PRIVACY NOTICE

YOUR PERSONAL INFORMATION AND WHAT WE DO WITH IT

THE MEANING OF SOME TERMS THAT WE USE IN THIS PRIVACY NOTICE
Automated decision making means a process where we make decisions about you, such as your suitability for a product, using a computer based and automated system without a person being involved in making that decision (at least first time around).
Profiling means any form of automated processing of your personal information to evaluate certain personal aspects about you, such as to analyse or predict aspects concerning your economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Process or processing includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting, destroying or transferring it overseas.
Legitimate interests is mentioned in our privacy notice because data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Those laws call this the legitimate interests legal ground for personal data processing.

WHO WE ARE AND HOW TO CONTACT US
Earl Shilton Building Society of 22 The Hollow, Earl Shilton, Leicester LE9 7NB is a data controller of your personal information. This means information that is about you or from which we can identify you. This privacy notice describes how we deal with your personal information. We are the data controller of this information under relevant data protection laws because in the context of our business relationship with you we decide how and why it is processed in the ways explained in this privacy notice. When we use terms such as we, us and our in this notice, we mean Earl Shilton Building Society.
Our Data Protection Officer can be contacted at any time including if you have queries about this privacy notice or wish to exercise any of the rights mentioned in it. The contact details are:
Post: Data Protection Officer
Earl Shilton Building Society
22 The Hollow
Earl Shilton
Leicester
LE9 7NB
Telephone: 01455 844422
You will see at the end of this privacy notice that we mention the privacy notices of Credit Reference Agencies. We do need to share these with you. Please read them carefully and contact those organisations if you have questions (their details are in their notices).
This privacy notice may be updated from time to time. This means we may send you an updated copy (depending on whether we are required to do that or not). An up to date version will be made available on the Society's website www.esbs.co.uk.

HAVE YOU BEEN INTRODUCED TO US BY A BROKER OR OTHER INTERMEDIARY?
Our mortgage and savings products are available through our own branches and savings accounts are available on our own website. Our mortgages may be viewed on our website and are also available through professional and financial advisors and anyone else who acts as a person sitting in between you and us in relation to what we do for you. In this notice we will call these persons “brokers and other intermediaries”.
When a broker or other intermediary processes your personal information on our behalf, this privacy notice will apply and you should contact our Data Protection Officer to exercise your rights under data protection laws. When a broker or other intermediary processes your personal information as a data controller in its own right, its own privacy notice will apply and you should ask them for a copy if you do not have one by the time you are introduced to us.

WHAT KINDS OF PERSONAL INFORMATION ABOUT YOU DO WE PROCESS?
This will depend on the products or services you apply for and (if your application is successful) obtain from us.

PERSONAL INFORMATION THAT WE GENERALLY PROCESS IN CONNECTION WITH ALL OUR PRODUCTS AND SERVICES
This includes:
• Your title, full name, your contact details, including for instance your email address, home and mobile telephone numbers;
• Your home address, correspondence address (where different from your home address) and address history; • Your date of birth and/or age, e.g. to make sure that you are eligible to apply for the product and/or that it is suitable for you;
• Your National Insurance number, if you have been issued with one;
• Your nationality, if this is necessary for us to comply with our legal and regulatory requirements;
• Records of how you have contacted us and, if you get in touch with us online, details such as your mobile phone location data, IP (Internet Protocol) address and MAC (Media Access Control) address; and
• Some special categories of personal data such as about your health or if you are considered a vulnerable customer (more details below).

ADDITIONAL PERSONAL INFORMATION THAT WE PROCESS IN CONNECTION WITH A MORTGAGE
This includes:
• Your financial details e.g. your salary and details of other income, details of your savings, details of your expenditure, and details of account(s) held with other providers if you pay your mortgage from those account(s);
• Details about all of your existing borrowings and loans;
• Personal information about your credit history which we obtain from Credit Reference Agencies (CRAs) including data which originates from Royal Mail (UK postal addresses), local authorities (electoral roll), the insolvency service, Companies House, other lenders and providers of credit (who supply data to the CRAs), court judgments, decrees and administration orders made publicly available through statutory public registers (see the section on ‘Credit Reference Agencies’ below);
• Information about your employment status including whether you are employed, self-employed, retired or receive benefits;
• Information about your occupier status, such as whether you are a tenant, live with parents or are an owner occupier of the property in which you live at the time of your application;
• Information which is relevant for your residency and/or citizenship status, such as your nationality, your length of residency in the UK and/or whether you have the permanent right to reside in the UK;
• Your marital status, family, lifestyle or social circumstances if relevant to the mortgage product (e.g. the number of dependents you have or if you are a widow or widower); and
• Where relevant, information about any guarantor which you provide in any application.

ADDITIONAL PERSONAL INFORMATION THAT WE PROCESS IN CONNECTION WITH A SAVINGS PRODUCT
This includes:
• Your financial details e.g. details of your other savings account(s) held with other providers if you pay into your savings product from those other account(s);
• Where a person other than the savings account holder makes a withdrawal from the account, information about that person and the transaction; and
• Information about your tax position.

JOINT APPLICANTS, GUARANTORS AND POWERS OF ATTORNEY
If you make a joint application we will also collect the personal information mentioned above about that/those person(s). You must show this privacy notice to the other applicant(s) and ensure they confirm that they know you will share it with us for the purposes described in it. If you look now at the “What are the legal grounds” section (below) you will see reference to consent and a description of some limited scenarios where it may be relevant to what we do with personal information. If we ask you to obtain consent from the joint applicant(s) (such as for marketing) you should do that using the consent capture mechanism that we give or make available to you for that purpose.
If you apply for your mortgage with a guarantor, that person will see this privacy notice when he/she submits his/ her own personal information to us because he/she must necessarily sign the application form. If there is somebody who has power of attorney over your affairs, that person will see this privacy notice when we make contact with him/her directly.

WHAT IS THE SOURCE OF YOUR PERSONAL INFORMATION?
We will generally collect your personal information from you directly. If you are introduced to us by a broker or other intermediary, we will obtain some personal information about you indirectly from them when they introduce you to us.
In addition, we obtain your personal information from other sources such as Credit Reference Agencies, your employer, landlord, other lenders, HMRC (Her Majesty’s Revenue & Customs), DWP (Department for Works & Pensions), publically available directories and information (e.g. telephone directory, social media, internet, news articles), debt recovery and/or tracing agents, other organisations to assist in prevention and detection of crime plus police and law enforcement agencies. Some of the personal information obtained from Credit Reference Agencies will have originated from publicly accessible sources. In particular, Credit Reference Agencies draw on court decisions, bankruptcy registers and the electoral register (also known as the electoral roll). We explain more about Credit Reference Agencies below. We have also mentioned above in the lists of personal information that we process some of the CRAs’ other sources of information (which are our own source of information too).

WHAT ARE THE LEGAL GROUNDS FOR OUR PROCESSING OF YOUR PERSONAL INFORMATION (INCLUDING WHEN WE SHARE IT WITH OTHERS)?
Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organisations). For some processing, more than one legal ground may be relevant (except where we rely on a consent). Here are the legal grounds that are relevant to us:
1) Processing necessary to perform our contract with you for the mortgage product or savings product or for taking steps prior to entering into it:
a) Administering and managing your mortgage or savings account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and doing this for recovering debt in relation to your mortgage account;
b) Sharing your personal information with other payment services providers such as when you ask us to share information about your account with them;
c) All stages and activities relevant to managing your mortgage or savings account including enquiry, application, administration and management of accounts, illustrations, requests for transfers of equity and setting up/changing/removing guarantors (relevant to mortgage accounts only); and
d) For some of our profiling and other automated decision making.
2) Where we consider that, on balance, it is appropriate for us to do so, processing necessary for the following legitimate interests which apply to us and in some cases other organisations (who we list below) are:
a) Administering and managing your mortgage or savings account and services relating to that, updating your records, tracing your whereabouts to contact you about your mortgage account and doing this for recovering debt;
b) To test the performance of our products, services and internal processes;
c) To adhere to guidance and best practice under the regimes of governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme;
d) For management and audit of our business operations including accounting;
e) To carry out searches at Credit Reference Agencies pre-application, at the application stage, and periodically after that;
f) To carry out monitoring and to keep records (see our section on monitoring below);
g) To administer our good governance requirements such as internal reporting and compliance obligations or administration required for AGM (Annual General Meeting) processes;
h) For market research and analysis and developing statistics;
i) For direct marketing communications; and
j) When we share your personal information with these other people or organisations;
• Your guarantor (if you have one) applicable to mortgages only;
• Joint account holders, trustees and beneficiaries and any person with power of attorney over your affairs (in each case only if relevant to you);
• Other payment services providers such as when you ask us to share information about your account with them; • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
• The broker or other intermediary who introduced you to us;
• Our legal and other professional advisers, auditors and actuaries;
• Financial institutions and trade associations;
• Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme;
• Tax authorities who are overseas for instance if you are subject to tax in another jurisdiction we may share your personal information directly with relevant tax authorities overseas (instead of via HMRC);
• Other organisations and businesses who provide services to us such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions;
• Buyers and their professional representatives as part of any restructuring or sale of our business or assets;
• Credit Reference Agencies (see below where we explain more and refer to a separate leaflet for more information); and
• Market research organisations who help us to develop and improve our products and services.
3) Processing necessary to comply with our legal obligations:
a) For compliance with laws that apply to us;
b) For establishment, defence and enforcement of our legal rights;
c) For activities relating to the prevention, detection and investigation of crime;
d) To carry out identity checks, anti-money laundering checks pre application, at the application stage, and periodically after that;
e) To carry out monitoring and to keep records (see our section on monitoring overleaf);
f) To deal with requests from you to exercise your rights under data protection laws;
g) To process information about a crime or offence and proceedings related to that (in practice this will be relevant if we know or suspect fraud); and
h) When we share your personal information with these other people or organisations:
• Your guarantor (if you have one) applicable to mortgages only;
• Joint account holders, Trustees and beneficiaries, and the person with power of attorney over your affairs;
• Other payment services providers such as when you ask us to share information about your account with them;
• Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
• Law enforcement agencies and governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme (depending on the circumstances of the sharing); and
• Courts and to other organisations where that is necessary for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
4) Processing with your consent:
a) When you request that we share your personal information with someone else and consent to that;
b) For direct marketing communications;
c) For some of our profiling; and
d) For some of our processing of special categories of personal data such as about your health or if you are considered a vulnerable customer (and it will be explained to you when we ask for that explicit consent what purposes, sharing and use it is for).
5) Processing for a substantial public interest under laws that apply to us where this helps us to meet our broader social obligations such as:
a) Processing of your special categories of personal data such as about your health or if you are considered a vulnerable customer;
b) Processing that we need to do to fulfil our legal obligations and regulatory requirements; and
c) When we share your personal information with other people and organisations if they need to know that you are considered a vulnerable customer such as your relatives, social services, your carer, and/or the person who has power of attorney over your affairs.

HOW AND WHEN CAN YOU WITHDRAW YOUR CONSENT?
Much of what we do with your personal information is not based on your consent, instead it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us as follows:
Post: Data Protection Officer
Earl Shilton Building Society
22 The Hollow
Earl Shilton
Leicester
LE9 7NB
Telephone: 01455 844422
The consequence might be that we cannot send you some marketing communications or that we cannot take into account special categories of personal data such as about your health or if you are considered a vulnerable customer (but these outcomes will be relevant only in cases where we rely on explicit consent for this).
We will tell the broker or other intermediary who introduced you to us that you have withdrawn your consent only if it is our data processor (this means an organisation who is processing personal information on our behalf) or if we are required to do so when you exercise certain rights under data protection laws. You should make sure to contact them directly to withdraw your consent for what they do with your personal information as a data controller in their own right.
To comply with payment services regulations we have to share some of your personal information with other payment service providers in some circumstances such as when you ask us to share information about your account with them. Whilst those payment services regulations mention ‘consent’ for this, ‘consent’ in that context does not have the same meaning as ‘consent’ under data protection laws. The legal grounds which may be relevant to this are compliance with our legal obligations, performance of our contract with you, our legitimate interests, or a combination of these. This is why if you ask to withdraw consent from what we do with your personal information where we need to have it for the payment services regulations, we may still have to hold and use your personal information.

IS YOUR PERSONAL INFORMATION TRANSFERRED OUTSIDE THE UK OR THE EEA?
We are based in the UK but sometimes your personal information may be transferred outside the UK or the European Economic Area. If it is processed within Europe or other parts of the European Economic Area (EEA) then it is protected by European data protection standards. Some countries outside the EEA do have adequate protection for personal information under laws that apply to us. We will make sure that suitable safeguards are in place before we transfer your personal information to countries outside the EEA which do not have adequate protection under laws that apply to us.
Safeguards include contractual obligations imposed on the recipients of your personal information. Those obligations require the recipient to protect your personal information to the standard required in the European Economic Area. Safeguards also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information.
HOW DO WE SHARE YOUR INFORMATION WITH CREDIT REFERENCE AGENCIES?
In order to process your application, we will perform identity checks and credit checks (applicable to mortgages only) on you with one or more credit reference agencies (CRAs). To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history.
CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We will use this information to:
• Assess your creditworthiness and whether you can afford to take the mortgage;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Manage your account(s);
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate to your circumstances.
Please see the data privacy notices section at the end of this document.
We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs. The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the separate leaflet which we refer to later on in this privacy notice.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you are making a joint application we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or the joint applicant successfully files for a disassociation with the CRAs to break that link.

WHAT SHOULD YOU DO IF YOUR PERSONAL INFORMATION CHANGES?
You should tell us without delay so that we can update our records. The contact details for this purpose are:
Post: Earl Shilton Building Society
22 The Hollow
Earl Shilton
Leicester
LE9 7NB
Alternatively, please contact either of our branches.
If you were introduced to us by a broker or other intermediary who is data controller in its own right, you should contact them separately. In some cases where you exercise rights against us under data protection laws (see the section on ‘what are your rights under data protection law?’) we may need to inform the broker or other intermediary but this will not always be the case.

DO YOU HAVE TO PROVIDE YOUR PERSONAL INFORMATION TO US?
We are unable to provide you with the mortgage product or savings product or to process your application without having personal information about you. Your personal information is required before you can enter into the relevant contract with us, or it is required during the life of that contract, or it is required by laws that apply to us. If we already hold some of the personal information that we need – for instance if you are already a customer – we may not need to collect it again when you make your application.

DO WE DO ANY MONITORING INVOLVING PROCESSING OF YOUR PERSONAL INFORMATION?
In this section monitoring means any listening to, recording of, viewing of, intercepting of, or taking and keeping records (as the case may be) of calls, email, text messages, social media messages, in person face to face meetings and other communications.
We may monitor where permitted by law and we will do this where the law requires it. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or in person meetings (as relevant) we will do so.
Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.
Some of our monitoring may check for obscene or profane content in communications.
We may conduct short term carefully controlled monitoring of your activities on your mortgage account or savings account where this is necessary for our legitimate interests or to comply with our legal obligations. For instance, where we suspect fraud, money laundering or other crimes.
Telephone calls and/or in person meetings between us and you in connection with your application and the mortgage product or savings product may be recorded to make sure that we have a record of what has been discussed and what your instructions are. We may also record these types of calls for quality control and staff training purposes.

PROFILING AND OTHER AUTOMATED DECISION MAKING
This section is relevant where we make decisions about you using only technology, and where none of our employees or any other individuals have been involved in the process. For instance, in relation to transactions on your mortgage account or savings account, payments into your savings account from other providers, and triggers and events such as account opening anniversaries and maturity dates. We may do this to decide what marketing communications are suitable for you, to analyse statistics and assess lending risks.
We can do this activity based on our legitimate interests (and they are listed in the section about legal grounds above) only where the profiling and other automated decision making does not have a legal or other significant effect on you. In all other cases, we can do this activity only where it is necessary for entering into or performing the relevant contract, is authorised by laws that apply to us, or is based on your explicit consent. In those cases you have the right to obtain human intervention to contest the decision (see ‘rights in relation to automated decision making which has a legal effect or otherwise significantly affects you’ below). Profiling for direct marketing can mean there is a separate right to object (see ‘rights to object’ below).

FOR HOW LONG IS YOUR PERSONAL INFORMATION RETAINED BY US?
Unless we explain otherwise to you, we will hold your personal information for the following periods:
• Retention in case of queries. We will retain the personal information that we need to keep in case of queries from you (for instance, if you apply unsuccessfully for a product or service) for 1 year unless we have to keep it for a longer period (see directly below);
• Retention in case of claims. We will retain the personal information that we need to keep for the period in which you might legally bring claims against us which in practice means 6 years for savings accounts and 12 years for mortgages and financial planning unless we have to keep it for a longer period (see directly below); and
• Retention in accordance with legal and regulatory requirements. We will retain the personal information that we need to keep even after the relevant contract you have with us has come to an end for 18 years for mortgages and financial planning and this will be to satisfy our legal and regulatory requirements.

WHAT ARE YOUR RIGHTS UNDER DATA PROTECTION LAWS?
Here is a list of the rights that all individuals have under data protection laws. They do not apply in all circumstances. If you wish to exercise any of them we will explain at that time if they are engaged or not. The right of data portability is only relevant from May 2018.
• The right to be informed – we have to be transparent with you about the processing that we do with your personal information. This is why we have a privacy notice. The information that you supply is determined by whether or not we collected your personal information directly from you or indirectly via someone else (such as a broker or other intermediary). Your right to be informed may be relevant if you consider it necessary to ask for more information about what we do with your personal information.
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed in certain circumstances. If we have disclosed the personal information in question to other organisations, we must inform them of the rectification where possible. Your rights in relation to rectification may be relevant if you consider that we are processing inaccurate or incomplete information about you.
• The right to object to processing of your personal information where it is based on legitimate interests, where it is processed for direct marketing (including profiling relevant to direct marketing) or where it is processed for the purposes of statistics. Your rights to object may be relevant if you wish to find out more about what legitimate interests we rely on (they are listed in this privacy notice) or about what profiling we do in relation to our direct marketing communications and activities (as mentioned in this privacy notice) for instance. There is an important difference between the right to object to profiling relevant to direct marketing in cases where that profiling activity does not have a legal effect on you or otherwise significantly affect you, and the separate right which exists under data protection laws in relation to profiling including automated decision making which has a legal effect or can otherwise significantly affect you (see below).
• The right to restrict processing of your personal information, for instance where you contest it as being inaccurate (until the accuracy is verified); where you have objected to the processing (where it was necessary for legitimate interests) and we are considering whether our organisation’s legitimate interests override your own; where you consider that the processing is unlawful (and where this is the case) and where you oppose erasure and request restriction instead; or where we no longer need the personal information for the purposes of the processing for which we were holding it but where you require us to continue to hold it for the establishment, exercise or defence of legal claims.
• The right to have your personal information erased (also known as the “right to be forgotten”). This enables an individual to request the deletion or removal of personal information where there is no compelling reason for its continued processing. This right is not absolute – it applies only in particular circumstances and where it does not apply any request for erasure will be rejected. It may be relevant where the personal information is no longer necessary in relation to the purpose for which it was originally collected/processed; if the processing is based on consent which you then withdraw; when you object to the processing and there is no overriding legitimate interest for continuing it; if the personal information is unlawfully processed; or if the personal information has to be erased to comply with a legal obligation. Requests for erasure may be refused in some circumstances such as where the personal information has to be retained to comply with a legal obligation or to exercise or defend legal claims.
• The right to request access to the personal information held about you, to obtain confirmation that it is being processed, and to obtain certain prescribed information about how we process it. This may assist if you wish to find out what personal information we do have about you in order to then determine if you can exercise other rights (those mentioned above and below).
• The right to data portability. This allows individuals to obtain and reuse their personal information for their own purposes across different services; to move, copy or transfer their personal information easily from one environment to another in a safe and secure way without hindrance to usability. This right can only be relevant where personal information is being processed based on a consent or for performance of a contract and is carried out by automated means. This right is different from the right of access (see above) and the types of information you can obtain under the two separate rights may be different. You are not able to obtain through the data portability right all of the personal information that you can obtain through the right of access.
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. This right allows individuals in certain circumstances to access certain safeguards against the risk that a potentially damaging decision is taken solely without human intervention. This right is different from the more general right to object to profiling (see above) because that other right is not tied to a scenario where there is a legal effect on you or where the processing otherwise significantly affects you. Data protection laws prohibit this particular type of automated decision making except where it is necessary for entering into or performing a contract; is authorised by law; or where you have explicitly consented to it. In those cases, you have the right to obtain human intervention and an explanation of the decision and you may be able to challenge that decision.
You have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk/
If you wish to exercise any of these rights against the Credit Reference Agencies, or a broker or other intermediary who is data controller in its own right, you should contact them separately.

DATA ANONYMISATION AND USE OF AGGREGATED INFORMATION
Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.

YOUR MARKETING PREFERENCES AND WHAT THIS MEANS
We may use your home address, phone numbers, email address and social media (e.g. Facebook, Google and message facilities in other platforms) to contact you according to your marketing preferences. This means we do this only if we have a legal ground which allows it under data protection laws – see above for what is our legal ground for marketing. You can stop our marketing at any time by writing to us at 22 The Hollow, Earl Shilton, Leicester LE9 7NB, by contacting either of our branches or by following the instructions on how to do that in any marketing email or other communication.

DATA PRIVACY NOTICES FROM OTHER ORGANISATIONS
We have mentioned that we share your personal information with Credit Reference Agencies. They require us to pass on to you information about how they will use your personal information to perform their services or functions as data controllers in their own right. These notices are separate to our own and will be made available when you apply to open a savings account, will be provided during the mortgage application process, may be viewed on the Society’s website www.esbs.co.uk and are also available on request by contacting either of our branches.

Earl Shilton Building Society Intermediary Online Application System Terms and Conditions

Thank you for your interest in registering for our Online Application System. Below you will find our Terms of Registration.

1. Intermediary Terms of Registration

1.1 It is important that you understand these Terms of Registration that apply to your use of our website to register as an Intermediary of Earl Shilton Building Society, whose Head Office is at 22 The Hollow, Earl Shilton, Leicester LE9 7NB. By using our website, you acknowledge that you have read, understood and agree to these Terms. These Terms outline the basis on which we accept Applications from you and govern the provision and use of our services. Please note that these Terms replace any previous Terms of Business between us.

1.2 Definitions

In these Terms the following expressions shall have the following meanings where the context otherwise requires:

“Application” means any and all applications for a Mortgage Product submitted by you on behalf of your client;

“Client” means the client (or clients where more than one client is applying) for whom you are processing the application;

“Customer” means any person(s) who has submitted or may submit a completed Application on the Online Application System through you;

“Data Protection laws and regulations” means all applicable legislation relating to data protection, the processing of personal data and privacy including (before 25th May 2018) the Data Protection Act 1998 and (with effect from 25th May 2018) the General Data Protection Regulation (EU) 2016/679, any legislation that in respect of the United Kingdom replaces or converts into domestic law the General Data Protection Regulation (EU) 2016/679 including is enacted as a consequence of the United Kingdom leaving the European Union, and all replacement, amending and implementing legislation;

“FCA” means the Financial Conduct Authority; and any successor organisation;

“Intellectual Property” means any patent, copyright, registered design, unregistered design right, trademark or other industrial or intellectual property owned or used by us together with any current applications for any registrable items of the foregoing;

“Mortgage Products” means mortgage products offered by us to customers from time to time;

“Payments” means any commission, charges or fees due to you from us in connection with applications;

“PRA” means the Prudential Regulation Authority;

”Services” means the services we provide to you in connection with applications;

”Terms” means these terms of business as amended, supplemented or novated from time to time;

“We”, “us”, “our” mean Earl Shilton Building Society;

”You” means the intermediary using our services and who has confirmed electronically that they accept these Terms.

2. Use of the Online Application System

2.1. The Earl Shilton Online Application System is owned and maintained by us. Use of the Earl Shilton Online Application System is subject to these Intermediary Terms;

2.2. You must be registered with us in accordance with these Intermediary Terms to use the Earl Shilton Online Application System;

2.3. If you are not an Intermediary, your Intermediary must give you authorisation to use the Earl Shilton Online Application System and have supplied us with your name;

2.4. Upon registration, you will be provided with a username and password. You will be able to change your password once you log-in to the Earl Shilton Online Application System;

2.5. You must at all times keep your username and password secure and prevent unauthorised use of the same. You must immediately notify us if you know or suspect of any unauthorised use of your username or password;

2.6. You must immediately inform us of any changes to the information provided to us in connection with your registration; including any changes to your email address;

2.7. The Earl Shilton Online Application System is only intended for the completion of applications for people resident in the United Kingdom;

2.8. We will ensure that the information provided on the Earl Shilton Online Application System complies with the Applicable Laws.

3. General

3.1. By applying to register as an Intermediary with us, you warrant and undertake that you have and will maintain the necessary and appropriate registrations, permissions and authorisations with the Financial Conduct Authority (FCA) to carry out business to advise on and arrange mortgages and will inform us immediately if those registrations, permissions or authorisations are cancelled, withdrawn or restricted by the FCA. You will at all relevant times maintain and shall comply with the requirements of all licences necessary for you to conduct business;

3.2. You shall effect and maintain a policy of professional indemnity insurance and provide us with a copy of your current professional indemnity insurance certificate on demand;

3.3. You will comply with our application process for mortgage sales as notified to you by us from time to time, including in relation to the use of our website and contact with our colleagues, and in line with the expectations of the FCA’s Consumer Duty;

3.4. You have not acted unlawfully in connection with the preparation or submission of the mortgage application;

3.5. You have provided an illustration to the customer which meets the requirements of the FCA in MCOB and are responsible for the contents of that illustration where it has not been produced by us;

3.6. You will immediately, in full and without amendment, pass any documentation and/or information passed to you from us or the customer to its intended recipient (e.g. to the customer or us) respectively;

3.7. You will process all personal data (as defined in the General Data Protection Regulation) relating to individuals strictly in accordance with the UK General Data Protection Regulation and obtain all appropriate authorisations from the customer to provide the information in the application and supporting documents to us. Earl Shilton Building Society shall be the controller of personal data about customers that has been gathered and collated for the purpose of us underwriting and administering a loan, and where you process such personal data on our behalf for these purposes, you shall act as a data processor. In doing so, you shall:

· process personal data only on our documented instructions, implement appropriate technical and organisational measures,

· not appoint sub-processors without our prior written consent,

· notify us without undue delay of any personal data breach,

· on termination, return or securely delete personal data as instructed, and

· make available information reasonably required to demonstrate compliance and cooperate with audits.

3.8. The Society may record telephone calls for training and monitoring purposes, when contacting the Society calls may be recorded;

3.9. You authorise us to process personal data about the directors, owners and employees of your firm for the purpose of administering the relationship between the parties including sharing this information with fraud prevention agencies. You warrant that you have the necessary consents/lawful basis from the directors, owners and employees to enable you to give this authorisation to us;

3.10. You will notify us in writing as soon as reasonably practicable if you receive any complaints in relation to mortgage advice, product pricing, or product performance relating to the sale of our mortgage products so that we can monitor such complaints and we can conduct any review as we deem necessary. You warrant that you will provide reasonable assistance to us in investigating any complaints made by customers;

3.11. You will not publish, circulate, issue or release, in any media, any advertisement, financial promotion or other literature relating to our mortgage products or make use of our name, logo or any of our intellectual property (any patent, copyright, registered design, design right, trademark or other industrial or intellectual property right whether register or not anywhere in the world) in any of their promotional activities without first receiving our written authorisation;

3.12. Where you conduct business through our websites, you agree that access to the websites will be governed by the terms of use provided by us;

3.13. Your company will be registered in the UK and you will only submit mortgage applications within the UK. We reserve the right at our sole discretion to decline all or any Applications and we are not required to give a reason for doing so;

3.14. We are not obliged to accept any application for a mortgage, or to offer a further mortgage to a customer at the end of the term of a mortgage product;

3.15. We may be required to report (MCOB regulated lending only) to the FCA and/or the PRA the basis on which business is conducted between you and the customer. You acknowledge and accept that we will treat business as being conducted on an “advised” basis unless you tell us otherwise when you submit the Application;

3.16. If we are not satisfied (acting reasonably) that you have complied with the applicable FCA rules, you shall allow us reasonable access to your offices, records (including extraction and copying facilities) and staff to investigate our concerns;

3.17. Nothing in these terms of registration is intended to, or shall be deemed to, establish any partnership or joint venture between you and us, constitute you the agent or representative of us or authorise you to enter into any commitments for and on behalf of us. You are not and may not purport or hold yourself out to be our agent unless specifically authorised in writing by us. You will not sign or amend any documents or policies on our behalf nor make any statements or promises or representations of any kind whether written or oral which bind or purport to bind us. You will not hold yourself out as having authority to make any such representation;

3.18. Any commission due to you from us in respect of any application will be paid to the operator of your Principal firm, or it will be paid via a mortgage club nominated by you in the application where we are on the mortgage club’s panel and have an arrangement to pay the commission via the mortgage club. We will not enter into any discussion or correspondence with you regarding the payment of any fees which may be due to it. We will pay you directly where you are Directly Authorised and have not nominated a mortgage club in which case we will need your up to date bank details;

3.19. Where you charge a fee to your customer for advice, we will need a full explanation if this is over 1% of the loan amount, or if the fee is over £750, whichever is the greater;

3.20. These terms of registration will be governed by and construed in accordance with the laws of England and subject to the exclusive jurisdiction of the English courts. You will comply with all applicable laws and regulations, including (but not limited to):

· The FCA’s Principle for Business and in particular the Mortgages and Home Finance: Conduct of Business sourcebook (MCOB), Consumer Duty, guidance for Treating Customers Fairly and Conduct Risk and all other relevant parts of the FCA’s Handbook of Rules and Guidance;

· the Money Laundering Regulations 2007 and the Bribery Act 2010; and

· the Data Protection Act 2018, (All as amended or replaced from time to time).

4. Your Duties

4.1. You warrant and represent that you will obtain the Customer’s authorisation to be their agent prior to submitting an Application to us and you acknowledge that you may not submit Applications without such authorisation from the customer;

4.2. Hold all relevant legal, regulatory, and other authorisations necessary for carrying out your business and for referring Applications to us;

4.3. Will conduct your business in accordance with the requirements of all relevant laws, regulations and rules of the FCA and or PRA including without limit the FCA and/or PRA handbooks (and all regulations made thereunder) and any applicable guidance issued by the FCA and/or PRA from time to time and will not by your acts or omission do anything to cause us to be in breach of the same or to cause an unfair relationship pursuant to Section 140A of the Consumer Credit Act to arise;

4.4. Will comply with all applicable codes of practice;

4.5. Will act diligently and in good faith in all your dealings with us and the customers; and (without limiting the foregoing) have disclosed to each customer all payments;

4.6. You will receive from us in respect of that customer’s Application and obtained the customer’s informed consent to such payments;

4.7. You will comply in full with all policies and procedures relating to Applications as we advise you of from time to time, and will only submit Applications in accordance with said policies and procedures and will attend and complete any training on the same as required by us from time to time;

4.8. During completion of an Application, you will make the customer aware of all declarations and statements that you make on your behalf and explain key information throughout the Application that will affect the customer. You will provide the customer with a copy of our Privacy Notice when you first capture his or her personal data with a view to sharing it with us and you will explain in particular with reference to our Privacy Notice about our use of their personal data and the effects of credit scoring and credit checks which may be undertaken by us in order to process an Application;

4.9. You will maintain the confidentiality of any username and password used by you in our system;

4.10. Act honestly and professionally and to use all due skill and care when acting for the customer, including (but not limited to) ensuring that the Application is suitable for the customer in cases where you advise on the same;

4.11. Use best endeavours to ensure that information provided to us is true, accurate and complete in all material respects;

4.12. Keep all details of customers up to date.

4.13. You agree to inform us immediately in writing if:

· You cease to act on behalf of a customer;

· Any of your authorisations, registrations or permissions needed to conduct all or part of your business lawfully are not current or are believed to be in jeopardy or if you are the subject of any enforcement action by the FCA and/or PRA;

· You become aware of any unauthorised use of any username or password;

· You become aware or believe that any information provided in or as part of an Application is or may become untrue or incomplete or inaccurate including without limitation having regard to the Data Protection laws and regulations; or

· You commit a material breach of any relevant laws or regulations or these Terms including without limitation the Data Protection laws and regulations.

5. Confidentiality and Data Protection

5.1. You will not divulge to any third party any documents or materials of any kind containing information we have identified as confidential information or which relates to our business or affairs or those of any of our subsidiaries or affiliates or associated companies;

5.2. Some or all of the information supplied to us in connection with an Application will comprise Personal Data (as defined by the Data Protection laws and regulations);

5.3. Where it is required, in connection with these Terms that we are relying on consent, you will obtain the client’s consent to such use of their personal data (including without limitation if they wish to consent to receiving direct marketing communications);

5.4. For the avoidance of doubt, we will use personal data supplied to us by or on behalf of a client for the purposes detailed in our Privacy Notice;

5.5. We and you confirm to each other that we are listed on the ICO Register and each agrees at all times to comply with the provisions of the Data Protection laws and regulations. You will not by your act or omission cause Us to be in breach of the Data Protection laws and regulations;

5.6. You acknowledge and agree that you are our Data Processor when you input personal data about any client into our mortgage portal and otherwise use our mortgage portal including but not limited to when you update data fields for accuracy upon notice from the client of a change in his details and accordingly when processing the personal data for the aforementioned purposes: For details of how and why personal data is processed in relation to clients that you submit through the mortgage portal please refer to our Privacy Notice (https://www.esbs.co.uk/privacy-notice/).

6. Dispute Resolution Procedure

6.1. Save that nothing in this clause 6 will prevent a party from taking any actions under these Terms or otherwise in relation to the recovery of debts, in the first instance, disputes which may arise between the parties in connection with other matters under these Terms shall be dealt with and determined as follows:

6.2. Each party shall nominate a representative who will be authorised to deal with the management, negotiation and settlement of any dispute arising under or in connection with this Agreement (“Nominated Representative”). Each party may change the identity of its Nominated Representative at any time during the term of this Agreement or in the absence of its Nominated Representative appoint another representative (“Alternative Nominated Representative”);

6.3. Each party shall refer any dispute that arises under or in connection with these Terms to its Nominated Representative (or Alternative Nominated Representative) appointed in accordance with clause 6.2, who shall be responsible for the escalation of the dispute within that party’s organisation and shall notify the other party’s Nominated Representative (or Alternative Nominated Representative) in writing of the reason for the dispute. Any such notifications shall include a summary of the salient details of the relevant dispute (“Dispute Notice”);

6.4. The Nominated Representatives shall meet within ten (10) Business Days of receipt of the Dispute Notice from the relevant Nominated Representative (or Alternative Nominated Representative) in order to agree a resolution or action(s) required by each party in order to resolve the dispute;

6.5. If any dispute has not been settled and / or a course of action for its settlement has not been agreed within twenty-one (21) days of the date of the Dispute Notice, each Nominated Representative (or Alternative Nominated Representative) shall procure that an alternative senior representative (“Alternative Senior Representative”) shall meet in order to agree to a resolution of such dispute on one separate, further occasion. The parties shall procure that any such meeting takes place as soon as reasonably practicable, taking into account the timescale in which the matter in dispute should be resolved so as not to impede the performance of this Agreement; and

6.6. If the dispute, considered by the Alternative Senior Representatives, is not resolved to the satisfaction of both the parties within fourteen (14) days of it being referred to them, the dispute shall be finally resolved by the courts of England.

6.7. All periods specified in clauses 6.1- 6.6 shall be extendable by written agreement of the parties.

6.8. Each party shall act in good faith in its attempts to resolve its dispute with the other party.

7. Liability and Indemnities

7.1. Nothing in these Terms shall exclude or limit the liability of either party:

· for fraud, fraudulent misrepresentation, bribery, deceit, dishonesty;

· for death or personal injury resulting from its negligence; or

· in respect of any other liability which cannot be excluded or limited by Applicable Laws.

7.2. Nothing in this Agreement shall exclude the liability of either party for:

· deliberate misconduct; or

· any breach of Confidential Information, Intellectual Property, or Data Protection)

7.3. Subject to clause 7.1, each party excludes liability to the other for any indirect, special, incidental or consequential loss or damage, loss of profit, business, revenue, goodwill and anticipated savings howsoever arising in respect of these Terms.

7.4. Subject to clause 7.1, a party’s maximum liability to the other under this Agreement whether in contract, tort, restitution or otherwise shall not exceed £1,000,000 in the aggregate except in relation to payment or repayment of Procuration Fees between the parties to these Terms.

7.5. Neither party shall be liable for any failure or delay in performing its obligations under this Agreement if and to the extent that such failure or delay is the result of a Force Majeure Event.

7.6. Nothing in this clause 7 will be taken as in any way reducing or affecting a general duty upon a party to mitigate any loss suffered by it.

8. Force Majeure (extraordinary or unforeseeable events that prevent someone from fulfilling a contract).

8.1. The parties shall not be liable for any breach of their obligations, acts or omissions hereunder resulting from a Force Majeure Event. Where a Force Majeure Event arises, the party whose obligations are suspended by virtue of the Force Majeure Event shall use all reasonable endeavours to mitigate the effect of such circumstances and to carry out such obligations or duties hereunder in such other way as may be reasonably practicable in all the circumstances.

8.2. The parties agree to give notice to each other as soon as is reasonably practicable after first becoming aware of a Force Majeure Event, such notice to contain details of the circumstances giving rise to the Force Majeure Event.

8.3. In the event of a party receiving notice from the other pursuant to clause 8.2, both parties shall within ten (10) Business Days of the notice jointly determine what measures, if any, can be put in place to prevent the occurrence (where possible) or mitigate the effect of the Force Majeure Event.

8.4. If a default due to a Force Majeure Event shall continue for more than four (4) weeks after expiry of the period provided for in clause 8.3, the party not in default shall be entitled to no longer be bound by these Terms by giving written notice to the other. The parties shall have no liability to each other in respect of the termination of the Terms between them as a result of a Force Majeure Event, but rights and liabilities which have accrued prior to termination shall subsist.

9. Termination

9.1. Either party may terminate the agreement on these Terms by giving notice to the other;

9.2. Any termination by us shall be without prejudice to any other remedies that we may be able to pursue against you, including in respect of accrued rights;

9.3. Upon termination, you will not proceed any further with any Application and shall cease all promotion of our business or the Mortgage Products; return to Us as soon as reasonably practicable any property belonging to us and be entitled to any unpaid Payments accrued to the date of termination but shall forfeit entitlement to all other Payments falling due after the date of termination;

9.4. We may terminate the agreement on these Terms with immediate effect on the occurrence of any one or more of the following:

· Any material breach by you or any person or body for which you are responsible of any of the provisions contained within these Terms;

· Any misconduct by you, any of your directors or partners, or any person or body for which you are responsible which is or could be reasonably viewed as prejudicial to our business or reputation;

· You are no longer properly authorised, you are fined or penalised by the FCA or PRA, your business stops or is suspended (or is likely to stop or be suspended), or we reasonably believe that your ability to meet your obligations is significantly affected.

· Your obligations under these Terms; or material litigation, insolvency, or reconstruction involving you (including any of your partners if you are a partnership) including (without limitation) bankruptcy, dissolution, sequestration, administration, winding up, or seizure of assets or entry into any arrangement or composition with creditors.

Privacy Policy

PRIVACY NOTICE

YOUR PERSONAL INFORMATION AND WHAT WE DO WITH IT

Terms and Conditions

Earl Shilton Building Society Intermediary Online Application System Terms and Conditions