Keeping your personal information secure and safeguarding your privacy are really important to us. So is making sure you understand what personal information we use, and how we use it, where we get it from, who we share it with and what rights you have to control how we use it.
2. How we use your personal information
We use your personal information in three ways:
- To provide our products and services to you
- To meet our legal obligations
- To run our business
We have described these in greater detail in Schedule A
3. The information we use and where it comes from
We collect and use various categories of personal information but only to the extent we need to achieve one or more of the purposes listed above. This personal information includes:
- Personal information you supply through the Kestrl app or website (for example, when you signed up to Kestrl or when you use your account, or get in touch with us). This includes your name, address, email and other contact details, ID and visual images (such as selfie or copy of passport photo).
- Transactional and other information we learn from how you use the Kestrl app, your card, your account, and any other third party bank accounts you’ve allowed us to access through account aggregation / Open Banking.
- Information we receive from third parties, such as those providing services to us or you e.g. ID verification services, credit reference agencies, fraud prevention or government agencies, and other banks.
- Device information including your location, mobile phone network, IP address and telephone number and how you use your mobile to access Kestrl
- Information about your family, lifestyle and social circumstances (such as dependents, marital status, next of kin and their contact details);
- Information about your financial circumstances, including personal wealth, assets and liabilities, proof of income and expenditure, credit and borrowing history and needs and goals
- Online profile and social media information and activity, based on your interaction with us and our websites and app, including for example, your banking profile and login information, Internet Protocol (IP) address, smart device information, location coordinates, online and mobile banking security authentication, mobile phone network information, searches, site visits and spending patterns.
- Information from publicly available sources including social media profiles, the electoral register, the media and online search engines.
We may also use certain special categories of information for specific and limited purposes, such as detecting and preventing financial crime or to make our services accessible to customers. We will only use special categories of information where we’ve obtained your explicit consent or are otherwise lawfully permitted (and then only for the particular purposes and activities set out in Schedule A for which the information is provided). This may include:
- information about racial or ethnic origin,
- religious or philosophical beliefs;
- physical or psychological health details or medical conditions; information, relating to the physical, physiological or behavioural characteristics of a person, including, for example, using voice recognition or similar technologies to help us prevent fraud and money laundering.
Where permitted by law, we may use information about criminal convictions or offences and alleged offences for specific and limited activities and purposes, such as to perform checks to prevent and detect crime and to comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption, and international sanctions. It may involve investigating and gathering intelligence on suspected financial crimes, fraud and threats and sharing data between banks and with law enforcement and regulatory bodies.
Your transaction history and account information may also contain special categories of personal data. For example, if you have a payment for a membership a particular political party, this could reveal your political beliefs. We will not profile you on the basis of this data or otherwise use this data for any other purposes other than providing our services.
4. Your Rights
Your rights in relation to the personal information we hold on you are set out in the table below. If you wish to exercise any of these rights, or if you have any queries about how we use your personal information which is not answered here, you can contact us at firstname.lastname@example.org
Please note that in some cases, if you don’t agree with how we use your information, it may not be possible for us to continue to operate your Kestrl account and/or provide certain products and services to you.
|Access||You have the right to a copy of the personal information we hold on you and can request it by contacting us at email@example.com|
|Erasure||You have the right to request we delete your personal information if you believe that:
|Restriction||You have the right to request use to restrict how we use your information if you believe that:
|Portability||You have a right to receive any personal information you provided to us directly in an electronically and/or request that we send it to a third party, if technically feasible and secure. If you would like to do this please contact our support team at firstname.lastname@example.org|
|Objection||You have the right to object to how we are using your information for the purposes described in Schedule A, table (C), (which can be found at the end of this document), unless we can demonstrate overriding compelling and legitimate grounds for the processing or where we need to use your information to investigate and protect us or others from legal claims.|
|Marketing||You have a right to object to us using your personal information for direct marketing purposes, including profiling you for direct marketing. For more information see section 10.|
|Lodge complaints||If you want to make a complaint about how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. Please contact us at email@example.com or 020 71531087.We hope that we can address any concerns you may have, but if you are not satisfied, you can always contact the Information Commissioner’s Office (ICO). For more information, visit https://ico.org.uk/.|
- Changing how we use your information
From time to time, we may change the way we use your information. Where we believe you may not reasonably expect such a change, we will give you at least 30 days policy to raise any objections before the change is made. However, in some cases, if you do not agree to such changes it may not be possible for us to continue to service your Kestrl account and/or provide certain products and services to you.
- Who we share your information with
We will only use and share your information where it is necessary for us to lawfully carry out our business activities. Your information will be shared with other KESTRL group companies and there are some circumstances where we will also share your personal information with third parties outside of the KESTRL group including fraud prevention agencies, government entities and other third parties who we are required or permitted by law to disclose to. We will not share your information with anyone outside the KESTRL group except:
- where we have your permission;
- where required for your product or service;
- where we are required by law and by law enforcement agencies, judicial bodies, government entities, tax authorities or regulatory bodies around the world;
- with other banks, individuals or organisations so that we can help recover funds that have entered your account as a result of a payment sent in error by one of the above;
- with companies providing services to us, such as market analysis and benchmarking, correspondent banking, and agents and sub-contractors acting on our behalf, such as ID verification services;
- when you agree to receive marketing from us, we may use social media companies or other third party advertisers to display relevant messages to you about our products and services. Third party advertisers may also use information about your previous web activity to tailor adverts which are displayed to you;
- with other banks to help trace funds where you are a victim of suspected financial crime and you have agreed for us to do so, or where we suspect funds have entered your account as a result of a financial crime;
- with debt collection agencies;
- with credit reference and fraud prevention agencies;
- with external guarantors or other companies that provide you with benefits or services (such as insurance cover) associated with your product or service;
- where required for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business;
- in anonymised form as part of statistics or other aggregated data shared with third parties; or
- where necessary for our legitimate interests (e.g. to help us provide and improve our products and services to make them better for you) or those of a third party, and it is not inconsistent with the purposes listed above.
If you ask us to, we will share information with any third party that provides you with account information or payment services. If you ask a third party provider to provide you with account information or payment services, you’re allowing that third party to access information relating to your account. We’re not responsible for any such third party’s use of your account information, which will be governed by their agreement with you and any privacy statement they provide to you.
In the event that any additional authorised users are added to your account, we may share information about the use of the account by any authorised user with all other authorised users.
Kestrl will not share your information with third parties for their own marketing purposes without your permission.
- Transferring information overseas
We may transfer your information to organisations in other countries (including to other KESTRL group companies) on the basis that anyone to whom we pass it protects it in the same way we would and in accordance with applicable laws.
In the event that we transfer information to countries outside of the European Economic Area (which includes countries in the European Union as well as Iceland, Liechtenstein and Norway), we will only do so where we are satisfied your information is adequately protected based on the European Commission’s assessment of the countries in question, the transfer has been authorised by the relevant data protection authority or a suitable contract with the organisation we are sharing your information with. You can contact us at firstname.lastname@example.org to get a copy of the relevant data protection clauses in the contract.
When you have told us that you want to hear from us via the app, email, social media or other electronic means, we may contact you from time to time about new products and services that we think could be of interest to you via email, text and other forms of communication. You can adjust your marketing preferences anytime you want via contacting us at email@example.com
- Communicating with you about your account
When we contact you we may do so via the Kestrl app, but sometimes we may use email, text message, post and/or telephone. To help us get in touch with you please keep your contact details in the app up to date.
We may monitor or record our communications with you in accordance with applicable laws for the purposes outlined in Schedule A.
- Credit reference, fraud prevention and identification and verification partners
We may access and use information from credit reference and fraud prevention agencies when you open your account and periodically to:
- manage and take decisions about your accounts, including assessing your credit worthiness and checks to avoid you becoming over-indebted;
- prevent criminal activity, fraud and money laundering;
- check your identity and verify the accuracy of the information you provide to us; and
- trace debtors and recover debts.
The decision to provide you with a Kestrl account may be taken based solely on automated checks of information from credit reference and fraud prevention agencies and internal KESTRL group records. To work out your credit score, we look at information you give us when you apply; information from credit reference agencies that will show us whether you’ve kept up to date with payments on any credit accounts (that could be any mortgages, loans, credit cards or overdrafts), or if you’ve had any court action such as judgments or bankruptcy; your history with us such as maximum level of borrowing; and affordability, by looking at your available net income and existing debts. You have rights in relation to automated decision making, including a right to appeal the decision.
We will continue to share information with credit reference agencies about how you manage your account including your account balance, payments into your account, the regularity of payments being made, credit limits and any arrears or default in making payments, while you have an account with us. This information will be made available to other organisations (including fraud prevention agencies and other financial institutions) so that they can take decisions about you, your associates and members of your household.
If false or inaccurate information is provided and/or fraud is identified or suspected, details will be passed to fraud prevention agencies. Law enforcement agencies and other organisations may access and use this information. If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we and others may refuse to provide the services and financing you have requested, to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
Please also be aware that, to make verifying your identity as part of the account opening process easy as possible, we will send required identification that you provide to us to a third party ID verification service provider.
When the credit reference and fraud prevention agencies, and our identity and verification provider use your information, they do so, on the basis that they have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect their business and to comply with laws that apply to them. Further, they are independent controllers of your data when they use your personal information. If you want further details of how your information will be used, you can contact them using the relevant details below.
- How long we keep your information for
By providing you with products or services, we create records that contain your information, such as customer account records, activity records, tax records and lending and credit account records. Records can be held on a variety of media (physical or electronic) and formats.
We manage our records to help us to serve our customers well (for example to help us deal with any queries you may have about your account) and to comply with legal and regulatory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.
How long we keep records depends on the type of record, the nature of the activity, product or service and the applicable local legal or regulatory requirements. We (and other KESTRL group companies) normally keep customer account records for up to six years after you close your account, whilst other records are retained for shorter periods. How long we retain your information for may change based on business or legal and regulatory requirements.
We may in certain circumstances retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies or our regulators. This is to make sure that we will be able to produce records as evidence, if they’re needed.
If you would like more information about how long we keep your information, please contact us at firstname.lastname@example.org
At Kestrl, making sure that we and any third parties who act on our behalf keep your personal information secure is really important to us.
We will only use and share your information where it is necessary for us to carry out our lawful business activities. Your information may be shared with and used by other KESTRL group companies. We want to ensure that you fully understand how your information may be used. We have described what we may use your information for below:
We may use your information where it is necessary to enter into a contract with you to provide you with our products or services or to perform our obligations under that contract. Without this information, we may not be able to continue to operate your Kestrl account and/or provide products and services to you. This may include processing to:
|Table A. Contractual necessity|
|Table B. Legal obligation|
|When you apply for a product or service (and throughout your relationship with us), we are required by law to collect and use certain personal information about you. Without this information we may not be able to continue to operate your account and/or provide products and services to you. This may include processing to:
|Table C. Legitimate interests of Kestrl|
|We may use your information where it is in our legitimate interests do so as an organisation and without prejudicing your interests or fundamental rights and freedoms.
a) We may use your information in the day to day running of our business, to manage our business and financial affairs and to protect our customers and employees. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business. This may include processing your information to:
b) It is in our interest as a business to ensure that we provide you with the most appropriate products and services and that we continually develop and improve as an organisation. This may require processing your information to enable us to:
We may perform data analysis, data matching and profiling to support decision making with regards to the activities mentioned above. It may also involve sharing information with third parties who provide a service to us.
c) It is in our interest as a business to manage our risk and to determine what products and services we can offer and the terms of those products and services. It is also in our interest to protect our business by preventing financial crime. This may include processing your information to: