How we use your information

Under data protection law, an organisation that decides how the personal information it collects and holds is used is called a ‘data controller’. We call this use of personal information ‘processing’.

If you submit your customer’s mortgages to Nationwide Building Society, the data controller of your personal information is Nationwide Building Society.

Nationwide Building Society has a number of subsidiary companies and overseas branches and is a member of various limited liability partnerships. These include Nationwide Covered Bonds LLP, The Mortgage Works (UK) plc, E-Mex Home Funding Ltd and Derbyshire Home Loans Ltd, UCB Home Loans Corporation Limited and Home Propositions Limited.

In some cases, one of these companies or partnerships will be the data controller.

In this notice, when we say 'Nationwide', ‘the Nationwide Group, 'we', 'us' or 'our' we mean the area of the business that is the data controller of your personal information.

The information we might collect and hold about you includes:

• Personal information to identify and contact you, such as your name, address and contact details that you submit as part of your registration to NFI Online.
• Information about your company, work or profession, your nationality, education and social and economic demographic.
• Details of the accounts and products your customers hold and/or previously held with us.
• Details of payments made to you.
• Personal information gathered from when you’ve applied for a product or service on behalf of a clinet, including where an application was declined.
• Details of when you contact us and when we contact you.
• Details of the type of device you are using (such as whether it’s an Apple phone or a Windows computer).
• Information on your location, gathered from your mobile phone or other devices, where you access the internet.
• Details of how you use our website and online services.
• Details you make public on social media such as Facebook/Twitter.
• Information about your interactions with us online or by telephone.
• Other information that you supply to us or that we obtain from our relationship with you. For example, information about your marketing preferences. This could include sensitive information (e.g. such as something you tell us about your health – we call this 'special category data'.

When we talk about ‘information’ throughout this page, we’re referring to all of these items.

Most of the information we hold about you comes directly from you. This includes information you give us when you:

• apply for our products or services on behalf of a customer
• update your information (such as when you change your contact details)
• speak to us on the phone (we may record some calls for training and quality purposes)
• use our websites or web chat services
• send us letters, emails or other documents.

In certain situations, we may use information that you’ve made public such as social media content. For example when you interact with our social media profiles or reference us in a tweet.

We might collect or receive information from certain third parties too. These include:

• Credit reference agencies
• Government bodies and agencies
• HM Revenue & Customs and other tax authorities
• Regulators
• Law enforcement agencies
• Fraud prevention agencies
• Insurers
• The Electoral Roll and other sources of publicly available information (e.g. Sanctions list, media)
• Our service providers
• Companies and organisations that introduce you to us
• Financial advisers
• Land agents
• Card associations
• Comparison websites
• Market research providers
• Tracing and debt recovery agents
• Organisations providing data services to support us in managing our relationship with you and operating our business.

In the event that you're providing information about another individual, we'll assume that you have told them that you are sharing their details and where they can find more information on how we may process their details.

We collect and use your information so we can open and manage your clients' mortgage accounts, provide services and also operate our business. Examples of how we use your information include:

• Processing your registration for NFI Online.
• Checking your identity and confirming that it is you.
• Managing your relationship with us.
• Preventing and detecting fraud and financial crime.
• Considering any business from you for administrative purposes including contact management.
• Checking the Financial Services Register to confirm that appropriate and current agreements indicating or giving rise to an agency, joint venture or authorisation and permissions are in place.
• Making any other relevant searches and checks in respect of you and your owners/principles.
• Conducting statistical analysis.
• Managing any queries and complaints you might have.
• Providing products and services of our partners.
• Enhancing your experience of our products and services.
• Sharing relevant marketing about our products and services.
• Meeting our legal and regulatory obligations.
• Testing our systems and processes.

We’re able to use your information for the purposes outlined above, where one of the following applies:

• We use the information to carry out our obligations to you, as part of an agreement between you and the Nationwide Group.
• We must use the information to comply with the law or in the public interest.
• We use the information to carry out our legitimate business interests.
• You have given us consent to use the information.
• We use your information to protect your vital interests (e.g. in very exceptional circumstances when we believe it’s in your best interests).

You can find out more about how we use your information in the next sections.

We collect and use your personal information to check your identity when you open a mortgage account, product or service with us on behalf of a client, and from time to time throughout our relationship.

How do we use your information in this way?

We use your information to check that it’s you when you open a mortgage account on behalf of a client. To do this, we collect and share information with databases held by credit reference and fraud prevention agencies. This is so that we can verify your identity.

Why do we use your information in this way?

It’s all about keeping your personal details safe. We check your identity to:

• Make it harder for criminals to use false names and addresses, steal the identities of innocent people and access financial products and systems by pretending to be you.
• Help prevent fraud and stop money laundering.
• Uphold our legal obligations and complete necessary due diligence checks to make sure we know our brokers and customers.

We may also check your identity for our legitimate business interests. For example, to follow guidance and best practice set by our regulators. However, we’ll always make sure that the way we process your information is not unfair to you.

In certain circumstances, you have the right to object to us processing your personal information. Discover more about this, and your other rights, on the Your information rights page.

We need to use your personal information to keep in touch with you.

When do we process your information

We’ll collect and use your details to: 

• Process your client's application for a product or service with us.
• Provide services based on your relationship with us.
• Send you communications to service your clients' accounts, products and services.
• Manage any queries and complaints you might have.
• Assess and accommodate our service to meet your needs.
• Make sure the data we hold about you is correct and up to date.

In managing your relationship with us, we may use information we already hold about you (for example your address and contact details). This is so we provide you with the best experience (such as pre-populating sections on certain application forms, so you don’t have to) and ensure that we hold consistent and correct information about you across our systems. 

We’ll process your information in this way when it’s required as part of the terms and conditions agreed between us, and also when you ask us to carry out activities that need your authorisation.

When you apply for a product or service with us on behalf of a client

Why do we process your information?

It’s part of your agreement with us that you’ll provide us with certain information before we can offer your client a product.

When applying for a mortgage, decisions are often made through automated means. This is so that we can work out your eligibility and whether we’re able to enter into an agreement with you. You’ll find more information on this under the Automated Decision Making section.

Who might we share your information with?

• Credit reference agencies, fraud prevention agencies
• Referees, intermediaries and your employer, for example, when confirming your income as part of a mortgage application
• Other financial providers
• People or organisations acting on your behalf.

When providing the services as part of your relationship with us

Why do we process your information?

It’s part of your agreement with us that we will provide you with these services. We use your information and profiling when providing your services to ensure:

• you can maintain access to your products
• you continue to meet the eligibility requirements for the account
• your product remains appropriate.

This allows us to be fair and consistent in the way we treat our customers, provide you with your information in a clear and concise way and ensure you receive the level of service you would expect.

There may be activities you request that we complete in relation to your account where we require your authority to continue.

Who might we share your information with?

• HMRC and other government agencies, such as DWP
• Credit reference agencies and fraud prevention agencies
• Suppliers acting on our behalf
• People or organisations acting on your behalf
• Payment processors such as BACS, and card associations such as Visa
• Organisations providing data services to support us in managing our relationship with you and operating our business
• Other banks and building societies, so that those making payments to your account can confirm the name they have for you matches the account name we have in our records.

To send you communications to service your clients’ accounts

Why do we process your information?

As part of your agreement with us, we need to send you certain communications, such as your statement and confirmation of interest rates.

We also have legitimate interests to send certain service communications, where necessary. This is due to our obligations as a responsible lender, our regulators’ guidance and best practice. We’ll make sure the way we process your information is not unfair to you.

Who might we share your information with?

Suppliers acting on our behalf.

To manage your queries and complaints

Why do we process your information?

We have legitimate interests to use your information where necessary to investigate and respond to any complaints you have raised with us.

This is because we’re committed to resolving any queries and complaints in a timely manner and will need to process your information to do so. We also have to comply with our regulatory obligations and guidance. We will make sure the way we process your information is not unfair to you.

Who might we share your information with?

• Financial Ombudsman Service and regulators, such as the Information Commissioners Office (ICO)
• Third parties on your behalf and with your authority, such as your MP, solicitor, claims management company
• Intermediaries, where your complaint relates to services provided to you by a broker or intermediary.

To assess and accommodate our service to meet customer needs

Why do we process your information?

We have legitimate interests to collect and use your personal data to work with you through challenging times and ensure it is easy for everyone to use our products and services. We’ll make sure the way we process your information is not unfair to you.

This is because of our obligations as a responsible lender in line with regulators’ guidance and best practice. We also have obligations to comply with the Equality Act 2010 and ensure our services are accessible to all.

You may provide us with special category data, such as health information, so that we can understand your specific circumstances and provide you with the service and/or additional support that may be required.

In most cases, we will ask for your consent when collecting this information. However, if you contact us by post or online we will assume you are happy for us to record the information unless you tell us not to.

Who might we share your information with?

• When necessary, we’ll provide information to our service providers to administer the request on our behalf
•  Third parties on your behalf and with your authority, such as a family member, the Citizens Advice Bureau and Macmillan Cancer Support

To make sure the information we hold about you is correct and up to date

Why do we process your information?

We have legitimate interests to analyse the quality and completeness of our data and the information we hold about you, where necessary. We will use profiling as part of this activity.

This is because data quality is vital to us. And we’re required by law to provide reports to our regulators, ensure that data is in line with Business Validation rules and can be used to make strategic decisions. We’ll make sure the way we process your information is not unfair to you.

Who might we share your information with?

• Suppliers acting on our behalf
• Aggregated level information will be disclosed to regulators

You have the right to object to us using your information for legitimate interests. Find out more about this on the Your information rights page.

At the Nationwide Group, our brokers and customers’ safety is our number one priority. And that’s exactly why we collect and use your information to confirm that you are who you say you are, and to help stop financial crime including fraud and money laundering.

How do we use your information in this way?

We share your personal information with fraud prevention agencies to help prevent financial crime. If required for fraud or criminal investigation reasons, we (and the fraud prevention agencies) may also allow law enforcement agencies to access and use your information.

What information do we share?

The personal information we might need to share in this way includes your:

• name
• address
• employment details
• identifying information (such as your IP address).

We’ll share your information in this way when it’s necessary as part of the terms and conditions agreed between us, either when you’re applying for a product on behalf of a client or as part of our ongoing relationship.

Why do we share your information in this way?

We have a legitimate business interest to check people’s identity, and identify and prevent financial crime including fraud and money laundering. Sharing your information in this way, when necessary, allows us to protect the financial security of brokers and customers. It also makes sure that we’re complying with the law.

You have the right to object to us processing your information in line with our legitimate interests. Find out more about this on the Your information rights page.

A little bit about automated decisions

Sometimes when processing people’s personal information, we might use technology that makes automated decisions about our brokers and customers. This means that we may automatically decide that someone poses a financial crime risk if:

• The information processed reveals behaviour that indicates financial crime.
• The information provided is different to information previously given.
• Someone appears to have deliberately hidden their true identity.

You have rights related to automated decision making. You can find out more about these by taking a look at the Your information rights page.

What happens if a financial crime risk is detected?

We take financial crime seriously. And if we, or a fraud prevention agency, believe that someone poses a financial crime risk then we may refuse to provide the services that they’ve asked for. We can also stop providing services they already have with us.

If they apply for a job with us, and financial crime is detected, we may not employ them. Or, if they work for us already, we may stop their employment.

A record of any fraud risk will be kept by the fraud prevention agencies and this could mean that other providers refuse to offer services, finances or employment. Fraud prevention agencies can hold onto someone’s personal data for different periods of time, depending on the situation. If someone is considered a fraud risk, their data can be held for up to six years.

Fraud prevention agencies may transfer your personal information outside of the UK, this may be to a country where the UK Government has decided that your information will be protected to UK standards. If it is any other country, fraud prevention agencies will ensure that appropriate safeguards are in place to continue to protect your personal information.

Any questions?

If you have any questions about financial crime prevention, and how we use your information in this way, don’t hesitate to get in touch.

Sometimes, we might need to collect and use your information to provide, introduce or distribute products and services from our partners.

How do we use your information in this way?

We’ll share necessary information with our partners when:

• Discussing any queries or complaints that may arise.
• To help them provide products and services to us.
• We need to update them about a change to your address or contact details.

Our partners will also collect and use your information to manage the products and services that you have with them. As this then makes them the ‘data controller’, they’ll provide more details on how they process your information at the time when it’s collected by them or shared by the Nationwide Group.

When selecting our partners, we take appropriate steps to make sure that they have adequate protection in place and that they follow data protection legislation.

Why do we need to use your information for this?

We’ll use your personal information to meet the promises we’ve made in the terms and conditions of your product or service. We also use your information to understand your needs so that we can accurately advise on the products and services that are right for you.

We may also use it for our legitimate business interests. For example, when we need to make sure that the terms you’ve agreed to will be upheld, or to follow best practice from regulators.

We’ll always keep your best interests at heart and make sure that the way we process your information isn’t unfair to you.

You have the right to object to us using your information for legitimate interests. Find out more about this on our Your information rights page.

How do we use your information in this way?

We want you to get the most out of your relationship with the Nationwide Group. One of the ways we might help you do this is by using the contact details you’ve supplied us to send you marketing information about products or services we think you’ll find interesting. For example, it might be a monthly e-newsletter keeping you updated on what’s happening with the housing market.

We also collect and use your information to help us plan and tailor the delivery of our marketing campaigns. Discover more about this in our enhancing your experience of our products and services section.

Your marketing preferences, your choice

When it comes to receiving marketing, you're in control. And you’re free to choose if you want to hear from us at all and how – whether that’s by post, phone, or email. It’s also fine if you change your mind. You can update your marketing preferences at any time.

Update your preferences:

• By calling us

Managing your marketing preferences if you are a commercial customer

If we have your name down as a contact or director or shareholder, we may send you marketing information from time to time about products or services we think could be of interest – or that could help you grow your business.

We have a legitimate business interest to use your information in this way due to the relationship you have with us as someone associated with one of our products. We‘ll only use this information in a way which is fair to you and you can update your marketing preferences at any time by using the contact details above.

And don’t worry, even if you’d rather not get marketing messages, we’ll still make sure you always receive important information about your accounts.

We’ll never pass on your details to anyone else for their marketing purposes either.

At the Nationwide Group, we’re required to collect and use your personal information in a number of circumstances to meet our legal and regulatory obligations.

These include using your personal information to carry out a range of activities that ensure we comply with the requirements set out by our regulators (e.g. Financial Conduct Authority – FCA – and Prudential Regulation Authority – PRA) and in relevant legislation (e.g. Data Protection Legislation and Anti-Money Laundering Regulations). We also disclose information to HMRC and other government bodies when we are required or permitted to do so.

How do we use your information in this way?

Sometimes, we’re required by law to produce reports or statistical modelling that we disclose to regulators or government bodies (e.g. when we need to report our complaints statistics to the FCA. To produce these reports, we may need to use profiling (where we categorise your behaviours, interactions and/or characteristics alongside other customers). This helps us make sure that our reporting is accurate.

In certain circumstances, we’ll process your personal information in this way for our legitimate business interests. This is when we have legal obligations to process your information but flexibility in how we do this.

You have the right to object to us using your information for legitimate interests. Find out more about this on our Your information rights page.

We’re constantly looking to improve how we do things – and understanding more about you helps us do exactly that.

We collect and use your personal information to help us make our business better, improve products and services and enhance how we engage with brokers and customers. This includes:

• Enhancing your experience online and on the phone, so we can provide the best possible service now and in the future.
• Understanding your needs and looking at how you engage with the Nationwide Group.
• Creating and improving the products and services we offer.
• Developing and improving our processes, credit risk systems and policies so we can meet the needs of our customers.
• Understanding our customers' diverse backgrounds to help inform our strategy.
• Planning and tailoring how we communicate and provide relevant content to you.
• Developing our business and understanding how we're performing.

We'll also use information we have collected from credit reference agencies and other organisations to profile your information. Profiling is where we categorise behaviours, interactions and/or characteristics, both now and in the future. We'll do this whether or not you, or the Nationwide Group, choose to proceed with the application. This is also part of our statistical modelling, helping us to review our risk appetite when making lending decisions.

What type of information do we use?

• Personal information to identify you
• Details about the products you hold and account activities
• Information about your work or profession, your nationality, education and social and economic demographic
• Information you put into our online services (such as our mortgage calculators)
• Information about how you interact with us (such as when you call us)
• Information about our online content which you have viewed
• Details of feedback you have provided, either directly to us or that you make public e.g. on social media
• Information about the services you use and how you use them
• Details of the devices you use to interact with us
• Information about how you respond to our communications (such as whether you read an email)
• Information on your location, gathered from your mobile phone or other device, where you access the internet or where you make a payment
• Information gathered from third parties.

How do we use your information for this?

We look at you and how you engage with us, your transactions and how you use our products and services. Sometimes, we'll collect information about you from organisations carrying out market research on our behalf to make sure you had a positive experience with us, to ask your opinion on our products and services, or trends in our industry.

Then, we structure and analyse this information to consider how you might use our products and services in the future. We may also use your information to categorise groups of members who interact and engage with us in similar ways.

Why do we use your information in this way?

We might use your information in this way when it is in our legitimate business interests. Your information and views help us understand the ever-changing needs of our customers, putting you at the heart of decisions we make about our products and services. By doing this, we can keep evolving what we offer.

What do we do when profiling your information?

Profiling your information alongside other members and customers also helps us to ensure that we’re providing a consistent service and giving people the best products at the right times. We may:

• Make predictions about you and your behaviours to understand the likelihood that you may do something
• Grouping your information with people with similar traits to make sure you receive the correct service messages for the products you hold and your personal circumstances.     
• Analyse your interactions with the Nationwide Group, such as when you telephone our call centre or visit our website
• Assess the performance of communications we share.
• Monitor the performance of our products and services in the marketplace
• Produce anonymised reports for internal use and to meet our legal and regulatory requirements.

We’ll always make sure the way we process your information is safe and not unfair to you. Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports.

You have the right to object to us processing your information for our legitimate interests. You can find out more about this, and your other rights, on our Your information rights page.

We’re constantly looking to improve our products, services and systems. And, when it’s essential, we may use your personal information for testing so that we can make them even better.

How do we use your information in this way?

We have stringent processes in place to keep your personal information safe and we won’t use it in a way that’s unfair to you. When we use your information for testing, we:

• Always do this in a secure and controlled environment.
• Only use the minimum amount of data necessary for the testing.
• Only use carefully selected specialist service providers, where necessary.
• Only hold your information in this way for as long as needed to carry out testing.

Why do we use your information in this way?

Using your information for testing is necessary for our legitimate business interests as it allows us to maintain and improve the security, integrity and performance of our systems. Also, being able to develop systems with customers in mind enhances the experiences you have with us.

You have the right to object to us processing your information in this way. For more details on this, and your other rights, take a look on our Your information rights page.

Your information will be shared with:

• The Nationwide Group, for the purposes explained in the how we use your information section.
• Partners and suppliers that support the operation of the business.
• Specific third parties that you’ve authorised us to deal with (e.g. professional advisors, family members or representatives for you).
• Third parties, when we’re required to do so under the terms of any secured wholesale funding programmes.

When necessary, we may also share information with other organisations, including:

• Credit reference agencies
• HM Revenue & Customs and other tax authorities
• UK Financial Services Compensation Scheme
• Regulators e.g. FCA
• Financial Ombudsman Scheme
• Law enforcement agencies
• Fraud prevention agencies
• Government bodies and agencies
• Land agents
• Card associations (e.g. Visa)
• The Direct Debit scheme (if you use Direct Debits)
• Payment processors (e.g. BACS)
• Comparison websites
• Market research providers
• Organisations providing data services to support us in managing our relationship with you and operating our business.

You’ll find out more about when we’d need to share your information with partners in our section about providing products and services from our partners.

If you’ve authorised us to, or in exceptional circumstances when we believe it’s in your interests, we might also share your information with healthcare or other wellbeing organisations. But we’ll only share the minimum amount of information needed (for example, your contact details).

Also, in the event that we transfer, sell or merge parts of our business, your information will be shared accordingly.

Our aim is to keep your information for as long as we need to, in order to manage your relationship with us and comply with legal and regulatory requirements.

Just so you know, we may keep your information for longer than indicated if we cannot delete it for legal, regulatory, or technical reasons. We may also keep it for research or statistical purposes. If we do, we’ll make sure that your privacy is protected and only use it for those purposes.

Keeping your information safe

We’re committed to taking good care of your personal information and we have stringent security measures in place to keep it well-protected.

You have certain rights when it comes to your personal information and there are a number of requests you can make to ensure we're only using your information in ways you agree to.

Please see Your information rights page to see how you can do this.

Why it's important

We need you to keep your personal details up to date so that we can get in touch with you about your accounts, products or services your clients have with us.

If you change your name, address, phone number or email address, please let us know straight away. You can update your contact details on our NFI Online registration page.

At the Nationwide Group, we sometimes use advanced technology to make automated decisions about our customers. This could be when you’re applying for a mortgage on behalf of your customer.

When do we use automated decision making?

1. To assess your client's application and check if we can approve them for credit, to make sure that we’re lending responsibility.
2. To assess if we can offer your customer a financial product and work out the level of interest that they’ll pay. This helps us make sure that we’re fair and consistent in our product offerings.
3. To check if someone’s making a fraudulent application or if there’s activity that needs further review. This is so we can protect you and your client from financial crime.
4. To decide if your clients are, or continue to be, eligible for the product or service chosen.

What information do we use to make these decisions

For automated decision making, we use information that we’ve collected or hold about you and your client from your applications. Sometimes, we might also use information from other sources such as credit reference or fraud prevention agencies – but we check this against the information you give us.

• Information you provide us as part of your customer’s mortgage application
• Information about how you use our services
• Information about the devices you use
• Information held with credit reference and fraud prevention agencies
• Existing data we hold for modelling purposes
• Information gathered from third parties.

How we use this information

• To validate the information you have provided us
• To make sure our credit scoring system is fair
• To create profiles about you through analysing the information
• To better understand trends in traits and behaviours
• To make predictions on potential fraudulent behaviour
• To analyse the data to improve our services. 

Profiling

Profiling is used to make automated decisions. This is where we combine your information with information about others so that we can:

• Understand trends in traits and behaviours.
• Make predictions about how you might use our products and services in the future.
• Analyse data to improve our service and generate alerts (e.g. where we suspect that you may be the victim of financial crime).

Why do we use your information in this way?

We use automated decision making to check that we can enter into an agreement with your client, and also carry out our legal and regulatory obligations. Sometimes, it’s required by law (e.g. when complying with UK money laundering regulations).

In certain circumstances, you have the right to ask for a decision to be reviewed by a person. For more information on this, take a look at Your information rights page.

From time to time, we might need to collect or use personal information from individuals who aren’t customers of the Nationwide Group. This could be when they:

• have a Power of Attorney or a third party mandate to act on a customer’s behalf.
• are the Personal Representative registering the death of a member or customer.
• are acting as the guarantor on a customer’s mortgage.
• are acting as the donor for the deposit on a customer’s mortgage.
• are supporting a member when English isn’t their first language.
• are raising a complaint but aren’t a member or customer of The Mortgage Works.
• are acting on behalf of our customer, either in a professional capacity (e.g. a broker in a mortgage application) or a personal capacity (e.g. a family member).

How do we collect or use this information?

In most cases, we’ll collect this information from the individuals directly. But there might be times when our customers provide their details.

If you’re providing information about another individual, we'll assume that you have told them that you are sharing their details and where they can find more information on how we may process their details.

Why do we need this information?

We might need to use this information to confirm their identity, help manage others’ accounts, prevent fraud and engage with customers.

We’ll only use this information if we have a legal reason or legitimate business interests to do so.

These individuals also have certain rights regarding their personal information. For more information on this, take a look at our information rights page.

We may transfer personal information to countries outside the UK when:

• You request for us to do so.
• We’re required or permitted to by law.
• We’re sharing data with a third party to support us in managing your account and running the Nationwide Group.

When working with our suppliers and/or transferring information to countries outside the UK, we take appropriate steps to ensure that there is adequate protection in place and that data protection legislation is followed.

This could be by:

• Ensuring that we transfer information to countries that we believe have comparable data protection legislation to the UK.
• Putting suitable clauses in our contracts so that organisations take appropriate steps to comply with UK data protection law.

If you would like more information on this, please contact us.

Nationwide’s Data Protection Officer (DPO) is responsible for protecting personal information held by Nationwide Building Society and its subsidiaries.

You can contact them by writing to:

The Data Protection Officer
Nationwide Building Society
Nationwide House
Pipers Way
Swindon
SN38 1NW