.g. Financial Conduct Authority – FCA – and Prudential Regulation Authority – PRA) and in relevant legislation (e.g. Data Protection Legislation and Anti-Money Laundering Regulations). We also disclose information to HMRC and other government bodies when we are required or permitted to do so.

How do we use your information in this way?

Sometimes, we’re required by law to produce reports or statistical modelling that we disclose to regulators or government bodies (e.g. when we need to report our complaints statistics to the FCA. To produce these reports, we may need to use profiling (where we categorise your behaviours, interactions and/or characteristics alongside other customers). This helps us make sure that our reporting is accurate.

In certain circumstances, we’ll process your personal information in this way for our legitimate business interests. This is when we have legal obligations to process your information but flexibility in how we do this. For example: when data protection legislations govern that we need security controls in place to make sure your information is not disclosed to the wrong person. To comply with this obligation, we have stringent identification and verification processes in place when you open a product, together with numerous security controls (e.g. our authentication process to identify you when you use our products and services).

You have the right to object to us using your information for legitimate interests. Find out more about this on our Your information rights page.

We’re constantly looking to improve how we do things – and understanding more about you helps us do exactly that.

We collect and use your personal information to help us make our business better, improve products and services and enhance how we engage with customers.

What type of information do we put in?

• Personal information to identify you
• Details about the products you hold and account activities
• Information about your work or profession, your nationality, education and social and economic demographic
• Information you put into our online services (e.g. our mortgage calculators)
• Information about how you interact with us (e.g. when you call us)
• Information about our online content which you have viewed
• Details of feedback you have provided, either directly to us or you make public e.g. on social media
• Information about the services you use and how you use them
• Details of the devices you use to interact with us
• Information about how you respond to our communications (e.g. whether you read an email)
• Information on your location, gathered from your mobile phone or other device, where you access the internet or where you make a payment
• Information gathered from third parties.

We’ll also use information we have collected from credit reference agencies and other organisations to profile your information (e.g. where we categorise behaviours, interactions and/or characteristics, both now and in the future). We’ll do this whether or not you, or The Mortgage Works, choose to proceed with the application. This is part of what we call ‘statistical modelling’, helping us to review our risk appetite when making lending decisions.

What do we do when profiling your information?

Profiling your information alongside other customers also helps us to ensure that we’re providing a consistent service and giving people the best products at the right times. We may:

• Make predictions about you and your behaviours to understand the likelihood that you may do something
• Segment customers (e.g. grouping you with people with similar traits) to make sure you receive the correct service message for the product you hold and your personal circumstances (e.g. time left on mortgage)
• Analyse your interactions with The Mortgage Works e.g. when you telephone our call centre or visit our website
• Assess the performance of communications we provide you with
• Monitor the performance of our products and services in the market place
• Produce anonymised reports for internal use and to meet our legal and regulatory requirements.

How does this benefit The Mortgage Works and you?

Your information and views help us understand the ever-changing needs of our customers, putting you at the heart of decisions we make about our products and services. By doing this, we can keep evolving what we offer and growing as a business. This includes:

• Helps us to grow and offer the right customer benefits
• Ensures we are fair and consistent and offer the best outcome for our customers
• Ensures our communications are appropriate
• Allows us to develop new products which meet the needs of our customers
• Allows us to continuously improve our content and the way we interact with you
• Helps us improve our productivity (e.g. reduce our call waiting times)
• Helps us develop new services based on emerging trends
• Helps The Mortgage Works have a ‘big picture’ view of our customers and our business so we can identify improvements to our products and services
• Allows us to offer a personalised service
• Helps us make investment decisions so that we can provide the services our customers require.

We’ll always make sure the way we process your information is safe and not unfair to you. Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports.

You have the right to object to us processing your information for our legitimate interests. You can find out more about this, and your other rights, on our Your information rights page.

We’re constantly looking to improve our products, services and systems. And, when it’s essential, we may use your personal information for testing so that we can make them even better.

How do we use your information in this way?

We have stringent processes in place to keep your personal information safe and we won’t use it in a way that’s unfair to you. When we use your information for testing, we:

• Always do this in a secure and controlled environment.
• Only use the minimum amount of data necessary for the testing.
• Only use carefully selected specialist service providers, where necessary.
• Only hold your information in this way for as long as needed to carry out testing.

Why do we use your information in this way?

Using your information for testing is necessary for our legitimate business interests as it allows us to maintain and improve the security, integrity and performance of our systems. Also, being able to develop systems with customers in mind enhances the experiences you have with The Mortgage Works.

You have the right to object to us processing your information in this way. For more details on this, and your other rights, take a look on our Your information rights page.

Your information will be shared with:

• The Nationwide Group, for the purposes explained in the how we use your information section.
• Partners and suppliers that support the operation of the business.
• Specific third parties that you’ve authorised us to deal with (e.g. professional advisors, family members or representatives for you).
• Third parties, when we’re required to do so under the terms of any secured wholesale funding programmes.

When necessary, we may also share information with other organisations, including:

• Credit reference agencies
• HM Revenue & Customs and other tax authorities
• UK Financial Services Compensation Scheme
• Regulators e.g. FCA
• Financial Ombudsman Scheme
• Law enforcement agencies
• Fraud prevention agencies
• Government bodies and agencies
• Other lenders who also have a charge on the property (if you have a mortgage with us)
• Other lenders and financial services’ providers
• Companies and organisations that introduce you to us
• Financial advisers
• Land agents
• Card associations (e.g. Visa)
• The Direct Debit scheme (if you use Direct Debits)
• Payment processors (e.g. BACS)
• Comparison websites
• Market research providers
• Organisations providing data services to support us in managing our relationship with you and operating our business.

You’ll find out more about when we’d need to share your information with partners in our section about providing products and services from our partners.

If you’ve authorised us to, or in exceptional circumstances when we believe it’s in your interests, we might also share your information with healthcare or other wellbeing organisations. But we’ll only share the minimum amount of information needed (for example, your contact details).

Also, in the event that we transfer, sell or merge parts of our business, your information will be shared accordingly.

Our aim is to keep your information for as long as we need to, in order to manage your relationship with us and comply with legal and regulatory requirements.

Your relationship with The Mortgage Works	How long we hold your information for
You are interested in taking out a product with us.	We’ll keep the information we have collected between 18 months and 6 years, depending on the stage in the application process you are at (e.g. whether you chose not to open your mortgage with The Mortgage Works but we have completed a credit check against you).
You are a customer.	We’ll keep the information we hold about you as long as you are a customer. There may be times when we don’t need certain pieces of information about you while you’re a customer, such as data we collect and use about you when developing our products and services.
You used to have an account with us but it’s closed now.	If you have had a mortgage with The Mortgage Works, your information will be retained for 12 years following the redemption of your mortgage. This is so The Mortgage Works can comply with its regulatory obligations.

Just so you know, we may keep your information for longer than indicated if we cannot delete it for legal, regulatory, or technical reasons. We may also keep it for research or statistical purposes. If we do, we’ll make sure that your privacy is protected and only use it for those purposes.

Keeping your information safe

We’re committed to taking good care of your personal information safe and we have stringent security measures in place to keep it well-protected.

You have certain rights when it comes to your personal information and there are a number of requests you can make.

Please see our Your information rights page to see how you can do this.

We need you to keep your personal details up-to-date so that we can get in touch with you about the account, product or service you have with us.

If you change your name, address, phone number or email address, please let us know straight away. You can update your contact details on our Change of details page.

If you have recently taken out a mortgage with us, please make sure we have the most up-to-date postal address for any other mortgage accounts you hold with us.

If you’re unsure about the address we have on record for you, get in touch.

We only hold one email address, one home number and one mobile number per customer and these apply to all accounts you have with us.

If you change your email address or phone number at any time, the new contact details you provide will replace all existing ones. This includes when you open a new account or product with us.

If you’ve opened a mortgage account with one of our partners but through us, and you notify us about a change to your contact details, we’d recommend getting in touch with them directly to confirm any changes. Likewise, if you have advised our partners of a change to your contact details please get in touch with The Mortgage Works to confirm any changes.

From time to time, we may need to ask for personal details that might seem sensitive. For example, a question about your health or whether you have any previous criminal convictions. This is known as ‘special category data’.

What special category data might we ask for?

Details about your health and disability

Why do we process this special category data?

So that we can understand your specific circumstances and provide you with the service and/or additional support that’s needed.

In some cases, the information may be used to make decisions as to how we contact you as part of your relationship with us. For example, you might ask us to send statements in braille.

In most cases, we will ask for your consent when collecting this information. However, if you contact us by post or online, we will assume you are happy for us to record the information – unless you tell us not to.

Who might we disclose this special category data to?

We will only disclose this special category data when we have your authority to do so. If you’ve requested our braille or Type Talk services, we’ll share your information with the suppliers who provide these to fulfil your request.

Behavioural biometrics data relating to the physical, physiological, or behavioural characteristics of a person

For example, individual’s interaction with their computer or smartphone device, including the use of their keyboard, mouse and/or the way in which they hold and interact with their device.

Why do we process this special category data?

We use this information to detect and prevent fraud, unlawful acts and money laundering as it is in the public interest to do so.

Who might we disclose this special category data to?

The data is collected and processed by one of our third-party suppliers, however it will never be shared or disclosed to any other organisations. We don't ask for your consent when doing this, because it is in yours, The Mortgage Works’ and other banks and building societies' interests to use new technologies to support us in protecting everyone’s economic well-being and stop financial crime. This data is not directly linked with your name or contact details, and it will never be used for any other purposes.

Searches made, as part of our regulatory obligations, which identify that someone has or may have a criminal conviction

Why do we process this special category data?

We run searches with fraud prevention and credit reference agencies, in certain circumstances, and these may provide information about someone’s criminal convictions. We use this information to detect and prevent fraud, unlawful acts and money laundering as it is in the public interest to do so.

Who might we disclose this special category data to?

Information is shared with fraud prevention, credit reference and, if necessary, law enforcement agencies.

Information obtained during your relationship with us

Why do we process this special category data?

We use details of mortgage payments made from your account. We may also become aware that you have a criminal conviction e.g. if your address is updated to that of a prison.

Who might we disclose this special category data to?

Information is shared with third parties to process payments.

How do we collect your information in this way?

In almost all cases, we’ll ask for your consent when collecting special category data. However, if you write to us containing this type of information, then we’ll assume that you’re happy for us to record it – unless you tell us not to. If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

You have the right to withdraw your consent to us recording special category data at any time. Find out more about how to do this, and your other rights, on our Your information rights page. This will not affect any use we have made of the information before you withdrew your consent.

At The Mortgage Works, we sometimes use advanced technology to make automated decisions about our customers. This could be when you’re applying to open a product, service or account with us, or as part of our ongoing relationship.

When do we use automated decision making?

1. To assess your application and check if we can approve you for credit, to make sure that we’re lending responsibility.
2. To assess if we can offer you a financial product and work out the level of interest that you’ll pay. This helps us make sure that we’re fair and consistent in our product offerings.
3. To check if someone’s making a fraudulent application or if there’s activity on your account that needs further review. This is so we can protect your money and protect you from financial crime.
4. To decide if you are, or continue to be, eligible for the product or service you’ve chosen.

What information we put in

• Information you provide us as part of your mortgage application (e.g. your income)
• Information we already know about you
• Information about your transactions and how you use our services
• Information about the devices you use
• Information about you held with credit reference and fraud prevention agencies
• Existing data we hold for modelling purposes
• Information gathered from third parties.

How we use this information

• To validate the information you have provided us
• To make sure our credit scoring system is fair
• To create profiles about you through analysing the information
• To better understand trends in traits and behaviours
• To make predictions on potential fraudulent behaviour
• To analyse the data to improve our services.

Why we do this and how it benefits you and The Mortgage Works 

• To comply with our requirements as a responsible lender
• To prevent fraud and money laundering by keeping your money and identity safe
• To make sure we are fair and consistent in how we treat our customers
• To make our processes efficient
• To manage our risk appropriately
• To trigger alerts when there is unusual activity on your account

Profiling

Profiling is used to make automated decisions. This is where we combine your information with information about others so that we can:

• Understand trends in traits and behaviours.
• Make predictions about how you might use our products and services in the future.
• Analyse data to improve our service and generate alerts (e.g. where we suspect that you may be the victim of financial crime).

In certain circumstances, you have the right to ask for a decision to be reviewed by a person. For more information on this, take a look in our Your information rights page.

From time to time, we might need to collect or use personal information from individuals who aren’t customers of The Mortgage Works. This could be when they:

• Have a Power of Attorney or a third party mandate to act on a customer’s behalf.
• Are the Personal Representative registering the death of a customer.
• Are acting as the guarantor on a customer’s mortgage.
• Are acting as the donor for the deposit on a customer’s mortgage.
• Are supporting a customer when English isn’t their first language.
• Are raising a complaint but aren’t a member or customer of The Mortgage Works.
• Are acting on behalf of our customer, either in a professional capacity (e.g. a broker in a mortgage application) or a personal capacity (e.g. a family member).

How do we collect or use this information?

In most cases, we’ll collect this information from the individuals directly. But there might be times when our members or customers provide their details. If you’re providing information about another individual, we’ll assume that you have told them that you are sharing their details and where they can find more information on how we may process their details.

Why do we need this information?

We might need to use this information to confirm their identity, help manage others’ accounts, prevent fraud and engage with customers.

We’ll only use this information if we have a legal reason or legitimate business interests to do so.

These individuals also have certain rights regarding their personal information. For more information on this, take a look at our Your information rights page.

We may transfer personal information to countries outside the UK when:

• You request for us to do so.
• We’re required or permitted to by law.
• We’re sharing data with a third party to support us in managing your account and running The Mortgage Works.

When working with our suppliers and/or transferring information to countries outside the UK, we take appropriate steps to ensure that there is adequate protection in place and that data protection legislation is followed.

This could be by:

• Ensuring that we transfer information to countries that we believe have comparable data protection legislation to the UK.
• Putting suitable clauses in our contracts so that organisations take appropriate steps to comply with UK data protection law.

If you would like more information on this, please contact us.

To find out more about how we use cookies on our websites and digital services, please see our cookies page.

Nationwide’s Data Protection Officer (DPO) is responsible for protecting personal information held by Nationwide Building Society and its subsidiaries, including The Mortgage Works.

You can contact them by writing to:

The Data Protection Officer
Nationwide Building Society
Nationwide House
Pipers Way
Swindon
SN38 1NW