Privacy
Calderdale Credit Union
Privacy Notice
Effective date: 1 October 2026
Last reviewed: 5 January 2025
Next review date: 30 September 2027
- About this Privacy Notice
Calderdale Credit Union is committed to protecting the privacy and security of your personal information.
This Privacy Notice explains how we collect, use, store and share your personal information when you become a member, apply for or use our products and services, contact us, or otherwise interact with Calderdale Credit Union.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
We aim to be transparent about how we use your information and to ensure that personal information is collected and used fairly, lawfully and only where necessary.
- Who is responsible for your personal information?
For the purposes of data protection law, Calderdale Credit Union is the data controller for the personal information we collect and use.
Our contact details are:
Calderdale Credit Union
15–19 Commercial Street
Halifax
HX1 1HJ
Telephone: 01422 386060
Email: admin@calderdalecreditunion.co.uk
If you have any questions about how we use your personal information, please contact us using the details above.
- What personal information do we collect?
Depending on your relationship with us and the products or services you use, we may collect and process information including:
- your name;
- date of birth;
- current and previous addresses;
- telephone numbers and email addresses;
- identification and verification information;
- membership information;
- savings and account information;
- loan and application information;
- income and employment information;
- financial information;
- information about your financial commitments;
- credit history and creditworthiness information;
- information obtained from credit reference agencies;
- information obtained from fraud prevention agencies;
- information relating to debt recovery;
- records of communications and interactions with us;
- information relating to complaints and queries;
- technical information, such as IP addresses and device information, where applicable; and
- Other information where we are legally required or permitted to collect it.
We will only collect information that is relevant and necessary for the purposes for which it is being used.
- How do we collect your personal information?
We may collect personal information:
- directly from you when you apply for membership or a product or service;
- when you contact us by telephone, email, online or in person;
- when you update your details;
- when you apply for a loan or other service;
- from credit reference agencies;
- from fraud prevention agencies;
- from debt recovery and tracing organisations;
- from publicly available sources and registers where permitted;
- from organisations that provide services to us or to you;
- from other organisations where this is necessary to provide a service or comply with a legal or regulatory requirement; and
- from other sources where we are legally permitted to obtain information.
- Where we obtain personal information from another organisation or source, we will provide you with appropriate privacy information where required by law.
- How we use your personal information
We use your personal information to operate the Credit Union, provide services to our members and meet our legal and regulatory responsibilities.
This includes the following purposes.
Membership and account administration
We may use your information to:
- establish and maintain your membership;
- confirm your identity;
- maintain our register of members;
- administer your savings and other accounts;
- process transactions;
- provide statements;
- provide information about your account;
- communicate changes to our products, services, terms and conditions;
- provide information about the Annual General Meeting and other member activities; and
- provide and administer other services available through the Credit Union.
Loan applications and lending
We may use your information to:
- consider and assess loan applications;
- assess affordability and creditworthiness;
- verify information you have provided;
- confirm your identity and address;
- assess your ability to repay borrowing;
- manage loans and repayments;
- monitor accounts;
- carry out credit and financial checks;
- make responsible lending decisions; and
- trace and recover outstanding debts.
Preventing fraud and financial crime
We may use your information to:
- prevent and detect fraud;
- prevent and detect money laundering;
- comply with financial crime legislation;
- verify your identity;
- identify suspicious or unusual activity;
- protect members and the Credit Union from financial crime; and
- assist law enforcement and fraud prevention organisations where appropriate.
Legal and regulatory requirements
We may process your information where necessary to:
- comply with legal and regulatory obligations;
- meet our responsibilities as a regulated credit union;
- comply with anti-money laundering and financial crime requirements;
- meet taxation requirements;
- respond to requests from regulators, government departments or law enforcement agencies;
- carry out internal and external audits;
- establish, exercise or defend legal claims; and
- protect the rights, property and interests of the Credit Union and its members.
Improving our services
- We may use information to:
- conduct member surveys;
- understand how our services are used;
- analyse statistical information;
- improve our products and services;
- monitor service quality and performance; and
- help us manage and develop the Credit Union.
- Where appropriate, we will use anonymised or aggregated information for statistical and analytical purposes.
Communicating with you
We may contact you to provide important information about your membership, accounts or services.
This may include:
- statements;
- information about your account;
- changes to terms and conditions;
- information about our services;
- regulatory or legal information;
- Annual General Meeting information; and
- other communications necessary to administer your membership.
Some communications are necessary for us to provide our services or meet our legal obligations and are not marketing communications.
- What is our legal basis for using your information?
Data protection law requires us to have a lawful basis for processing your personal information.
Depending on the circumstances, we may rely on one or more of the following lawful bases.
Contract
We may need to process your personal information because it is necessary to enter into or perform our contract with you.
For example, this includes administering your membership, savings account or loan.
Legal obligation
We may process your information where necessary to comply with a legal or regulatory obligation.
This includes requirements relating to financial crime, anti-money laundering, taxation, accounting, auditing and regulatory reporting.
Legitimate interests
We may process your information where this is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and freedoms.
This may include:
- managing and protecting the Credit Union;
- preventing fraud and financial crime;
- recovering debts;
- managing information security;
- improving our services;
- managing operational risks; and
- certain forms of direct marketing where permitted by law.
Where we rely on legitimate interests, we will consider whether the processing is necessary, proportionate and appropriate.
Consent
In some circumstances, we may ask for your consent before using your personal information.
Where we rely on consent, you have the right to withdraw your consent at any time.
Withdrawing consent does not affect processing that we have already carried out lawfully.
- Direct marketing
We may use your personal information to provide information about products, services or other activities that may be relevant to you.
Where required by law, we will obtain your consent before sending electronic direct marketing, such as marketing emails or text messages.
We will comply with applicable data protection and electronic marketing requirements.
You can ask us to stop sending you marketing communications at any time.
You can also withdraw your consent where consent is the legal basis for the marketing.
Your right to object to direct marketing is absolute.
- Who do we share your personal information with?
We may share personal information with other organisations where this is necessary, lawful and proportionate.
These may include:
- credit reference agencies;
- fraud prevention agencies;
- debt recovery and tracing organisations;
- law enforcement agencies;
- government departments and regulatory authorities;
- HM Revenue & Customs;
- auditors and professional advisers;
- insurers and organisations providing services or benefits connected with your account;
- IT and technology service providers;
- payment and banking service providers;
- organisations supporting identity verification;
- suppliers providing services to the Credit Union; and
- other organisations where we are required or permitted to disclose information by law.
Where another organisation processes personal information on our behalf, we will have appropriate contractual and security arrangements in place.
We do not sell your personal information.
- Credit Reference Agencies
When you apply for credit, we may obtain information about you from credit reference agencies (CRAs).
We may provide information to CRAs and receive information from them to:
- assess creditworthiness;
- assess affordability and product suitability;
- verify your identity;
- manage your account;
- prevent and detect fraud;
- prevent money laundering and other financial crime;
- trace and recover debts; and
- support responsible lending decisions.
We may continue to share information with CRAs during the life of a loan, including information about how you manage your borrowing and whether repayments are made on time.
CRAs may combine information supplied by us with information obtained from other organisations and publicly available sources.
This may include information about:
- your current and previous addresses;
- credit agreements;
- outstanding balances;
- repayment history;
- financial associations;
- previous names;
- insolvency and bankruptcy information;
- County Court Judgments;
- businesses you own or have owned or directed; and
- information relating to fraud.
Where you are financially linked to another person, such as through a joint financial arrangement, information held by CRAs may also relate to that financial association.
The credit reference agencies we currently use are:
TransUnion
www.transunion.co.uk/crain
Equifax
www.equifax.co.uk/crain
Experian
www.experian.co.uk/crain
The CRAs may retain information for up to six years after a credit agreement has ended, depending on the circumstances and their own retention policies.
- Fraud Prevention Agencies
We use information from and share information with fraud prevention agencies to help prevent and detect fraud, money laundering and other financial crime. These agencies could include NCA, Local Police or Local Authorites
Information shared may include:
- Your name;
- Your address;
- Your date of birth;
- Contact details;
- Financial information;
- Employment information;
- Device information, including IP address where applicable; and
- Other information where sharing is necessary and lawful for the prevention or detection of fraud or financial crime.
Fraud prevention agencies may use this information to identify and prevent fraud and other financial crime and may make information available to law enforcement agencies and other organisations where permitted by law.
Fraud prevention agencies may retain information for different periods depending on the circumstances. Where a fraud or money laundering risk is identified, information may be retained for up to six years.
If we or a fraud prevention agency determine that there is a fraud or financial crime risk, we may refuse an application or take other appropriate action in relation to existing services.
- Automated decision-making
Where we use automated processing or profiling as part of the administration or assessment of our products and services, we will comply with applicable data protection legislation.
Where a decision is made solely by automated means and has a legal or similarly significant effect on you, you may have rights in relation to that decision, including the right to obtain information about the decision, express your point of view, request human intervention and challenge the decision, where applicable.
If you have concerns about a decision involving automated processing, please contact us using the details in this Privacy Notice.
- Where we send your personal information
We primarily process personal information within the UK.
Some of our suppliers or service providers may process or access personal information outside the UK.
Where personal information is transferred outside the UK, we will ensure that the transfer is permitted under applicable UK data protection law and that appropriate safeguards are in place where required.
This may include transferring information to a country recognised as providing an adequate level of protection or using appropriate contractual or other safeguards.
- How long do we keep your information?
We will keep your personal information only for as long as it is reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and reporting requirements.
The length of time we keep information will depend on:
- the type of information;
- why we collected it;
- our relationship with you;
- legal and regulatory requirements;
- our contractual obligations;
- whether we need the information to establish, exercise or defend legal claims; and
- our legitimate business and risk-management requirements.
In some circumstances, we will need to keep information after you have left the Credit Union.
When personal information is no longer required, we will securely delete, destroy or anonymise it, subject to any legal or regulatory requirement to retain it.
- Keeping your information accurate
It is important that the personal information we hold about you is accurate and up to date.
Please tell us as soon as possible if your personal circumstances or contact details change.
You have the right to ask us to correct inaccurate or incomplete information.
- How we protect your information
We take appropriate technical and organisational measures to protect your personal information against:
- unauthorized access;
- accidental loss;
- destruction;
- misuse;
- alteration; and
- unauthorized disclosure.
Access to personal information is restricted to people who need it for legitimate business, operational, legal or regulatory purposes.
We also require appropriate security and confidentiality arrangements from organisations that process personal information on our behalf.
While no method of storing or transmitting information can be guaranteed to be completely secure, we regularly review and improve our information security arrangements.
- Your data protection rights
Depending on the circumstances and the lawful basis on which we process your personal information, you may have the following rights.
Right of access
You can ask for a copy of the personal information we hold about you. This is commonly known as a Subject Access Request (SAR).
Right to rectification
You can ask us to correct inaccurate or incomplete personal information.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
This right is not absolute and does not apply where we have a legal or legitimate reason to continue processing or retaining the information.
Right to restriction
In certain circumstances, you can ask us to restrict how we process your personal information.
Right to object
You may have the right to object to processing where we rely on legitimate interests.
You have an absolute right to object to the use of your personal information for direct marketing.
Right to data portability
In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format and to request that it is transferred to another organisation.
Right to withdraw consent
Where we rely on your consent, you may withdraw your consent at any time.
The availability of these rights depends on the circumstances and the legal basis on which we process your information.
- Making a data protection request
If you wish to exercise any of your data protection rights, please contact us:
Calderdale Credit Union
15–19 Commercial Street
Halifax
HX1 1HJ
Email: admin@calderdalecreditunion.co.uk
Telephone: 01422 386060
We may need to verify your identity before providing personal information.
There is normally no charge for exercising your data protection rights.
However, we may charge a reasonable fee where a request is manifestly unfounded or excessive, or where permitted by law.
We will normally respond to a valid Subject Access Request without undue delay and within one month. In certain circumstances, this period may be extended by up to a further two months where permitted by law. If we need to extend the period, we will explain why.
- Complaints about how we use your personal information
If you have concerns about how we have collected, used, stored or shared your personal information, please contact us using the details above.
We have a process for handling data protection complaints.
We will acknowledge a data protection complaint within 30 days and will investigate and respond to the complaint without undue delay, in accordance with applicable data protection requirements.
If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Further information about making a complaint is available from the ICO’s website.
- Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect:
- changes in legislation;
- regulatory guidance;
- changes to our services;
- changes to the way we process personal information;
- changes to our suppliers or technology; or
- Improvements to our privacy practices.
We will ensure that the latest version is available on our website.
Where changes are significant, we will take appropriate steps to bring them to your attention.
This Privacy Notice was last reviewed: 01 October 2026
Next review due: 30 September 2027
News
