RCI Financial Services Ltd Privacy Policy

Introduction

Please read this Privacy Policy carefully as it explains how RCI Financial Services Limited (“RCI Financial Services”) and our related businesses within RCI Group (“we”, “our” or “us”) uses the personal information that you provide to us via your Dealer or that we have obtained about you. The personal data that your provide (referred to as your “information” in this Privacy Policy) is data which by itself or with other data available to us, can be used to identify you.

RCI Financial Services is part of the RCI Group of companies whose intermediate parent company is RCI Banque SA trading as “RCI Bank and Services” and whose ultimate parent company is Renault SA which is part of the Renault-Nissan-Mitsubishi Alliance and includes RCI Bank UK Limited, as well as your selected vehicle manufacturer’s group companies including Renault UK Limited, Renault UK Limited trading as Dacia, Renault UK Limited trading as Alpine, and Nissan Motor (GB) Limited (all of which comprise the, “RCI Group” or “Group”). The RCI Group therefore includes, RCI Banque SA, RCI Financial Services, RCI Bank UK Limited, our ultimate parent company’s group of companies, the Renault-Nissan-Mitsubishi Alliance and your selected vehicle manufacturer’s group companies and brands. If the RCI Group changes from time to time, we shall inform you of such changes. If you would like more information on the companies that make up the RCI Group, please do get in touch or go online to ww.rcibs.com and www.group.renault.com.

Where this Privacy Policy refers to your "Dealer", this means the car dealership that has contacted us on your behalf regarding vehicle finance. Please be aware that the Dealer is not part of RCI Financial Services or the RCI Group. Your Dealer may retain your information for its own purposes, for example, to contact you about its products and services. If you would like to know more about how the Dealer may use your information, please ask the Dealer for a copy of its Privacy Notice

From time to time, we may need to update or amend this Privacy Policy but we’ll let you know of any key changes to this Privacy Policy beforehand so you understand how your information is being used.

What information do we collect?

When applying for finance, it is important that you provide accurate information on your application.

We’ll only process personal data you provide to us in accordance with the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, (as updated from time to time) and other applicable privacy laws as amended from time to time. Whether you become a customer or not, we’ll use your personal data for the reasons set out below and if you do become a customer, we’ll use it to manage your finance. Most of this information is directly collected when applying for finance.

The categories of information that we may collect about you during your application for finance from RCI Financial Services are as follows: title, full name, address, e-mail address, telephone number, address history, residential status, date of birth, place of birth, nationality, marital status, driving licence number, vehicle information (including VIN, service reminders, warranty and service information), bank details, employer’s name and address, occupation, time in employment, income, expenditure, any ID documents, the date and time you used our services, telematics and location information relating to your vehicle, website information, transactions with the Dealer, information relating to your business, voice recordings made to our customer service centres and any other information or documentation you may provide in relation to your application or otherwise.

Providing some personal data in the application is optional. The optional and/or required data fields are indicated in the application form. All non-optional information we need from you is mandatory and required. If you do not want to provide us with the required information then we will not be able to proceed with the identification and fraud prevention checks described below, subsequently, we will not be able to enter into an agreement with you. At the end of the application we will ask you to confirm your details and submit your application.

In addition to the information that you provide in your application for finance from RCI Financial Services, we may also collect information about you from enquiries we may make about you (including from the searches we do with fraud prevention and credit reference agencies and enquiries we may make internally, or with any other RCI Group company, about your performance of any other agreement you have with us or an RCI Group company).

We collect information about you and/or your vehicle when you use RCI Financial Services websites, applications and our customer service centres. To find out more about the cookies and similar technologies we use, please see our Cookies Policy. We also obtain information about you or your vehicle from our authorised Dealers and repairers. Some of this information does not identify you personally, but provides us with information about how you use our services and engage with us (we use this information to improve our services and make them more useful to you). We may also receive information from third parties, suppliers and partners about the products and services you have purchased.

We may also collect other information such as information you provide through customer surveys, feedback, complaints and correspondence. Some information is required information but other information is optional and if you do not want to give it to us, you do not need to. We are always grateful for information you do provide though because this helps us to improve our products and services.

Electric vehicles:

If you have purchased an electric vehicle from us, we may also collect additional information about you and your use of the electric vehicle, which will be transmitted to us by the telematics box installed in the vehicle. This information includes mileage data, battery performance and charge data. The reason we collect this information is to monitor your battery, its use and performance, to manage battery stocks and maintain hire payments at a competitive level. We will use the data as it is necessary for our legitimate interests for management, statistical and analytical, administration and accounting purposes. Please note that if you have opted to have a connection pack installed, we will also receive data about your location. If you do not wish us to receive location data you may disconnect the telematics box in accordance with the instructions supplied with the connection pack.

What information do we collect?

The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are as follows:

• It is necessary for the performance of the contract with you or to take steps to enter into it. This includes verifying your identity and assessing your application for finance (including fraud prevention checks) when you first enter into the contract and/or any subsequent applications, variations or modifications to the contract and administering the agreement between us (including tracing your whereabouts to contact you and recover debt) and to provide you with the service under that agreement (i.e. managing your account, communicating with you, providing updates on the status of your account, dealing with any complaints and notifying you of any changes to this statement).
• It is necessary for our legitimate interests or that of a third party. This includes:
  • making automated decisions about you when processing your application as this is most efficient way to process applications (see “Automated decisions and profiling” below for more information);
  • creating a profile of you to decide what products and services to offer to you for direct marketing purposes;
  • using ‘list-based’ targeting tools via social media platforms to offer you and like-minded individuals tailored products and services for direct marketing purposes;
  • making available personalised offers and promotions to you;
  • identifying trends to develop new products and services;
  • contacting you prior to the expiry of your finance agreement to discuss your options;
  • advising you about the products and services that we are providing to you in response to a request from you about this;
  • in some cases, we may use automated methods to analyse, combine and evaluate information that you have provided to us (including the sharing of your personal information within our RCI Group of companies as mentioned in this Privacy Policy) which includes Renault UK Limited, Renault UK Limited trading as Dacia, Renault UK Limited trading as Alpine, Nissan Motor (GB) Limited and RCI Bank UK Limited;
  • collecting and analysing information so that we can deliver the most appropriate customer experience to you by tailoring and making relevant all our service and communications (for example, when your finance contract options are available);
  • preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us;
  • for product development, statistical analysis and market research and customer surveys so that we can better understand you as a customer and provide tailored offers, products and services that we think you will be interested in (we may want to contact you from time to time for market research, however you can ask us not to contact you for this purpose at any time);
  • providing you with customer support and services, including answering questions and responding to feedback and complaints;
  • monitoring communications between us (calls, letters, emails and texts) to prevent and detect crime, to protect the security of our communications, systems and procedures, and for quality control and training purposes;
  • for management and audit of our business operations including accounting and analysis of applications made to us;
  • to verify the accuracy of information that we hold about you and create a better understanding of you as a customer;
  • for network and information security purposes i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorised access;
  • to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
  • for improving our systems, operations, processes and services (including their testing) and for business continuity and disaster recovery purposes; and
  • for the establishment and defence of our legal rights.

We only collect information which is necessary, relevant and adequate for the purpose you are providing it for.

• It is necessary for compliance with a legal obligation. This includes when you exercise your legal rights under data protection law, to verify your identity, for the establishment and defence of our legal rights, for activities relating to the prevention, detection and investigation of crime, to conduct credit, fraud prevention and anti-money laundering checks and for compliance with our legal and regulatory responsibilities. We may process your personal information to comply with our other legal requirements (for example, to register your car with the DVLA).
• You have given us your consent to use it for direct marketing communications. Please see ‘Marketing’ below for more information on marketing, including details on how to stop receiving marketing communications. You can change your marketing preference at any time; for email and SMS, please follow the unsubscribe instructions in those communications.

Please note that your Dealer will enter your information onto our Finance Proposal System when you apply for finance with us.

Use by credit reference and fraud prevention agencies

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies. To do this, we will supply your personal information to credit reference agencies and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. Credit reference agencies will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. When credit reference agencies receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

We will use this information to:

• assess your creditworthiness and whether you can afford to take the product you have applied for;
• verify the accuracy of the data you have provided to us;
• prevent criminal activity, fraud and money laundering;
• manage your account(s);
• trace and recover debts; and
• ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with credit reference agencies while you have a relationship with us. We will also inform the credit reference agencies about your settled accounts. If you borrow and do not repay in full and on time, credit reference agencies will record the outstanding debt. This information may be supplied to other organisations by credit reference agencies.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together. You should make sure you discuss and share this information with them, before making an application to us. Credit reference agencies will also link your records together and these links will remain on both of your files until such time as you successfully file for a disassociation with the credit reference agencies to break that link.

The identities of the credit reference agencies, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the Credit reference agencies are explained in more detail at www.experian.co.uk/crain.

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process your information. If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.

Further details explaining which fraud prevention agencies we use and how the information held by fraud prevention agencies may be used can be obtained by contacting us using the contact details set out below.

Automated decisions and profiling

RCI Financial Services may use a credit-scoring system and fraud detection and prevention system, i.e. an automated system to assess your credit worthiness and decide whether to enter into a finance agreement with you and an automated fraud detection and prevention system. You may ask us to ensure that, when we are evaluating your application for finance, we don’t base any decisions solely on an automated process. You must notify us of this request in writing using the contact details below.

If you make such a request, you will then have the right to be notified where such a decision is or will be based on an automated process. If we notify you that we have taken such a decision, you may request us to review that decision other than by automatic means by writing to us within 21 days of receiving the notification.

We will create a profile of you based on the information that we hold about you and the vehicle(s) that you are interested in in order to send you tailored offers (if you have agreed to receive marketing communications from us) from time to time.

Data anonymisation and use of aggregated information

Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. We might pass on this information to companies in our Group for analytical and statistical purposes or to other companies, such as advertisers, to use for our business and research purposes.

Who may receive or have access to your information?

We may share your information with:

• Companies and consultants providing services to us (for example, marketing agencies, mail outsourcing service providers, information technology service providers who provide and maintain our systems and our website host). Those companies and consultants providing services to us will only use your information to provide those services to us.
• Our Dealer network and third party suppliers who fulfil business activities for us (like roadside assistance, marketing, customer care, customer retention, contract and vehicle related offers and options, events and market research etc.)
• Selected partners who help us to provide you with the information, products and services and services that you request such as roadside assistance.
• Other members of the RCI Group for purposes set out in this Privacy Policy and for product development, statistical analysis and audit purposes.
• A purchaser or potential purchaser of our business or otherwise in the event of a merger, acquisition, re-organisation or similar event.
• A third party company that may take over your contract so that you can continue with your contract.
• A third party involved in the funding, liquidity, capital or treasury and/or related services in relation to your contract with us, for example, asset backed securitisation services.
• Any associated or connected motor manufacturer from whom we purchase or hire goods (and their group companies), including, without limitation, Renault UK Limited, Renault UK Limited trading as Dacia, Renault UK Limited trading as Alpine, and Nissan Motor (GB) Limited. For example, to handle complaints or provide you with services and information.
• Franchise car dealers, including their business partners and when the Dealers opens, closes or moves premises.
• Third party insurance and services providers.
• Credit reference, identity authentication and fraud prevention agencies to help us make credit decisions and fraud prevention checks (they may also share information about you with us).
• Debt collection agencies.
• The police, fraud prevention and identity authentication entities, other law enforcement agencies, government and tax authorities in the United Kingdom or abroad in order to detect, investigate and prevent crime (please note that fraud prevention agencies may also enable law enforcement agencies to access and use your information to detect, investigate and prevent crime).
• The courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
• Our legal and other professional advisors.
• Anyone else where you have given consent or as required by law.

Please be aware that we engage third party agencies, who on occasion, may contact customers by post, e-mail, telephone and/or SMS message on our behalf (for example, to discuss your options prior to the expiry of your finance agreement or customised offers based on information we hold about you and your vehicle). Any information that you provide to the agency or any requests that you make for further information will be passed onto RCI Financial Services and we will deal with your query. Please be assured that any information that you provide to the agency will be kept secure and confidential.

Marketing communications

We would like to contact you with exciting and relevant information about our promotions, events, information, products and services which may be of interest to you. We may do this by post, e-mail, SMS and/or telephone, unless you have told us not to contact you specifically for this purpose.

You can change your marketing preference at any time by getting in touch with us. For e-mail and SMS, please follow the unsubscribe instructions in those communications.

Marketing and social media

We may share your personal data with certain third-party social media platforms for direct marketing purposes to make our products and services more responsive to your interests and/or those of like-minded individuals. We may use your information on ‘list-based’ targeting tools offered by social media platforms and match you on social media for the purposes of direct marketing. For example, we may aggregate your email address together with the email addresses of other customers that visit our website, hash such data, and transmit the hashed data to Facebook for the purposes of creating “Custom Audiences” (where targeted ads are sent to people on Facebook who have already been on our website). We may also use your information to build “Lookalike Audiences” based on your characteristics or interests using targeting tools on social media platforms, for example, where targeted ads are sent to people on Facebook who have similar characteristics to people on our Custom Audience list.

You can opt-out of this use of your personal data for targeted ads at any time by contacting us at the details in section 14, and we will take steps to remove your information from our social media marketing lists. Please note that where you opt-out of this use of personal data, you will be opted-out of all marketing communications, including communications outlined in section 8.

Where we store your information / Transfers to third countries

Sometimes our service providers or other Group companies may be located in other countries and in which case we may send your personal information to countries which have different standards of data protection than the UK. We have put in place protections to ensure that your information is always safeguarded.

We store your information on servers located within the UK or European Economic Area (EEA). We may change the location of servers in the future to improve services to you but we shall always ensure that we put in place protections to ensure that your information is safeguarded. Due to the international nature of our business, there may be some instances where your information is processed or stored outside of the UK and/or EEA. In those instances, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law.

Whenever fraud prevention agencies transfer your information outside of the UK and/or EEA, they impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK and/or EEA. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

Please note that we are a member of National Hunter, a fraud prevention agency. The rules currently do not allow for processing National Hunter data outside of the EEA

How long we store your information

Where we collect your information, the length of time we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under applicable laws. We do not retain personal information in an identifiable format for longer than is necessary for the purposes for which we collect it unless we believe that the law requires us to preserve it.

If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or for as long as necessary to deal with any ongoing queries you may have and/or compliance with laws and regulations. If your application is accepted and you proceed, we hold your information for 7 years from the date on which your agreement with us ends.

If you have signed up to receive email marketing from us, we will store your information for as long as you are subscribed to our email marketing list (even if you are no longer an active customer). If you unsubscribe, we will keep your email address on our suppression list to ensure that we do not send you marketing emails.

Credit reference agencies will retain the information that we give to them for 6 years after your account is closed. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years.

We will not hold your personal information in an identifiable format for any longer than is necessary. We hold your personal information for the periods mentioned to establish, bring or defend legal claims.

The only exceptions to the periods mentioned above are where:

• the law requires us to hold your personal information for a longer period, or delete it sooner;
• where you have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your information for a period of 6 years following the date of that complaint or query for the purposes of bringing or defending any legal claims;
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection
• in limited cases, the law permits us to keep your information indefinitely provided we put certain protections in place.

At the end of the retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

Your rights

Under data protection laws, you have the following rights in respect of your information:

• to be informed about the processing of your information (this is what this Privacy Policy sets out to do);
• to have your information corrected if it’s inaccurate and to have incomplete information completed. If you enter into an agreement with us, you can change your information via our customer online portal or by contacting us using the details at the end of this policy – it’s important that you keep your information up to date;
• to object to processing of your information provided we do not have any continuing lawful reason to continue to use and process the information. When we do rely on our legitimate interests to use your personal information for direct marketing, we will always comply with your right to object. If you would like to do so, please contact us at the details at the end of this policy;
• to withdraw your consent at any time where we rely on it to process your information. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can do so using the unsubscribe tool in the communications, updating your preferences via our Customer Portal or by contacting us using the details at the end of this policy. If you withdraw your consent, our use of your information before you withdraw is still lawful;
• to restrict processing of your information provided we do not have any continuing lawful reason to continue to use and process that information;
• to have your information erased from our systems by contacting us using the details at the end of this policy, provided we do not have any continuing lawful reason to continue to use and process that information;
• to request access to your information and information about how we process it by contacting us using the details at the end of this policy. We may not provide you with a copy of your information if this concerns other individuals or we have another lawful reason to withhold that information;
• to move, copy or transfer your information in a structured data file (“data portability”). Where we rely on your consent as the legal basis for processing your information or need to process it in connection with your contract, you may ask us to provide you with a copy of that information in a structured data file; and
• rights relating to automated decision making, including profiling, in certain circumstances. If you object to this, please contact us at the details at the end of this policy.

You have a number of rights in relation to your personal information as mentioned above under data protection law. In relation to most rights, we will ask you for information to confirm your identity to protect the confidentiality of your personal information and, where applicable, to help us search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received any request (including any identification documents requested).

The way we process your information and the legal basis on which we rely to process it may affect the extent to which these rights apply. If you would like to discuss or exercise any of these rights, please contact us using the details provided below.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (or other relevant data protection authority) where your information has or is being used in a way that you believe does not comply with data protection laws. Please visit the ICO’s website at www.ico.org.uk for further details. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our Data Protection Officer with any data protection concerns. We’ve included how to contact them below.

Security

We are committed to ensuring that your information is secure. To prevent unauthorised access or disclosure of information we have physical, electronic and managerial procedures in place to keep your information safe. For more information on the security we have in place to protect information, please see our Security Policy which is available on request.

Contact details

If you have any specific data protection questions, concerns or a complaint, you can address it to our Data Protection Team as follows:

Data Controller:
RCI Financial Services Limited, Rivers Office Park, Denham Way, Maple Cross, Rickmansworth, WD3 9YS. Telephone: 0333 009 0231; Email: customerservices@rcibanque.com

Contacting us by post:
Data Protection Officer, RCI Financial Services Limited, Rivers Office Park, Denham Way, Maple Cross, Rickmansworth, WD3 9YS

Contacting us by phone:
You can call our Customer Services team on 0333 009 0231. To help us improve our service we may record and monitor calls. Calls are charged at local rate.

Contacting us by email:
dataprotectionofficer-uk@rcibanque.com When you email us, we collect some personal details like your name, address and phone numbers. Email isn’t 100% secure – so we advise that you keep personal information to a minimum. With this in mind, please don’t transmit agreement information using email.

Information Commissioner’s Office
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them using the details below.

ICO Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: www.ico.org.uk/concerns

This Privacy Policy was last updated on 4th May 2021.