1. Who are we?

We are Carbon Finance Limited, a company registered in the UK with company number 11517060. We operate in the UK under the brand Carbon and trade via this website https://www.carbonfinance.co.uk. We are authorised and regulated by the Financial Conduct Authority (FRN 827288) as a credit broker and we are registered with the Information Commissioner's Office (registration number ZA477716).

We are the data controller in relation to the processing of the personal information that you

provide to us when using our website and services. Personal information is information specific to you, including, but not limited to, your name, address, date of birth, income and online identifiers, for example, the IP address from which you connect to the internet. We take your privacy very seriously and it is important that you read and understand this privacy policy, which details how we collect, use and manage your personal information when you use our service.

Please note that this privacy policy should be read in conjunction with our terms and conditions and our cookie policy. It is important to understand that these three documents are only relevant to your use of Carbon's website and services. Should you leave our website, for example by clicking on a link which takes you to the website of any third parties we work with or include links to, you will need to read their equivalent documents to understand how they are collecting and using your personal information and the terms and conditions associated with the usage of their websites and services.

Back to top

2. How can you contact us?

If you have any queries relating to our use of your personal information, if you want to contact our Data Protection Officer or if you have any other related privacy questions, please send us a message by selecting the appropriate options our contact us page or write to us at:

The Data Protection Officer Carbon Finance Limited 4th Floor Market Square House St. James's Street Nottingham NG1 6FG

Back to top

3. What does our service do?

The Carbon service allows you to compare various financial options that exist when you are looking to a buy a used car with finance. In order to provide this service, you will need to provide us with your personal information. How our service works broadly is described below. Note that this description summarises the key points and more detail may be included within later sections of this privacy policy:

  • We will collect personal information from you via various means and store it within our secure UK based data centre
  • We may share the personal information with three types of third party:
    1. Technical service providers who, under our instructions, assist in the provision of our service to you
    2. Credit reference agencies ("CRAs")
    3. Providers of the financial products ("Providers")
  • CRAs will provide us with your credit report data and in doing so will record a "soft search" (sometimes referred to as a "quotation search"), which means the record of that search will not be visible to other third parties and cannot impact your ability to obtain credit in the future. This credit report data will be used by us to calculate your eligibility and personal rate of interest for certain products on our panel
  • Providers will use your information in order to determine your eligibility for their products and your personal rate of interest. In order to do this, they themselves may share your data with CRAs (who will always record a "soft search") to obtain your credit report data
  • Once we have calculated or obtained your eligibility and your personal rates of interest for all products on our panel, we will present these results back to you along with relevant information to help you understand them. This will include products for which you are not eligible for or where we have been unable to obtain or calculate a result for any reason
  • We may also send you your product results via email so that you have for future reference
  • If you wish to apply for any of the products displayed, you will need to click on the relevant link and you then will be redirected to the respective Provider's website to complete your application
  • In some cases, on clicking the link we will provide the Provider with your personal information to facilitate the application process. Alternatively, we may provide the Provider with a reference number associated with the result they provided us following our original sharing of your personal information with them. This will allow them to locate your details in their own databases and proceed with your application more efficiently if you wish to do so
Back to top

4. How do we collect your personal information?

We collect your personal information in various ways. These are listed below:

  • When you submit online forms - there are several forms on our website which are used to collect personal information. These include the one that collects the personal information required for us to provide our main service and one that allows you to contact us, for example if you have a complaint or request regarding the personal information that we hold on you
  • When you e-mail or send us paper mail - when you email us at one of the email addresses provided on our website or you send us mail at the provided postal address
  • When you browse our site - when you browse our website, we will collect personal information regarding items such as, your IP address, computer equipment and other browsing actions and patterns
  • When we receive personal information from third parties - when we share your personal information from third parties, they will return to us further personal information on you such as your credit report data or your eligibility for their products
  • When we read information held in cookies we have placed on your device - these cookies allow us to do a range of things including improving your experience when using our website. More information on cookies and how we use them is contained in our cookie policy
Back to top

5. What personal information do we collect?

Below is a description of the various types of personal information we collect along with a brief description of how we use it. More detail around how we use your personal information is discussed in a later section of this privacy policy:

  • Identity information - this includes your name and date of birth and is required so that ourselves and other third parties we share your personal information with are able obtain your credit report data from the CRAs, which can affect your eligibility and personal rate of interest for the products on our panel
  • Residency information - this includes your current address as well as a previous address if you have resided at your current address for less than three years. As is the case for identity information this data is needed in order to obtain your credit report data from the CRAs. We also need to understand your current residential status, for example whether you are a homeowner. This is needed as it can affect your eligibility and personal rate of interest for the products on our panel
  • Financial information - including your annual income, employment status, monthly rent or mortgage costs and the number people that are financially dependent on you. These are needed as they can affect your eligibility and personal rate of interest for the products on our panel
  • Contact information - including your email address and occasionally your telephone number. These are required so that we can communicate your results to you or so that our Providers can contact you should you wish to proceed with an application. It also allows us to communicate with you when you contact us directly regarding any matter
  • Borrowing requirements information - including what type of vehicle you are looking at buying or the amount you are looking to borrow and over what time period. These are needed as they can affect your eligibility and personal rate of interest for the products on our panel. They also allow us to tailor the product results to your actual needs
  • Technical information - including the IP address you are using to connect to the internet, your browser, your device's operating system, where your visit to our site originated from, for example, via a google search or a partner's site and your behaviour when using our site, for example, which pages you visited, which products you clicked on which web page elements you did or did not interact with. These are needed to allow us to understand how users interact with our site so we can make improvements to our service. They also allow us to understand the performance of our marketing campaigns

If you are providing us with another individual's personal information, before doing so you should ask them to read this privacy policy, as well as our terms and conditions and cookie policy. By giving us personal information about another individual you are confirming that they are happy for you to provide their personal information to us and that they understand how it will be used.

It is important you provide accurate personal information and failing to do so limits our ability to provide you our service and is likely to result in you seeing invalid product results such as incorrect personal rates of interest and eligibilities. Note that it is your responsibility to check and ensure that all personal information you provide on to us is correct, complete, accurate and not misleading.

Back to top

6. How do we use your personal information?

We will only use your personal information where there is a valid lawful basis for us to do so and we currently rely on the following three lawful bases for all our processing:

  • Contract - this is where we are required to process your personal information in order to fulfil on a contractual obligation, for example when you use our main service after agreeing to our terms and conditions
  • Legal obligation - sometimes we are required to process your personal information in order to comply with a common law or statutory obligation, for example as a result of a court order or a regulatory obligation
  • Legitimate interests - this is where we process your personal information for our legitimate or for the legitimate interests of the third parties we work with. We may do this providing such processing does not outweigh your rights and freedoms. Where the lawful basis we are relying for processing on is legitimate interests, you have the right to object at any time

Below is a list of the ways we use your personal information alongside the lawful basis we are relying on in each case.

  • To enable us to provide you with your product results, including your eligibility and your personal rate of interest for each of them

    Lawful basis relied upon: Contract

    Description: When you provide us with your personal information and agree to our terms and conditions, we are agreeing to provide you with our service. This is ultimately the provision of information around which products from our panel you could be eligible for and your personal rates of interest. To perform this service, we will be sharing your personal information with third parties for them to provide us with these product results and we will be making automated decisions using the personal information we collect from you and the third parties we work with to calculate additional product results

  • To enable us to communicate with you after you contact us, with either an enquiry regarding the personal information we hold on you, or a complaint

    Lawful basis relied upon: Legal obligation

    Description: When you contact us to either, make a request regarding personal information we hold on you, or to make a complaint, we are legally bound to deal with those communications in a certain manner that may require processing of your personal information

  • To enable us to communicate with you after you contact us regarding anything other than those matters covered in the previous point

    Lawful basis relied upon: Legitimate interests

    Description: If you contact us for reasons other than those regarding any personal information that we hold on you or to make a complaint, we will communicate with you which may involve processing your personal information

  • To enable us to communicate your product results to you after you use our service

    Lawful basis relied upon: Legitimate interests

    Description: When we provide you with product results after you engage with our main service, we may email those results to you shortly afterwards. This allows you to reference them a later time without the need to come back to the website

  • To enable us to proactively communicate changes to this privacy policy

    Lawful basis relied upon: Legitimate interests

    Description: If we make significant changes to this privacy policy, we may email you to make you aware of those changes

  • To perform data analysis and testing for the purposes of improving our website and service

    Lawful basis relied upon: Legitimate interest

    Description: We may analyse the personal information we collect for the purposes of improving our website and services, for example to determine whether the addition of extra Providers on our panel could improve the overall level of service we can provide

  • To perform data analysis as part of the administration of our business affairs

    Lawful basis relied upon: Legitimate interest

    Description: We may share your information with third parties for the purposes of tracking outcomes if you apply for their products, which allows us to complete certain administrative process, for example raising and reconciling invoices

  • To optimise our advertising efforts

    Lawful basis relied upon: Legitimate interest

    Description: We may use information regarding your visit to our site to create audiences for remarketing purposes via other third-party platforms such as Google and Facebook. This practise helps us to improve the relevance of any marketing material issued by us. We rely on cookies to carry out this activity and more information is included in our cookie policy

Back to top

7. Who do we share your information with?

To provide our service to you we may need to share your personal information with third parties. However, we will only do so once we are comfortable those third parties maintain high standards when it comes to the security of your personal information and we have contacts in place with them all, which obliges them adhere to data protection regulation. Furthermore, we will never share your personal information with third parties for their own marketing purposes.

A full list of the third parties we may share your personal information with is included in the below table which details the following information

  • Third party name - the name of the third party
  • Third party role - the role of the third party with respect to the processing of your personal information. This will be either data processor or data controller. A data processor essentially acts purely under our instruction. A data controller on the other hand determines how they use your data independently of us, details of which will be included in their privacy policy
  • Privacy policy link - for data controllers, where it has been explicitly provided to us a link to the third party's privacy policy is included. If a link is not provided, you are encouraged to locate and read the relevant privacy policy before using our service
  • Notes - any other relevant notes regarding the third party
Third party name Third party role Link to third party's privacy policy Notes
Micro­soft Corpo­ration Data processor Not applicable Our website, services and databases are hosted within the Microsoft Azure data centre
Equifax Inc. Data controller Click here Equifax are a CRA and supply us with your credit report data
Shaw­brook Bank Limited Data controller Click here This company is a Provider of lending products on our panel and trades under the name "Shawbrook Bank"
Lendable Ltd Data controller Click here This company is a Provider of lending products on our panel and trades under the name "Lendable"
Bamboo Limited Data controller Not provided This company is a Provider of lending products on our panel and trades under the name "Bamboo"
Admiral Financial Services Ltd Data controller Not provided This company is a Provider of lending products on our panel and trades under the name "Admiral"
Evolution Funding Ltd Data controller Click here This company is a Provider of lending products on our panel and trades under the name "Evolution Funding Ltd"
Zopa Bank Limited Data controller Not provided This company is a Provider of lending products on our panel and trades under the name "Zopa"
Money­barn No.1 Limited Data controller Not provided This company is a Provider of lending products on our panel and trades under the name "Moneybarn"
Back to top

8. Where do we keep your personal information and how do we keep it secure?

All the personal information that we collect on you is stored in databases on servers within a secure data centre in the UK.

The security protecting your personal information includes:

  • Physical security - the actual servers are located within a data centre that has a walled perimeter which is monitored at all points 24/7. It also has specific access points that allows entry to authorised individuals only for a limited time period
  • Technical security - access to the servers by unauthorised users is prevented via the use of firewalls and authentication processes

When your personal information is being transmitted over the internet, for example when we are collecting your personal information via one of the forms on our website or sharing it with third parties, we will always ensure that this is done in an encrypted fashion.

When communicating with us, you should not provide us with any personal information unless we have specifically requested it. As part of this communication we may contact you by email. You should keep your email account secure.

Back to top

9. Will you transfer my personal information outside the European Economic Area ("EEA")?

Although we store all your personal information within our data centre in the UK, we may share it with third parties. Those third parties may be based outside of the EEA or may themselves transfer your personal information outside of the EEA.

If we need to transfer your personal information to a third party who is based outside the EEA, we will ensure that appropriate safeguards and protections are in place as stated under UK law, for example by using a data transfer agreement incorporating certain standard model protection clauses which have been approved by the European Commission or, in the case of a US based third party ensuring they have signed up to the EU-US Privacy Shield.

If you would like to know more around whether the third parties that we share your personal information with will themselves transfer your personal information outside the EEA, please refer to their respective privacy policies.

Back to top

10. How long do we keep your personal information for?

Unless we are required by law, we will keep your personal information for no longer than 6 years from the date we collected it or until you ask us to delete it.

We may share your personal information with third parties who become data controllers with respect to it. Please see the relevant section of this privacy policy for more details of who these third parties are and refer to their own privacy policies if you would like to understand how long they will keep your personal information for.

If you delete or ask us to delete your personal information it may persist as part of our system backups for legal, tax or regulatory purposes.

Back to top

11. Do we do automated decision making?

Automated decision making is, in essence, a computer program that can use various pieces of information about you to make a decision, without the need for human intervention or support. It is a useful practise as it helps ensure decisions can be made quickly and in the same repeatable manner for all individuals. Such automated decision making is required for us to be able to provide our service to you.

We may use automated decision making, using your personal information in combination with that collected from CRAs, to calculate your eligibility and personal rate of interest for certain products, or to determine whether to share your personal information with our third party Providers for them to calculate and return to us your eligibility and personal rate of interest for their products.

You have the right not to be subject to a decision based solely on automated processing. If you have any questions about automated decision making, please contact us via the form on the contact us page

The third parties we share your personal information with may themselves perform automated decision making and you are encouraged to refer to their privacy policies if you require more information around that processing or if you would like to exercising your right to object to them using automated decision making

Back to top

12. Do we use cookies?

A cookie is a small text file which is placed on your computer or device when you visit our website (and most other websites).

We do use cookies, which are useful, and amongst other things help us to:

  • Understand how people engage with our website over time, which in turn allows us to continually improve it
  • Understand how many visitors we have to our website and which pages they use
  • Ensure that people have a consistent experience when they visit our website on different occasions

For more information on the cookies we use, please see our cookie policy

Back to top

13. What are your personal information rights?

As part of the data protection legislations, you have certain rights around the personal information we hold on you. To exercise any of these rights please use the form on the contact us page. Please select the "data request" option on the form to ensure that your enquiry is identified as such and dealt with promptly.

These rights are listed below along with a brief description of what we will do if we receive a request from you.

  • Right of access - you have the right to obtain a copy of your personal information and other supplementary information we hold on you. Depending on the nature of your request we may need you to supply us with more information in order to help us verify your identity before we are able to disclose any personal information
  • Right of rectification - you have the right to have inaccurate personal information rectified or to have incomplete personal information completed. If we believe that the personal information is already accurate and / or complete, we will not make any changes to it and will let you know how we arrived at that decision in our response
  • Right to erasure - also referred to as the "right to be forgotten", you have the right to have any personal information we hold on you to be deleted. In some exceptional circumstances the data protection legislation overrides this right. If these are relevant to your request, we will inform you in our response
  • Right to object - you have the right to object to our use of your personal information including where we use it for our legitimate interests or where we use automated decision making or perform profiling. If you raise an objection, we will stop processing your personal information unless very exceptional circumstances apply, in which case we will let you know why we're continuing to process your personal information
  • Right to restrict processing - you have the right to limit the way that we use your personal information where you have a specific reason for requesting that limitation. For example, if you have concerns that the personal information that we hold on you is inaccurate or you have concerns around how we have been processing your data
  • Right to data portability - you have the right to receive your personal information provided to us in a structured, commonly used and machine-readable format. You may also have the right to have this information transferred directly to a third party

We will respond to any requests to exercise these rights within one month unless the request is complicated, in which case we will let you know that it may take longer than one month for us to respond.

If you are not satisfied the way we have handled any request regarding your personal information, then you may be able to refer the matter to the relevant data protection regulator which in the UK is the Information Commissioner's Office.

Back to top

14. Changes to this policy

We will update this policy from time to time and any changes will be posted on this page. The date of the most recent changes will also appear on this page. In the event we make a significant change, or changes, which affects how we use your personal information, we will contact you by email. If you do not agree with any changes we make, please do not continue to use our website.

Where we are required by law, we will obtain your consent before making any changes.

Last updated: 25th June 2019

Back to top