align box align box

Privacy Notice



Chorley and District Building Society of Key House, Foxhole Road, Chorley, Lancashire, PR7 1NZ is a data controller of your personal information. This relates to information that is about you or from which we can identify you. We are registered with the ICO register under registration number Z5708404. A Data Controller determines the way your personal information is processed and this privacy notice explains how and why we do so. When we use terms such as we, us and our in this notice, we mean Chorley and District Building Society.

Our Data Protection Officer can be contacted if you have any queries about this privacy notice or wish to exercise any of the rights mentioned in it by writing to Key House, Foxhole Road, Chorley, Lancashire PR7 1NZ or by email to DPO@chorleybs.co.uk

This privacy notice may be updated from time to time. You should check this page regularly so that you can read the up to date version.


Have you been introduced to us by a broker or other intermediary?


Our products and services are available through our own branches and on our own website as well as through professional and financial advisors and anyone else who acts as a person sitting in between you and us in relation to what we do for you. In this notice we will call these persons “brokers and other intermediaries”.

If you are using brokers and other intermediaries, our privacy notice only applies to the processing of your personal information that they may do on our behalf. You should receive a separate privacy notice from these brokers and other intermediaries where they are acting as a data controller of your personal information.


What do we mean by processing your personal information?


When we refer to process or processing, this includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting, destroying, or transferring it overseas (if applicable).

The processing we do will depend on the products or services you apply for and obtain from us.


Personal information that we generally process in connection with all our products and services


We will use the personal information we collect about you to:

This includes:

  • Your full name and contact details;
  • Your address and address history;
  • Your date of birth;
  • Your nationality;
  • Information which is relevant for your residency and/or citizenship status, such as your length of residency in the UK and/or whether you have the permanent right to reside in UK;
  • Your financial details, such as your salary, income and expenditure and where necessary details of your other income and assets;
  • Your marital status, family and lifestyle if relevant to the product;
  • Information about your employment status including whether you are employed, retired or receive benefits;
  • Information about your tax position;
  • The purpose for obtaining for the products or services you are applying for;
  • Records of how you have contacted us and, if you get in touch with us online, details such as your mobile phone location data, IP address and MAC address;
  • Personal information which we obtain from fraud prevention agencies (see the section on fraud prevention agencies below);
  • Some special categories of personal data such as about your health if you are a vulnerable customer; and
  • Whether you hold a prominent public function (or if you are a family member or known close associate of such a person).

  • Additional personal information that we process in connection with a mortgage


    This includes:

  • Details about all of your existing borrowings and loans;
  • Information about your occupier status.
  • Your credit history which we obtain from Credit Reference Agencies (see the section on Credit Reference Agencies below); and
  • Details of any unspent criminal convictions and offences

  • Joint applicants, guarantors, powers of attorney and other third parties


    If you make a joint application with your spouse, partner or family member, or they are a guarantor, giftor, or other third party, we will also process the personal information mentioned above about that person. It is important that they are given the opportunity to read and understand this privacy notice.


    What is the source of your personal information?


    We will generally collect your personal information from you directly. If you are introduced to us by a broker, or other intermediary, we will obtain some personal information about you indirectly from them when they introduce you to us.

    Some personal information is obtained from Credit Reference Agencies and this will have originated from publicly accessible sources. Credit Reference Agencies draw on court decisions, bankruptcy registers and the electoral register (also known as the electoral roll). We explain more about Credit Reference Agencies below.

    In addition, where applicable we obtain your personal information from other sources such as fraud prevention agencies, your employer, landlord, other lenders, publically available directories and information (e.g. telephone directory, social media, internet, news articles), other organisations to assist in prevention and detection of crime, police and law enforcement agencies.


    What are the legal grounds for our processing of your personal information (including when we share it with others)?


    Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organisations). For some processing more than one legal ground may be relevant (except where we rely on consent). Here are the legal grounds that are relevant to us:

    1) Processing necessary to perform a mortgage or savings contract with you or for taking steps prior to entering into it (during application stage):

    a) Administering and managing your account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and in the case of mortgages doing this for recovering debt;

    b) Sharing your personal information with other payment services providers such as when you ask us to share information about your account with them;

    c) All stages and activities relevant to managing your account including enquiry, application, administration and management of accounts.

    2) Data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Where we consider that, on balance, it is appropriate for us do so, processing necessary for the following legitimate interests which apply to us and in some cases other organisations (who we list below) are:

    a) Administering and managing your account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and in the case of mortgages doing this for recovering debt;

    b) To test the performance of our products, services and internal processes;

    c) To carry out monitoring and to keep records (see below);

    d) To administer our good governance requirements such as internal reporting and compliance obligations or administration required for AGM processes;

    e) For market research and analysis and developing statistics;

    f) For direct marketing communications;

    g) When we share your personal information with these other people or organisations;


  • Your guarantor (if you have one on any mortgage account you hold);
  • Joint account holders, trustees and beneficiaries and any person with power of attorney over your affairs (in each case only if relevant to you);
  • Other payment services providers such as when you ask us to share information about your account with them;
  • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
  • The broker or other intermediary who introduced you to us;
  • Our legal and other professional advisers, auditors and actuaries;
  • Financial institutions and trade associations;
  • Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme;
  • Tax authorities who are overseas for instance if you are subject to tax in another jurisdiction we may share your personal information directly with relevant tax authorities overseas (instead of via HMRC);
  • Other organisations and businesses who provide services to us such as back up and server hosting providers, IT software and maintenance providers, our Valuer Panel Management Partner, our Legal Services Partner, our Fraud Prevention Agency, our chosen mail and print house, our Mortgage Indemnity Guarantee (MIG) provider and suppliers of other back office functions;
  • Buyers and their professional representatives as part of any restructuring or sale of our business or assets;
  • Credit Reference Agencies see below where we explain more and refer to a separate leaflet to more information; and
  • Market research organisations who help us to develop and improve our products and services.

  • 3) Processing necessary to comply with our legal obligations:

    a) For compliance with laws that apply to us;

    b) For establishment, defence and enforcement of our legal rights;

    c) For activities relating to the prevention, detection and investigation of crime;

    d) To carry out identity checks, anti-money laundering checks, and checks with fraud prevention agencies pre-application, at the application stage, and periodically after that;

    e) To carry out monitoring and to keep records (see section below);

    f) To deal with requests from you to exercise your rights under data protection laws;

    g) To process information about a crime or offence and proceedings related to that (in practice this will be relevant if we know or suspect fraud); and

    h) When we share your personal information with these other people or organisations:

  • Your guarantor (if you have one on any mortgage account you hold);
  • Joint account holders, Trustees and beneficiaries, and the person with power of attorney over your affairs;
  • Other payment services providers such as when you ask us to share information about your account with them;
  • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
  • Fraud prevention agencies;
  • Law enforcement agencies and governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme (depending on the circumstances of the sharing); and
  • Courts and to other organisations where that is necessary for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.

  • 4) Processing with your consent:

    For some of our processing of special categories of personal data, such as about your health or if you are a vulnerable customer, we will process your information with your consent (and it will be explained to you when we ask for that explicit consent what purposes, sharing and use it is for).

    5) Processing for a substantial public interest under laws that apply to us where this helps us to meet our broader social obligations such as:

    a) Processing of your special categories of personal data such as about your health or if you are a vulnerable customer;

    b) Processing that we need to do to fulfil our legal obligations and regulatory requirements; and

    c) When we share your personal information with other people and organisations such as your relatives, social services, your carer, or the person who has power of attorney over your affairs.


    How and when can you withdraw your consent?


    Much of what we do with your personal information is not based on your consent, instead it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us using the details above. The consequence might be that we cannot take into account special categories of personal data such as about your health or if you are a vulnerable customer (but these outcomes will be relevant only in cases where we rely on explicit consent for this).

    To comply with Payment Services Regulations we have to share some of your personal information with other payment service providers in some circumstances, such as where you require us to cooperate with another bank or building society you hold an account with to help them recover a mistaken payment. We will obtain your consent to do this, however consent under the payment services regulations does not have the same meaning as consent under data protection laws, therefore if you were to withdraw your consent for us to process your personal information, as is your right under data protection laws, this may not apply to any processing of your information in accordance with the Payment Services Regulations.


    Is your personal information transferred outside the UK or the EEA?


    Data Protection law imposes restrictions on the transfer of personal data outside the European Union, to third countries or international organisations, to ensure that the level of protection of data is not undermined. The Society does not transfer your personal data outside the European Union.


    How do we share your information with credit reference agencies?


    In order to process your application, we will perform credit and identity checks on you with one or more Credit Reference Agencies (“CRAs”). Where you take banking services from us we may also make periodic searches at CRAs to manage your account with us. To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. We will use this information to:

  • Assess your creditworthiness and whether you can afford to take the product;
  • Verify the accuracy of the data you have provided to us;
  • Prevent criminal activity, fraud and money laundering;
  • Manage your account(s);
  • Trace and recover debts; and
  • Ensure any offers provided to you are appropriate to your circumstances.
  • We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

    When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

    If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link. The identities of the CRAs, their role as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the separate leaflet, Credit Reference Agency Information Notice (CRAIN). An electronic version of the CRAIN can be obtained from our chosen CRA, Equifax Ltd, at www.equifax.co.uk/crain


    How do we share your information with fraud prevention agencies?


    When we and the fraud prevention agencies process your personal information, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity in order to protect our business and to comply with the laws that apply to us. Such processing is also a contractual requirement of the mortgage and savings products we provide you.

    We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal information to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to six years.

    If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse or stop providing products or services to you.

    A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact the Society’s Data Protection Officer on the details above. Alternatively you can contact our chosen fraud prevention agency, Synectics Solutions Ltd of Synectics House, The Brampton, Newcastle under Lyme, Staffordshire ST5 0QY.


    Do you have to provide your personal information to us?


    If you do not provide us with your personal information, we are unable to process your application or provide you with our mortgage or savings products and services.


    Do we do any monitoring involving processing of your personal information?


    In this section monitoring means any listening to, recording of, viewing of, intercepting of, or taking and keeping records (as the case may be) of calls, emails, in person face to face meetings and other communications. We may monitor where permitted by law and we will do this where the law requires it. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or in person meetings (as relevant) we will do so.

    Some of our monitoring may be to comply with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.

    Some of our monitoring may check for obscene or profane content in communications.

    We may conduct short term carefully controlled monitoring of your activities on your account where this is necessary for our legitimate interests or to comply with our legal obligations, for instance, were we suspect fraud, money laundering or other crimes.


    Do you have to provide your personal information to us?


    We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). In the absence of specific legal, regulatory or contractual requirements, our standard retention period for records and other documentary evidence created in the provision of services is 6 years from the date that our contractual relationship ends.

    Where your application for an account does not proceed, any personal data will normally be retained for no longer than 3 months from the date your application is withdrawn or declined, in the absence of any other specific legal, regulatory or contractual requirements.

    If you would like further information about our data retention practices, please contact our Data Protection Officer.


    What are your rights under data protection laws?


    Under data protection laws you have the following rights. They do not apply in all circumstances and if you wish to exercise any of them we will explain at that time if they apply or not.

  • The right to be informed about the processing of your personal information. This privacy notice includes all of the information we are required to provide you under this right.
  • The right to request access to your personal information and obtain information on how we process it. Upon request, we will provide a copy of the personal information we hold on you. To action this right please complete the Society’s Data Subject Access Request form which is available electronically here.
  • The right to have your personal information rectified or corrected if it is incomplete or inaccurate. If we have disclosed your personal information to others, then where necessary we will also notify them of the change to your information.
  • The right to have your personal information erased. This right only applies where our processing of your information was unlawful, our processing is no longer necessary, we no longer have a legitimate interest to process your information, or where our processing is based on consent and you wish to withdraw that consent. The right to erasure does not apply if we are required to retain your information to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
  • The right to restrict the processing of your personal information. This means that we will continue to store your personal information but will not use it if; you believe that the information we hold relating to you is inaccurate and we are verifying the accuracy of it; we have processed your information unlawfully; we no longer need your personal information but you require us to keep it in order for you to establish, exercise or defend a legal claim; or you have objected to the processing of your personal information and we are assessing whether our legitimate grounds for processing override your rights.
  • The right to data portability. This means that you have the right to move, copy, or transfer your personal information from our IT environment to another in a safe and secure way, so that it can be reused for your own purposes across different services. This right is different to the right of access (see above) and you will not be able to obtain a copy of all of your personal information by exercising your right to portability. The right to portability applies to personal information that you have provided directly to us, where we process it based on your consent or for the performance of a contract, and where it is carried out by automated means (thereby excluding paper records).
  • The right to object to the processing of your personal information. You have the right to object to us processing your information on the basis of legitimate interests or for the purposes of direct marketing. We will stop processing your personal information unless we are able to demonstrate that we have compelling legitimate grounds for processing which override your rights, interests or freedoms or if processing is needed for the establishment, exercise or defence of legal claims.
  • The rights relating to automated decision making and profiling. Automated decision making is when a computer-based decision is made about you without a person being involved and profiling is where this is done to make predictions about you. We do not undertake any automated decision making or profiling activities with your personal information therefore these rights are not applicable.
  • You also have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk . For more details on all of the above rights, you can contact our Data Protection Officer.

    If you wish to exercise any of these rights against the Credit Reference Agencies, the fraud prevention agencies, or a broker or other intermediary who is data controller in its own right, you should contact them separately.


    Data anonymisation and use of aggregated information


    Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.


    Your marketing preferences and what this means


    Occasionally, we may provide you with information about other products and services offered by the Society. We do this only if we have a legal ground which allows it under data protection laws – see section on ‘What are the legal grounds for our processing of your personal information above for what is our legal ground for direct marketing. The Society does not share your data with any other organisation for marketing or promotional purposes.

    Your marketing preferences are obtained during the product application stage, however you may change your marketing instructions at any time by writing to us quoting your product account number.

    Please note, should you choose not to receive any direct marketing from us you will still receive all regulatory required mailings and, where you are an eligible member of the Society, notice of the Society’s Annual General Meeting.