- 1. Who are we?
- 2. How can you contact us?
- 3. What does our service do?
- 4. How do we collect your personal information?
- 5. What personal information do we collect?
- 6. How do we use your personal information?
- 7. Who do we share your information with?
- 8. Where do we keep your personal information and how do we keep it secure?
- 9. Will you transfer my personal information outside the European Economic Area ("EEA")?
- 10. How long do we keep your personal information for?
- 11. Do we do automated decision making?
- 12. What cookies do we use?
- 13. What are your personal information rights?
- 14. Changes to this policy
1. Who are we?
We are Carbon Finance Limited, a company registered in the UK with company number 11517060. We operate in the UK under the brand Carbon and trade via this website https://www.carbonfinance.co.uk. We are authorised and regulated by the Financial Conduct Authority (FRN 827288) as a credit broker and we are registered with the Information Commissioner's Office (registration number ZA477716).
We are the data controller in relation to the processing of the personal information that you
2. How can you contact us?
If you have any queries relating to our use of your personal information, if you want to contact our Data Protection Officer or if you have any other related privacy questions, please send us a message by selecting the appropriate options our contact us page or write to us at:
The Data Protection Officer Carbon Finance Limited 4th Floor Market Square House St. James's Street Nottingham NG1 6FGBack to top
3. What does our service do?
- We will collect personal information from you via various means and store it within our secure UK based data centre
We may share the personal information with three types of third party:
- Technical service providers who, under our instructions, assist in the provision of our service to you
- Credit reference agencies ("CRAs")
- Providers of the financial products ("Providers")
- CRAs will provide us with your credit report data and in doing so will record a "soft search" (sometimes referred to as a "quotation search"), which means the record of that search will not be visible to other third parties and cannot impact your ability to obtain credit in the future. This credit report data will be used by us to calculate your eligibility and personal rate of interest for certain products on our panel
- Providers will use your information in order to determine your eligibility for their products and your personal rate of interest. In order to do this, they themselves may share your data with CRAs (who will always record a "soft search") to obtain your credit report data
- Once we have calculated or obtained your eligibility and your personal rates of interest for all products on our panel, we will present these results back to you along with relevant information to help you understand them. This will include products for which you are not eligible for or where we have been unable to obtain or calculate a result for any reason
- We may also send you your product results via email so that you have for future reference
- If you wish to apply for any of the products displayed, you will need to click on the relevant link and you then will be redirected to the respective Provider's website to complete your application
- In some cases, on clicking the link we will provide the Provider with your personal information to facilitate the application process. Alternatively, we may provide the Provider with a reference number associated with the result they provided us following our original sharing of your personal information with them. This will allow them to locate your details in their own databases and proceed with your application more efficiently if you wish to do so
4. How do we collect your personal information?
We collect your personal information in various ways. These are listed below:
- When you submit online forms - there are several forms on our website which are used to collect personal information. These include the one that collects the personal information required for us to provide our main service and one that allows you to contact us, for example if you have a complaint or request regarding the personal information that we hold on you
- When you e-mail or send us paper mail - when you email us at one of the email addresses provided on our website or you send us mail at the provided postal address
- When you browse our site - when you browse our website, we will collect personal information regarding items such as, your IP address, computer equipment and other browsing actions and patterns
- When we receive personal information from third parties - when we share your personal information from third parties, they will return to us further personal information on you such as your credit report data or your eligibility for their products
5. What personal information do we collect?
- Identity information - this includes your name and date of birth and is required so that ourselves and other third parties we share your personal information with are able obtain your credit report data from the CRAs, which can affect your eligibility and personal rate of interest for the products on our panel
- Residency information - this includes your current address as well as a previous address if you have resided at your current address for less than three years. As is the case for identity information this data is needed in order to obtain your credit report data from the CRAs. We also need to understand your current residential status, for example whether you are a homeowner. This is needed as it can affect your eligibility and personal rate of interest for the products on our panel
- Financial information - including your annual income, employment status, monthly rent or mortgage costs and the number people that are financially dependent on you. These are needed as they can affect your eligibility and personal rate of interest for the products on our panel
- Contact information - including your email address and occasionally your telephone number. These are required so that we can communicate your results to you or so that our Providers can contact you should you wish to proceed with an application. It also allows us to communicate with you when you contact us directly regarding any matter
- Borrowing requirements information - including what type of vehicle you are looking at buying or the amount you are looking to borrow and over what time period. These are needed as they can affect your eligibility and personal rate of interest for the products on our panel. They also allow us to tailor the product results to your actual needs
- Technical information - including the IP address you are using to connect to the internet, your browser, your device's operating system, where your visit to our site originated from, for example, via a google search or a partner's site and your behaviour when using our site, for example, which pages you visited, which products you clicked on which web page elements you did or did not interact with. These are needed to allow us to understand how users interact with our site so we can make improvements to our service. They also allow us to understand the performance of our marketing campaigns
It is important you provide accurate personal information and failing to do so limits our ability to provide you our service and is likely to result in you seeing invalid product results such as incorrect personal rates of interest and eligibilities. Note that it is your responsibility to check and ensure that all personal information you provide on to us is correct, complete, accurate and not misleading.Back to top
6. How do we use your personal information?
We will only use your personal information where there is a valid lawful basis for us to do so and we currently rely on the following three lawful bases for all our processing:
- Contract - this is where we are required to process your personal information in order to fulfil on a contractual obligation, for example when you use our main service after agreeing to our terms and conditions
- Legal obligation - sometimes we are required to process your personal information in order to comply with a common law or statutory obligation, for example as a result of a court order or a regulatory obligation
- Legitimate interests - this is where we process your personal information for our legitimate or for the legitimate interests of the third parties we work with. We may do this providing such processing does not outweigh your rights and freedoms. Where the lawful basis we are relying for processing on is legitimate interests, you have the right to object at any time
Below is a list of the ways we use your personal information alongside the lawful basis we are relying on in each case.
To enable us to provide you with your product results, including your eligibility and your personal rate of interest for each of them
Lawful basis relied upon: Contract
Description: When you provide us with your personal information and agree to our terms and conditions, we are agreeing to provide you with our service. This is ultimately the provision of information around which products from our panel you could be eligible for and your personal rates of interest. To perform this service, we will be sharing your personal information with third parties for them to provide us with these product results and we will be making automated decisions using the personal information we collect from you and the third parties we work with to calculate additional product results
To enable us to communicate with you after you contact us, with either an enquiry regarding the personal information we hold on you, or a complaint
Lawful basis relied upon: Legal obligation
Description: When you contact us to either, make a request regarding personal information we hold on you, or to make a complaint, we are legally bound to deal with those communications in a certain manner that may require processing of your personal information
To enable us to communicate with you after you contact us regarding anything other than those matters covered in the previous point
Lawful basis relied upon: Legitimate interests
Description: If you contact us for reasons other than those regarding any personal information that we hold on you or to make a complaint, we will communicate with you which may involve processing your personal information
To enable us to communicate your product results to you after you use our service
Lawful basis relied upon: Legitimate interests
Description: When we provide you with product results after you engage with our main service, we may email those results to you shortly afterwards. This allows you to reference them a later time without the need to come back to the website
Lawful basis relied upon: Legitimate interests
To perform data analysis and testing for the purposes of improving our website and service
Lawful basis relied upon: Legitimate interest
Description: We may analyse the personal information we collect for the purposes of improving our website and services, for example to determine whether the addition of extra Providers on our panel could improve the overall level of service we can provide
To perform data analysis as part of the administration of our business affairs
Lawful basis relied upon: Legitimate interest
Description: We may share your information with third parties for the purposes of tracking outcomes if you apply for their products, which allows us to complete certain administrative process, for example raising and reconciling invoices
To optimise our advertising efforts
Lawful basis relied upon: Legitimate interest
8. Where do we keep your personal information and how do we keep it secure?
All the personal information that we collect on you is stored in databases on servers within a secure data centre in the UK.
The security protecting your personal information includes:
- Physical security - the actual servers are located within a data centre that has a walled perimeter which is monitored at all points 24/7. It also has specific access points that allows entry to authorised individuals only for a limited time period
- Technical security - access to the servers by unauthorised users is prevented via the use of firewalls and authentication processes
When your personal information is being transmitted over the internet, for example when we are collecting your personal information via one of the forms on our website or sharing it with third parties, we will always ensure that this is done in an encrypted fashion.
When communicating with us, you should not provide us with any personal information unless we have specifically requested it. As part of this communication we may contact you by email. You should keep your email account secure.Back to top
9. Will you transfer my personal information outside the European Economic Area ("EEA")?
Although we store all your personal information within our data centre in the UK, we may share it with third parties. Those third parties may be based outside of the EEA or may themselves transfer your personal information outside of the EEA.
If we need to transfer your personal information to a third party who is based outside the EEA, we will ensure that appropriate safeguards and protections are in place as stated under UK law, for example by using a data transfer agreement incorporating certain standard model protection clauses which have been approved by the European Commission or, in the case of a US based third party ensuring they have signed up to the EU-US Privacy Shield.
If you would like to know more around whether the third parties that we share your personal information with will themselves transfer your personal information outside the EEA, please refer to their respective privacy policies.Back to top
10. How long do we keep your personal information for?
Unless we are required by law, we will keep your personal information for no longer than 6 years from the date we collected it or until you ask us to delete it.
If you delete or ask us to delete your personal information it may persist as part of our system backups for legal, tax or regulatory purposes.Back to top
11. Do we do automated decision making?
Automated decision making is, in essence, a computer program that can use various pieces of information about you to make a decision, without the need for human intervention or support. It is a useful practise as it helps ensure decisions can be made quickly and in the same repeatable manner for all individuals. Such automated decision making is required for us to be able to provide our service to you.
We may use automated decision making, using your personal information in combination with that collected from CRAs, to calculate your eligibility and personal rate of interest for certain products, or to determine whether to share your personal information with our third party Providers for them to calculate and return to us your eligibility and personal rate of interest for their products.
You have the right not to be subject to a decision based solely on automated processing. If you have any questions about automated decision making, please contact us via the form on the contact us page
The third parties we share your personal information with may themselves perform automated decision making and you are encouraged to refer to their privacy policies if you require more information around that processing or if you would like to exercising your right to object to them using automated decision makingBack to top
A cookie is a small text file which is placed on your computer or device when you visit our website (and most other websites).
- Understand how people engage with our website over time, which in turn allows us to continually improve it
- Understand how many visitors we have to our website and which pages they use
- Ensure that people have a consistent experience when they visit our website on different occasions
13. What are your personal information rights?
As part of the data protection legislations, you have certain rights around the personal information we hold on you. To exercise any of these rights please use the form on the contact us page. Please select the "data request" option on the form to ensure that your enquiry is identified as such and dealt with promptly.
These rights are listed below along with a brief description of what we will do if we receive a request from you.
- Right of access - you have the right to obtain a copy of your personal information and other supplementary information we hold on you. Depending on the nature of your request we may need you to supply us with more information in order to help us verify your identity before we are able to disclose any personal information
- Right of rectification - you have the right to have inaccurate personal information rectified or to have incomplete personal information completed. If we believe that the personal information is already accurate and / or complete, we will not make any changes to it and will let you know how we arrived at that decision in our response
- Right to erasure - also referred to as the "right to be forgotten", you have the right to have any personal information we hold on you to be deleted. In some exceptional circumstances the data protection legislation overrides this right. If these are relevant to your request, we will inform you in our response
- Right to object - you have the right to object to our use of your personal information including where we use it for our legitimate interests or where we use automated decision making or perform profiling. If you raise an objection, we will stop processing your personal information unless very exceptional circumstances apply, in which case we will let you know why we're continuing to process your personal information
- Right to restrict processing - you have the right to limit the way that we use your personal information where you have a specific reason for requesting that limitation. For example, if you have concerns that the personal information that we hold on you is inaccurate or you have concerns around how we have been processing your data
- Right to data portability - you have the right to receive your personal information provided to us in a structured, commonly used and machine-readable format. You may also have the right to have this information transferred directly to a third party
We will respond to any requests to exercise these rights within one month unless the request is complicated, in which case we will let you know that it may take longer than one month for us to respond.
If you are not satisfied the way we have handled any request regarding your personal information, then you may be able to refer the matter to the relevant data protection regulator which in the UK is the Information Commissioner's Office.Back to top
14. Changes to this policy
We will update this policy from time to time and any changes will be posted on this page. The date of the most recent changes will also appear on this page. In the event we make a significant change, or changes, which affects how we use your personal information, we will contact you by email. If you do not agree with any changes we make, please do not continue to use our website.
Where we are required by law, we will obtain your consent before making any changes.
Last updated: 25th June 2019Back to top