Zopa Privacy Notice
This is the Privacy Notice for Zopa Limited and Zopa Bank Limited. When we mention "Zopa", "we", "us" or "our", we mean whichever one of Zopa Limited or Zopa Bank Limited that processed your personal data.
This Privacy Notice provides details of what information we collect from you, what we do with it, who we share it with and your rights in relation to it.
Last updated: 21 August 2019
- The Information we collect about you
- Using your information
- Sharing your information
- Credit reference agencies
- Fraud prevention agencies
- Overseas transfers
- Retaining your information
- Automated decisions and profiling
- Consequences of processing
- Your rights
- How to contact us or make a complaint
- Consequences of not providing us with your personal data
- Keeping your information safe
- About Zopa
- Changes to this Privacy Notice
1. The information we collect about you
The types of personal data that we collect and process about you will depend on how you interact with Zopa and what Zopa products, if any, you use. The personal data we collect may include the following categories but will extend to any data relating to you that we process as a result of your interactions with Zopa:
|Contact and ID|
This information may come from:
- You, when you want to apply for any of our products e.g. when you apply for a loan (including if your application is declined), ask us to provide you with a personalised rate, or want to invest in our P2P lending platform
- The way you use your account, our website and online services
- Your other interactions with us, including information you may voluntarily share with us
- Credit reference agencies (who may check the information against other databases – public and private – to which they have access) or fraud prevention agencies
- Various third parties and other publicly available sources, e.g. we may buy or rent marketing lists from third parties, which contain the contact details of individuals (including you) to whom we can send marketing materials
2. Using your information
The UK's Data Protection law requires us to have a legal basis to use your personal data. We rely on one or more of the following reasons to use your personal data:
- To perform our contractual obligations under our agreement with you
- To comply with a law that we are subject to as a financial institution
- We have a legitimate interest in using your information which isn't outweighed by your interests, rights and freedoms
- You have given us your consent
We've set out in the table below how we use your personal data and the legal basis for using it:
|How we may use your information||Lawful basis for processing|
|To onboard and serve you as a customer: ||To perform our contractual obligations under our agreement with you: |
|To improve our business and products: ||Legitimate interest: |
|To protect our business: ||Legitimate interest: |
|To comply with laws and regulations: ||To comply with laws and regulations: |
|To provide an enhanced service: ||Legitimate interest: |
|Third Party Marketing: ||You have given us your consent.|
|To display advertising to you across the web We will process your data so that we can show you adverts for Zopa. We may do this as a result of you visiting Zopa’s website or if we think you might be interested in seeing these ads. See “Advertising” below for more details.||You have given us your consent.|
When you register with Zopa we'll give you the option to opt-out of receiving different categories of messages from us. These categories relate to letting you know about new products or launches, promote your existing products, and asking for feedback.
We only send these messages if there is something worthwhile to tell you about. If you don't want to receive these messages you can log into your account and change your "Profile/Contact" settings. Simply select what you want to hear about and how.
We’ll still send your messages relating to Zopa products you have where this is necessary to provide you with a good service. There also may be some messages that we're required by law or regulation to send you even if you ask us not to.
3. Sharing your information
We use a range of third parties to help us with our business. This means that we may have to share your information with third parties and they may have to share your information with us. These third parties include:
- Credit reference and fraud prevention agencies
- Our regulators or government authorities, for example the Financial Conduct Authority, the Financial Ombudsman Service and the police
- Collection agencies and lawyers to help us collect any money you owe us
- Third party service providers to support the running of our business: e.g. cloud data storage services and services to ensure data transfer and processing is secure
- Third parties to help us understand, improve and market our products
- Retailers from whom you've purchased goods or services using loans provided by us
- Anyone to whom we may transfer all or part of our assets whether in connection with an acquisition or as part of any insolvency
- In the event we need to stop running our business (in the unlikely event we become insolvent, or the P2P business is no longer viable), we may also share your information with a third party servicer who will service any loan back book (including working with borrowers and investors in our P2P platform) to enable us to wind down the business in an orderly manner. If we are unable to offer you a loan, to credit brokers or other lenders who may be able to arrange credit for you.
- If a borrower is unable to repay their loan, we may use the services of debt collection agencies
We won't disclose customer data to other Zopa customers unless it's necessary to enforce a loan contract between them. If you're an investor on our platform and we give you information about the loan customers you've lent to, you must only use it to discuss your loan contracts with us.
However, we make available certain transactional information (for example loan amount and repayment details) on an anonymised basis to the public. We will not be responsible for misuse of transactional data by others. We advise that you inform us promptly if you are the victim of any misuse of that information so we can investigate any such matter and prevent further misuse immediately.
4. Credit reference agencies
If you ask us to provide you with a personalised loan rate we'll supply your personal data to credit reference agencies (CRAs) and carry out a 'soft credit search' to establish your credit rating.
This is a preliminary credit check and will give us an overall view of your financial health (including your credit score) but not your full credit report. This will help us determine whether your application is likely to be successful and how much you can borrow and at what interest rate.
The CRAs will record our search but other lenders won't be able to see it and it won't affect your credit score.
It's only when you accept our offered quote that we will carry out a full search of your credit report. CRAs will supply to us both public (including electoral register) and credit, financial situation and financial history information and fraud prevention information about you and also any person that you share financial ties with (a joint current account or a joint mortgage, for example), this person is known as a ‘financial associate’.
We will use this information to:
- Assess your credit worthiness and whether you can afford to take the loan
- Verify the accuracy of the information you have provided us
- Prevent criminal activity, fraud and money laundering
- Manage your account
- Trace and recover debts
- Ensure any offers provided to you are appropriate to your circumstances
We'll go on sharing your personal data with CRAs for as long as you are a customer. We will also inform CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. They may also provide this information to other organisations including financial institutions who offer similar products to Zopa.
We do not provide joint loans, but if you tell us you have a financial associate (see above), we'll link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging this application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files a request with the CRAs to break that link.
As a general rule, we'll give you at least 28 days' notice if we decide to file a default on your credit reference file. However, we may not always give you notice beforehand, for example, if we plan to take court action.
If you are an investor or a prospective investor we may conduct searches with credit reference agencies to verify your identity and bank account details. Also, we may use data from credit reference agencies to supplement data you’ve provided to us for the purposes outlined below in “Automated Decision Making and Profiling”
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal data, data retention periods and your data protection rights with the CRAs are explained in the Credit Reference Agency Information Notice (CRAIN), which is available from each of the three CRAs-clicking on any of these three links will take you to the CRAIN document:
5. Fraud prevention agencies
If you give us false or inaccurate information or if we suspect or identify fraud we may record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention including law enforcement agencies.
We and other organisations may access and use this information to prevent fraud, money laundering or other criminal activity.
Fraud prevention agencies may hold your information for different periods of time, and if you're considered to be a fraud or money laundering risk, your information may be held for up to six years. It may also result in us and others refusing to provide services, financing or employment to you.
You can contact us at firstname.lastname@example.org if you'd like to know more about the credit reference and fraud prevention agencies we use. The fraud prevention agency we currently use is Cifas. We use Cifas to help prevent fraud, money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further information about how Cifas process your data can be found on their Fair Processing Notice.
6. Overseas transfers
We may transfer your personal data to countries outside either the UK or the European Economic Area (EEA), whose personal data protection laws are less strict than in the UK or the EEA.
Where we do so, we will make sure suitable safeguards are in place in accordance with data protection requirements, to protect your personal data. The safeguards we will use will depend on the circumstances and the third party who we transfer data to. The mechanisms we currently use extend to the EU Commission’s standard contractual clauses and in the case of transfers to the USA, Privacy Shield.
Whenever fraud prevention and credit reference agencies transfer your information outside the UK or the EEA, they will also ensure the transfer takes place in accordance with data protection laws.
7. Retaining your information
We will hold your information for as long as you have a relationship with us, e.g. you’ve applied to take out a product with us or you’re an existing customer with us. How long we’ll keep your information for once your relationship with us ends, e.g. we’ve declined your application, or you’ve closed your account, will depend on the type of information and the purposes for which we hold it.
We’ll retain information that helps us to:
- Comply with legal and regulatory requirements, e.g. anti-money laundering laws and laws that require us to keep details of transactions we’ve been a party to (loan repayments, investor payments)
- Establish, exercise and defend legal claims
- Prevent and detect fraud
- Pursue our (or a third party’s) legitimate interests, e.g. developing and improving credit risk models to help us make better lending decisions. For example, where you are a Zopa borrower, we will retain your data for analysis and also provide it to credit reference agencies so they can also use it for the purposes outlined in this bullet point
- Deal with future complaints regarding the services we’ve provided
- Maintain records of anyone who has opted out of receiving marketing material from us
- Maintain business records for analysis and audit purposes
8. Automated decisions and profiling
Occasionally we’ll make decisions relating to you by using automated decision making processes, including profiling, and without human involvement. The types of automated decision making include:
When you apply for a loan we'll use an automated process to decide whether to lend to you, i.e. we may make our decision without any human involvement. This helps us to make quicker lending decisions.
The process works by taking information you've provided when applying for the loan, any information we already have about you and information we obtain from third parties such as credit reference and fraud prevention agencies to calculate a credit score for you.
This information may include:
- How long you've lived at your address
- Your account history with us
- The number and type of credit agreements you have and how you've used them
- Whether you've been late making payments
- Whether you've had any court judgments made against you or whether you've been made bankrupt or had an IVA or other form of debt-related arrangement.
Using an automated credit scoring process means we may automatically decide that we are unable to offer you a loan, or only offer you a loan for a lower amount and/or shorter term that you requested.
Our credit scoring methods are regularly tested to ensure they remain fair, accurate and unbiased.
In addition to the original lending decision, if you’re an existing borrower and we think you may be interested in borrower additional sums (we call this a ‘top-up’), we’ll also use data about you to make an automatic decision on whether or not you’re eligible for additional lending.
We use automated processes to detect and help eradicate fraud.
We may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent activity, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity.
If we think there is a risk of fraud we may suspend your account and/or refuse you access to it.
Developing and marketing our products and services and finding new customers
We may use automated processing and profiling to help us develop products and services that would be of interest to existing and prospective customers, to manage your existing products and services to help you get the best out of them, and to provide you with marketing messages that we think you’ll be interested in. This automated decision making and profiling may mean us making changes to your current products and services or the way we communicate with you.
We may also use profiling to help us build up a picture of the kinds of people who are interested in Zopa products, to help us find other similar people as we think they’ll be more likely to be interested in Zopa products if they share traits with our existing customers. As part of this, we’ll also provide data to credit reference agencies to supplement our picture of you so we can better target new customers.
Your rights in relation to automated decision making
See "Your rights" below, for details about your rights in relation to automated decision making.
You can ask us to reconsider any declined decision by contacting us at email@example.com or by calling us on 020 7580 6060.
Like most businesses, we use advertising to let people know about our services and products. Our use of advertising can involve the use of ad networks which effectively enable potential advertisers to bid for the right to show advertising to you across the web. Part of this process involves the use of a range of data about you (location, gender, preferences and interests) to allow better targeting of adverts so you hopefully see adverts relevant to you. However it will mean that a large volume of data about you is shared with a vast number of third parties.
As a result, you may see adverts for Zopa across the web. This includes where you have visited our website (because we think that because you visited the Zopa website previously you may be interested in Zopa’s products).
If you see an advert for Zopa and also if you interact with the advert and come to Zopa’s website, we’ll also measure the effectiveness of adverts, including by assessing how long you spend on our site.
10. Consequences of processing
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide you with the services or financing you have requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk may be retained by fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us using the details above.
11. Your rights
Right to be provided with certain information
We must provide you with certain information at the time we collect your personal information, including how we use it and the legal basis for doing so, who we share it with, how long we intend to keep it, where we got the information from and your rights in relation to it. You find this information in this Privacy Notice.
Right to access your information
You can ask for a copy of the personal data we hold about you (and other information relating to it) unless providing some or all of it would adversely affect the rights and freedoms of others, or the law requires us not to comply with your request. You can access your personal data by emailing us at firstname.lastname@example.org or by calling us on 020 7580 6060. We aim to provide you with your information within 30 days.
Right to correction
You can ask us to correct any information which you believe is inaccurate. We'll update your information as soon as we can. You may need to provide supporting evidence before we can deal with your request; e.g. a copy of your marriage certificate if you want to update your name.
Right to erasure (‘right to be forgotten’)
You can ask us to erase your personal data:
- if you think it's no longer necessary for us to hold your information;
- if you don't think we have any legitimate grounds for processing it;
- if you think we're using your personal data unlawfully; or
if you think we should delete your personal data because the law requires us to do so.
Right to restrict processing
You can ask us to stop using your personal data:
- if you think it's inaccurate;
- if you think it's illegal for us to use it;
- if you don't want us to destroy it because you need it for legal proceedings;
- if you've told us we don't have a legitimate reason for using it and we're considering your request.
You can ask us to notify everyone to whom we've given your personal data whenever we amend, delete or agree to restrict our use of it.
Right to data portability
If we're using your information on the basis of your consent or because we need it to carry out our contractual obligations to you, you can ask us to give you your personal data in a structured, commonly used and machine-readable format or have it transmitted to another data controller.
Right to object
You have a right to object whenever we are using personal data on the basis of our legitimate interests (section 2 contains the ways in which we rely on legitimate interests to use your personal data).
Right to human intervention
When you apply for a loan we'll use an automated process to decide whether to lend to you. If we decline your application, you can ask one of our underwriters to review our decision.
We may not always be able to comply with your requests
There may be occasions when you wish to exercise one of your rights and we're unable to agree to your request, e.g. because we have compelling legitimate grounds for using your information, or because we need to keep your information to comply with a legal obligation.
Making requests to exercise your rights
You can send us your request by emailing us at email@example.com or by calling us on 020 7580 6060.
How to stop receiving marketing messages
If you no longer want to receive marketing messages you can log into your account and change your "Profile/Contact" settings. If you need help with this, please get in touch with our customer services at firstname.lastname@example.org.
12. How to contact us or make a complaint
If you have any further questions about data privacy at Zopa, or if you are unhappy with how we've handled your information you can contact us at:
The Data Protection Officer (DPO)
47-49 Tooley St
Or by email at: email@example.com If you are still unsatisfied you can refer your concerns to the Information Commissioner's Office, the body that regulates the handling of personal data in the UK, at:
Information Commissioner's Office
13. Consequences of not providing us with your personal data
You don't have to provide us with your personal data. However, we need your information partly because the law requires us to ask for certain details about you (for example, so we can verify your identify) and partly so that we can provide products and services to you.
This means that if you don't provide us with the information we ask for, we'll not be able to open an account for you.
14. Keeping your information safe
We take your privacy seriously and take every reasonable measure to keep your information secure. We monitor our systems 24/7 and continually work to improve the security of your personal data and our systems.
16. About Zopa
Zopa Bank Limited is a company incorporated in England & Wales under company registration number 10627575, . Our registered office at 1st Floor, Cottons Centre, Tooley Street, London SE1 2QG. We’re registered with the Information Commissioner with registration number Z879078. We’re also authorised and regulated by the Financial Conduct Authority and entered on the Financial Services Register under firm registration number 800542.
17. Changes to this Privacy Notice
We'll regularly review this Privacy Notice. If we make any changes, we'll post the updated policy on this page.
21 August 2019 Provided more detail about Zopa's fraud prevention measures, including our use of Cifas. Additional cosmetic changes following an internal review.
4 December 2018 We extended the policy to cover Zopa Financial Services Limited, which will launch as a bank next year.
1 December 2018 We added details of how our company is now structured and regulated now that we have a banking licence.
23 November 2018 Added contact details for our Data Protection Officer (DPO).
1 August 2018 We clarified our responsibility on overseas transfers.