Toyota Financial Services (UK) PLC will be referred to as "we" "us" or "our"
Contents
Personal information or personal data is information about you that enables you to be identified. We may collect, use, process and store the following categories of personal information about you:
If you provide personal information about another person such as a person who has agreed to indemnify your liability under the finance agreement, you must have authority from that person to provide it. By providing any personal information about another person you confirm that you are authorised to do so, so that their personal information can be used by us in accordance with this notice.
It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your information changes.
We will collect, use, process and store your personal information on the basis that we need to take steps to enter into or to perform the agreement for the finance product that you have applied for, and to comply with laws that apply to us.
Also, sometimes your personal information may be used for our legitimate interests or those of relevant third parties such as credit reference agencies, provided that your interests and fundamental rights do not override those interests.
Specifically we will use and process your personal information in the following situations and for the following reasons:
We may contact you in the last twelve months of your finance agreement on the basis that we have a legitimate interest to communicate with you about any end of contract options that are described in your finance agreement, or otherwise in relation to any relevant matters arising from the performance and expiry of your finance agreement.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
We have put in place procedures to deal with any suspected data security breach or incident and will notify you and any applicable regulator of a suspected breach or incident where we are legally required to do so.
We will only collect information about criminal and fraudulent investigation and convictions where it is relevant and appropriate to enter into the finance agreement or to perform any finance agreement entered into.
We or fraud prevention agencies may enable law enforcement agencies to access and use your personal information to detect, investigate and prevent crime.
The decision to accept your application for a finance product may be conducted by automated means. If your application is not accepted in this way it will be referred for analysis and assessment by a person in our relevant application assessment team.
For further information about automated decision making please refer to our privacy policy or contact us. See the ‘How to contact us’ section below.
We may share your personal information with third parties where it is necessary to enter into the finance agreement or to perform or enforce any finance agreement entered into and to comply with laws that apply to us. In particular, we may share your personal information with other Toyota group companies for this purpose and for the administration of your finance agreement.
Before we enter into any finance agreement with you we will search the files of credit reference and fraud prevention agencies who will record any searches and other information on your file.
We may share your personal information with credit reference agencies or fraud prevention agencies on the basis that we have a legitimate interest in preventing fraud and money laundering, to verify identity and to assess your creditworthiness, provided that your interests and fundamental rights do not override those interests.
We may share your personal information with third parties in the following situations and for the following reasons:
Our third party service providers are required to take appropriate security measures to protect your personal information. We do not allow third party service providers to use your personal information for their own purposes, they are only allowed to use and process your personal information for specified purposes and in accordance with our instructions.
In particular, we may share your personal information with the following third parties:
Credit Reference Agencies
In order to process your application, we will perform credit and identity checks about you with one or more credit reference agencies (CRAs). These CRAs are Equifax and Experian.
To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.
If we share your personal information with a CRA your personal information will be used and processed by the CRA in accordance with the provisions of the Credit Reference Agency Information Notice (referred to as the CRAIN).
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in their respective CRAINs.
The CRAINs are accessible from each of the CRAs – clicking on any of the following links will also take you to the same CRAIN document:
www.equifax.co.uk/crain.html
www.experian.co.uk/crain/
Cifas
Cifas is the data controller of the Cifas National Fraud Database.
The personal information we have collected from you will be shared with Cifas and fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud or a money laundering risk is detected, you could be refused certain services, finance or employment.
Further details of how your information will be used by Cifas and these fraud prevention agencies, and your data protection rights, can be found on the Cifas website located at:
www.cifas.org.uk/fpn
We do not envisage that we will need to transfer the personal information we collect about you outside of the European Economic Area.
For further information about transfer of information please refer to our privacy policy or contact us. See the ‘How to contact us’ section below.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, and for the purposes of satisfying any legal, regulatory, accounting or reporting requirements.
For further information about retention please refer to our privacy policy or contact us. See the ‘How to contact us’ section below.
Data protection law gives you rights in relation to the use of your personal information. These rights include a right for you to request access to your personal information, a right to object to our processing of your personal information and a right to request that your personal information is erased or corrected.
You will not have to pay a fee to access your personal information for the first time or to exercise any other of your rights. Under certain circumstances we may charge a reasonable fee for your access or refuse to comply with your request.
For further information about these and other rights please refer to our privacy policy or contact us. See the ‘How to contact us’ section below.
You have the right to make a complaint at any time to the Information Commissioner’s Office (referred to as the ‘ICO’). The ICO is the UK regulatory authority for data protection issues.