Data Protection at Haven Mortgages

GDPR is the General Data Protection Regulation. It comes into effect from 25 May 2018. It sets out a series of new EU laws concerning how data is processed and used. The objective of the regulation is to strengthen and standardise data protection laws for all EU citizens. These regulations will apply to any organisation that controls and/or processes data on behalf of an individual or group of individuals. Those responsible for adhering to these regulations include employees of the organisation, including contractors, consultants, agents and third parties who have access to data either directly or indirectly.

When we talk about “AIB”, or “us” or “we” on our Data Protection Notice and this website, we are talking about Allied Irish Banks, p.l.c. and its subsidiaries, affiliates and their respective parent and subsidiary companies (including AIB, EBS, Haven and Goodbody).

We share your information within AIB Group to help us provide our services, comply with regulatory and legal requirements, and improve our products.

We have always appreciated your trust in us to collect, process and protect your information. As a data controller and processor of your personal data, we will continue to

• develop on our strong risk culture by acting responsibly and putting your security at the front of our priorities;
• manage our controls, processes and systems to continue improving our level of customer service while providing you with the assurance that your information is safe and secure; and
• conduct our business in a fair and transparent way and ensure we minimise the risk of unfair outcomes for our customers or impact on their data rights and freedoms.

Our Data Protection Notice and website explains how we collect personal information about you, how we use it and how you can interact with us about it.

Our Data Protection Officer oversees how we collect, use, share and protect your information to ensure your rights are fulfilled. You can contact our Data Protection Officer at DPO@aib.ie or by writing to them at Data Protection Officer, 10 Molesworth Street, Dublin 2,  D02 R126.

We collect personal information from you, for example when you:

• apply for a product;
• when reviewing your credit facility or a facility you have a connection to; or
• look for advice.

Further information on how we collect information online is detailed on our Privacy Policy Statement.

We will sometimes record phone conversations and we will always let you know when we do this.

We may source information about your assets or loans from reliable third party sources. For example, when you apply for a loan against a property, we will collect the energy rating information about the property from an online register (e.g. SEAI).

If you are a sole trader, or in a business partnership, we may also collect information about your company from your website(s). An example of this could be where we collect Environmental, Social and Governance information from your company’s published sustainability report. 

Our websites use 'cookie' technology. A cookie is a little piece of text that our server places on your device when you visit any of our website. They help us make the sites work better for you. Further information is available on our Cookie Policy.

When you apply to us for a product and during the lifetime of this product, we carry out information searches and verify your identity. We do this by sending and receiving information about you to and from third parties including credit reference agencies, and/or credit registers including the Central Credit Register. We and these agencies/registers may keep records of our searches whether or not the product goes ahead.

We share your information within AIB Group to help us provide our services, comply with regulatory and legal requirements, and improve our products.

For example, the European Banking Authority’s guidelines on Loan Origination and Monitoring require us to have a single, consistent view of our borrowers’ assets and liabilities throughout the AIB Group. When assessing and monitoring loans, we will access a Single Customer View of accounts our customers may have across the AIB Group, including AIB (ROI and UK), EBS and Haven. European Banking Authority’s guidelines on connected clients requires that we take a holistic view of customer connections for assessing connected facilities and exposures.  Your data may be used in the assessment of another AIB Customer where there is a customer connection. The account information that’s available will help us to more efficiently assess applications for new credit facilities, for example new loans or credit cards, as well as support our ongoing review of credit arrangements.

The Group entity you are engaging with remains the controller of your information and will facilitate you exercising any of your data protection rights. The Group entities together act as joint controllers for the Single Customer View and Connect Clients.

We use information about you to:

• provide relevant products;
• identify ways we can improve our products;
• maintain and monitor your products;
• When assessing or reviewing your facilities in respect of yourself or whether part of a connection to other customers;
• protect your interests; and
• decide and recommend how our products and services might be suitable for you

To provide our products under the terms and conditions we agree between us, we need to collect and use personal information about you. If you do not provide this personal information, we may not be able to provide you with our products and services.

The European Banking Authority’s guidelines on Loan Origination and Monitoring require us to have a single, consistent view of our borrowers’ assets and liabilities throughout the AIB Group. When assessing and monitoring loans, we will access a Single Customer View of accounts our customers may have across the AIB Group, including AIB (ROI and UK), EBS and Haven. European Banking Authority’s guidelines on connected clients requires that we take a holistic view of customer connections for assessing connected facilities and exposures.  Your data may be used in the assessment of another AIB Customer where there is a customer connection.  The account information that’s available will help us to more efficiently assess applications for new credit facilities, for example new loans or credit cards, as well as support our ongoing review of credit arrangements.

We analyse the information that we collect on you through your use of our products. This helps us understand your financial behaviour, how we interact with you and our position in a market place. Examples of how we use this information include helping protect you from financial crime, offering you products and services, personalising your experience and meeting our regulatory requirements.

All of our processing must be supported by a lawful basis, as discussed in our Meeting our legal and regulatory obligations section below.

To meet our regulatory and legal obligations, we collect some of your personal information, verify it, keep it up to date through regular checks, and delete it once we no longer have to keep it. We may also gather information about you from third parties to help us meet our obligations. 

When you apply to us for products and services, and during the time you use these, we carry out information searches and verify your identity. We share your information with credit reference agencies and/or credit registers including the Central Credit Register (CCR).

When you enter into a credit agreement with us, this data is registered on to the CCR database. Each month CCR receives an update for each open account. This builds up a credit history which indicates how you are meeting the repayment terms of any credit agreements you may have.

When you apply for credit from us, we may access the CCR's database to get your credit report. You may have loans from more than one member and your credit report will include details of all registered loans, open and closed. Credit agreements are retained on the CCR database for five years after they are completed.

Equally, you may not have any credit history in the cases where you have not borrowed previously, or any credit agreements have been closed for more than five years.

Central Credit Register (CCR)

The CCR was established by the Credit Reporting Act 2013 and is operated by the Central Bank of Ireland. It collects and stores personal and credit information on credit agreements of €500 or more for products such as loans, credit cards, overdrafts and mortgages. The aim of the CCR is to provide greater protection and promote greater financial stability by providing lenders with comprehensive information to support credit assessments.

When you apply for credit from us or enter into a credit agreement with us of €500 or more, this information will be reported to the CCR and then updated monthly while the credit agreement remains in place. Information sent to the CCR also includes your Personal Public Services Number (PPSN) or Tax Reference Number (TRN) which is collected to enable the CCR to complete accurate customer identification. From 30 September 2018, if you apply for credit from us of €2,000 or more, we are required by law to make an enquiry to the CCR about your credit history. Information about your credit agreements will remain on the CCR database for five years after the agreement ends.

Further information on the CCR is available at www.centralcreditregister.ie or www.aib.ie/ccr or by calling 01 2245500. You can also send a specific query to consumerinfo@centralcreditregister.ie.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment.

If you do not provide the information we need, or help us keep it up to date, we may not be able to provide you with our products and services.

Sometimes we need your consent to use your personal information. For example, when we use sensitive personal information (known as ‘special category information’ under GDPR) about you, such as medical data, we ask for your explicit consent

We have controls to ensure that you are informed when making your decision and that you are aware that you can remove your consent at any time by contacting us. Our consent requests are built on the following principles:

• Positive Action - Clear affirmative action is required. We will no longer use pre-ticked boxes, imply or assume consent in the event of no positive action from you.
• Free will – Your consent must be freely given and not influenced by external factors.
• Specific – We will be clear on what exactly we are asking your consent for.
• Recorded – We will keep a record of your consent and how it was obtained.
• Can be withdrawn at any time – We will stop data processing requiring your consent at any time you make valid request.

We protect your information with security measures under the laws that apply and we meet international standards. We keep our computers, files and buildings secure.

In addition to our technical controls, our Data Protection Officer oversees how we collect, use, share and protect your information to ensure your rights are fulfilled. Our Data Protection Officer advises on how we can best understand risks to your data rights and freedoms, implemented processes to protect these and has responsibility to report to the Data Protection Authorities if we are not meetings our obligation.

When you contact us to ask about your information, we may ask you to identify yourself. This is to help us protect your information.

Sometimes we share your information with third parties.

For example to:

• provide products;
• analyse information;
• research your experiences dealing with us;
• collect debts;
• sell your debts;
• sell whole or part of our business;
• prevent financial crime;
• help trace, investigate and recover funds on your behalf;
• trace information; and
• protect both our interests.

Third parties we share information with can include:

• Estate agencies
• Credit reference agencies and/or registers including the Central Credit Register
• Fraud prevention agencies
• Company search databases
• Regulatory bodies including the Data Protection Commissioner and the Central Bank of Ireland
• Companies we have a joint venture or agreement to work with
• Insurance companies
• Government bodies including Revenue (Further information on tax reporting is available on our Group website)
• Businesses that introduce you to us or we introduce you to
• Transaction processing
• Market research companies
• Financial advisors
• Investment managers
• Debt collection agencies
• External consultancy firms including Legal, Accountancy, Compliance and other Professional Services
• Any entity you request your data to be shared with

We require that these third parties provide sufficient guarantees that the necessary safeguards and controls have been implemented to ensure there is no impact on your data rights and freedoms.

We also have to share information with third parties to meet any applicable law, regulation or lawful request. When we believe we have been given false or misleading information, or we suspect criminal activity we must record this and tell law enforcement agencies, which may be either in or outside Ireland.

We may transfer your personal information outside of the European Economic Area (EEA) to help us provide your products and services such as where we share information with service providers in the United States or India. We will only transfer your information outside of the EEA where expect the same standard of data protection applies or appropriate safeguards are in placeis applied outside of the EEA to these transfers and the use of the information, to ensure your rights are protected. This may include;

• transfers to countries approved by the European Commission as having an adequate level of protection
• use of appropriate safeguards such as Binding Corporate Rules or Model Contractual Clauses
• transfers in line with the derogations for specific situations set out in Article 49 of the GDPR.

For more information on how you can exercise your rights please refer to our Data Protection Rights section here.

Whenever you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information.

Your right to obtain information cannot adversely affect the rights and freedoms of others. Therefore, we cannot provide information on other people without consent.

We generally do not charge you when you contact us to ask about your information. Under GDPR, if a request is deemed excessive or manifestly unfounded, we may charge a reasonable fee to cover the additional administrative costs or choose to refuse the requests.

You can change your mind wherever you have given us your consent, such as for processing your sensitive information, e.g. medical data. By contacting us at 0818 565 500, you can request that we no longer process data we require your consent for.

If you have a complaint about the use of your personal information, please let a member of staff know, giving them the opportunity to put things right as quickly as possible. If you wish to make a complaint you may do so by phone, in writing and by email. We will fully investigate all the complaints we receive. You may complain through our contact centre, our website, by phone, or by email. We ask that you supply as much information as possible to help us resolve your complaint quickly.

You can also contact the Office of the Data Protection Commissioner in Ireland on the below details:

• Visit their website www.dataprotection.ie.
• Email info@dataprotection.ie
• Phone on +353 (0)57 8684800
• Write to Data Protection Office, Canal House, Station Road, Portarlington, Co. Laois, R32 AP23. Or 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland.

Please see explanations below of some of the data protection terms used on this website.

Consent – of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Data Controller – is a natural or legal person, public authority, agency or other body who determine the purpose and means of the processing - of personal data, where the purposes and means of such processing are determined by Union or Member State law.  AIB are considered a data controller, as they process personal data on behalf of both their customers and their employees.

Data Processor – in relation to personal data, means any natural or legal person (other than an employee of the data controller), public authority, agency or another body who processes personal data under the direction of, and on behalf of a data controller. AIB is considered a data processor, as they process personal data on behalf of Third Parties. Additionally, Third Parties engaged by AIB to process personal data are considered data processors.

Data Protection Officer – The Data Protection Officer oversees how we collect, use, share and protect information.

Data Protection Regulation – means all legislation, regulation and applicable codes of practice relating to the processing, protection and privacy of personal data.

General Data Protection Regulation (‘GDPR’) – is a regulation intended to strengthen and unify data protection for all individuals within the European Union (‘EU’). The aim of the GDPR is to reinforce data protection rights of individuals and facilitate the free flow of personal data. It applies to all data controllers and processors established in the EU, as well as those established outside the EU that process the data of EU citizens. 

Lawful basis - Processing of data is lawful only if and to the extent that at least one of the following applies:

1. Personal data processing is necessary to enter into or perform a contract with a data subject;
2. There is a legal obligation to the data controller for the personal data processing;
3. AIB Group or our Third Parties have a legitimate interest in processing the data. This legitimate interest cannot over-ride the interests or fundamental rights of the data subject;
4. The data subject has provided consent to the processing of his or her personal data for one or more specific purposes;
5. Personal data processing protects the vital interests of the data subject; or
6. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Location Data – means any data processed indicating the geographical position of the terminal equipment of a user, including data relating to:

1. The latitude, longitude or altitude of the terminal equipment;
2. The direction of travel of the user; or
3. The time the location information was ‘recorded'

Personal Data/ Data Subject – is any data relating to an identified or identifiable natural person (‘data subject’), who may be identified from the data either on its own (directly) or in conjunction with other data (indirectly), in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing – means obtaining, recording or holding the information or data, whether or not by automated means, or carrying out any operation or set of operations on the information including:

1. Collection of data
2. Organisation, adaption or alteration of the information or data
3. Retrieval, consultation or use of the information or data
4. Disclosure of the information, or data by transmission, dissemination or otherwise making available, or
5. Alignment, combination, blocking, erasure or destruction of the information or data

Recipient – means a natural or legal person, regulator, agency or another body, to which the personal data are disclosed, whether a Third Party or not. The processing of those data shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Special Categories of Personal Data – is data which relates to:

1. Racial or ethical origin, political opinions or religious or philosophical beliefs
2. Trade union membership
3. Biometric data (We may collect voice, facial or fingerprint information to identify data subjects)
4. Physical or mental health
5. Sexual Life/Orientation
6. Genetic data

Supervisory Authority – means an independent public authority which is established by a Member State. In the Republic of Ireland the Office of the Data Protection Commissioner (‘ODPC’) and in the UK the Information Commissioner’s Office (‘ICO’) are the public authorities established to monitor the application of Data Protection Law.