Go to pepper group pages > Call 0818 866 666 Data Privacy Notice Data Privacy Notice To be our customer, you share information with us. At Pepper, your privacy is very important to us. Below is a guide to how personal data is managed by Pepper. If you prefer, you can open the Data Privacy Notice in a print ready format by clicking here. This is a guide to how personal data is managed by Pepper. Please read it carefully. 1. Introduction We are Pepper Finance Corporation (Ireland) DAC trading as Pepper Money and Pepper Asset Servicing (“Pepper”, “us”, ”we”, “our”). We are a member of the Pepper group of companies. Our principal activity, when trading as Pepper Money, is the provision of commercial mortgage loans. Our principal activity, when trading as Pepper Asset Servicing, is the management of Pepper loans or the provision of loan portfolio management/credit servicing to various investment companies, along with third party servicing activities. The purpose of this Data Privacy Notice is to explain how we, in our capacity as a data controller, collect and use your personal information. Personal information means information relating to a living individual who can be identified (either from that information itself or when combined with other information). We are a data controller in respect of the loans we own and a data processor in respect of our credit servicing activities. In relation to the latter, we may also be a data controller for a period after we stop servicing your loan where we retain personal information for the purposes of compliance with our regulatory obligations. Whether as a data controller or a data processor, we are committed to complying with Data Protection Law at all times. By “Data Protection Law” we mean the EU General Data Protection Regulation, the Data Protection Acts 1988 to 2018 and any other laws which govern the use of your personal data. 2. Why Pepper collects and uses your personal information We collect and process your personal information for a variety of reasons and we rely on a number of legal bases for doing so including: 2.1 To enter into and for the performance of a contract We process your personal information where it is necessary to enter into a contract with you for the provision of a product or service, to assess you for suitability for a product or service or to perform our obligations under a contract with you. This includes: Applications: We use personal information that you provide to us to process your application for a product or service from us and to decide on the terms upon which we can enter into a contract with you, for example, an application for a mortgage loan. Ongoing Product/Service Management: In order to manage any product or service provided, we have to process your personal information, for example, administration of a mortgage loan by processing payments, writing to you about the status of your loan, assessing your loan for an alternative repayment arrangement if you find yourself in financial difficulty and so on. As part of this management, we may be required to pass some of your personal information to an intermediary or counterparty (e.g. to take a payment by direct debit from your bank account we have to share your personal information with our bank). Continuing Performance: Where we may have acquired your loan from another lender, they will pass relevant information to us to allow for the continued performance of your contract. 2.2 To comply with legal obligations In certain circumstances, we must process your personal information to comply with legal obligations. These include: Assessing affordability and suitability for the provision of credit and throughout our relationship with you including analysing your credit data for regulatory reporting. Obtaining personal information from the Central Credit Register when considering credit or loan applications to assess affordability and suitability for the provision of credit, and providing information to the Central Credit Register about the performance of your loan agreement with us. Verifying personal information provided to us to prevent money laundering, financing of terrorism, tax avoidance, and/or fraud. For example, we may ask you for a proof of identity and/or a proof of address as part of our ongoing verification requirements in respect of Anti-Money Laundering legislation. Responding to queries raised by regulatory authorities, law enforcement and/or other government agencies such as the Data Protection Commission, the Central Bank of Ireland, An Garda Siochana, and the Revenue. Providing information requested in the context of a regulatory investigation or inspection. Delivering mandatory communications as required by legislation or regulations. Investigating and resolving complaints. Managing contentious regulatory matters, investigation and litigation. 2.3 Our legitimate business interests Your personal information will also be processed on the basis of our legitimate interests. Where it is processed on this basis, we ensure that there is a fair balance between our legitimate interests and your privacy rights. The following are some examples of when Pepper processes your personal information for legitimate business interests. Your personal information may not be processed in all cases and if it is, it will always be subject to measures to comply with Data Protection Law. To enable us to manage our relationship with you including having readily available access to your information through use of IT systems and functionality. To monitor, maintain and improve internal business processes, information, technology and communications that may benefit you or Pepper. To ensure business continuity and disaster recovery and to respond to information technology and business incidents and emergencies. To ensure adequate network and information security and fraud prevention protections are in place. To undertake system testing, for example, prior to implementing system improvements. For internal analysis and reporting for the management of individual customer accounts and to make strategic decisions for our business. To establish, exercise and safeguard our rights which may include taking enforcement action against customers or defending complaints or claims made about us. To assess the quality of our customer services and to provide staff training. This includes monitoring and testing of how we manage your loan(s) and our interactions with you. To perform analysis on customer complaints for the purposes of preventing errors and process failures. To rectify negative impacts on customers as a result of process or regulatory failures (including those of a previous lender). To comply with regulatory rules, guidance and requests, or assist a previous lender in its compliance with regulatory rules, guidance and requests. To ensure we act as a prudent servicer of your account. 2.4 Where you have provided consent In some cases we rely on your consent such as: Marketing Consent: At the time of applying for your loan, or at any time thereafter, if you consented to marketing, we might use your personal information to make you aware of other products or services which we think could be of interest to you. In addition, depending on the preferences you selected at the time of your application, we might disclose your personal information to third parties and our partners whose products or services we consider could be of interest to you. All marketing communications will include a clear opt-out facility if you wish to change your marketing contact preferences. Sensitive Information Consent: Data Protection Law may require us to obtain consent to the processing of special categories of personal information such as personal information that reveals racial or ethnic origin, information about a person’s health, religious beliefs and other categories of ‘sensitive data’. While we don’t collect sensitive data as a matter of course, you may choose to disclose health and other sensitive information in limited circumstances, such as if you are experiencing a health issue which is affecting your ability to repay a loan, which we will record on our systems. Authorised third parties: At your request and with your written consent, we will liaise with a third party nominated by you to act on your behalf. Telephone Contact at Work: You may have consented to us contacting you at your workplace, where it is not your residence. At any time you can withdraw your consent through the contact channels referenced in Section 12. 2.5 Where you have provided us with information about another person Where you provide us with personal information relating to another person (e.g. a partner, spouse or guarantor) we rely on you to ensure that you have their consent to providing us with their information for use in accordance with this Data Privacy Notice. 3. Types of personal information we collect and how it is used We collect and process various categories of personal information at the start of and for the duration of your relationship with us. We limit the collection and processing of personal information to such information as is necessary for the purposes set out in Section 2 above. We collect information about you: When you ask us to provide you with certain products and services including over the course of your relationship with us. When you use our website and online services provided by us and visit our offices. When you or others give us information verbally or in writing. This information may be on application forms, in records of your transactions with us, within a standard financial statement (“SFS”) or if you make a complaint. From your online activities with third parties where you have given us your consent (for example, by consenting to our use of certain cookies or other location tracking technologies). When you act as an authorised third party in respect of a loan which we own or service. From clients or other parties who have engaged us to provide credit servicing. From credit reference agencies, credit registration agencies, fraud prevention agencies or public agencies such as property registration authorities, the Companies Registration Office or judgment registries. Personal information requested over the course of your relationship with us may include, but is not limited to, the following: Identity information: Name, date of birth, proof of identification (such as driving licence or passport). Examples of how we use this information include: to identify you and to comply with our legal and regulatory obligations. Contact information: Address, telephone number, email address. Examples of how we use this information include: to manage and administer your loan(s) with us, to send you information which you request and to respond to your queries and complaints. Personal circumstances: Employment status and details, financial circumstances including income and expenditure, assets, borrowings, savings, lifestyle needs. Examples of how we use this information include providing you with products such as a new loan or restructuring or rescheduling of a loan. Interactions with Pepper staff: Whenever a staff member meets you or contacts you, a note of this interaction is recorded on our loan management system. In addition, we sometimes record telephone conversations to improve services, for training purposes, to resolve complaints and as required by relevant regulations and Central Bank of Ireland Codes of Conduct. However, we will always let you know when we are recording our calls with you. Health information: With your consent, we sometimes process information on your health when you are applying for a product or service or over the course of your relationship with us. You may choose to share health information with us, for example, if you are in financial difficulties as a result of a health issue you may provide us with this information in writing or by phone in which case it may be included in a call recording. Other: We may also collect and process personal information made available by other parties, for example credit reference agencies such as Central Credit Register or entities such as An Post. 4. Your rights in relation to the personal information you have given to Pepper You have a number of rights in relation to the personal information which Pepper holds about you. If you choose to exercise any of these rights, we may ask you to verify your identity by providing us with additional documentation such as an up to date proof of identity. Timelines: We will consider your request and provide a response within 1 month of receipt of your request and verification of your identity, where required, as set out in Section 3 above. This time period may be extended in exceptional circumstances. In these cases we will advise you of this along with confirming the reasons for the extension. How to make a request: You can make your request using any of the channels set out in Section 12. 4.1 Right of access to your personal information You have the right to get confirmation about whether we process any of your personal information and, if so, how we use it. We use this Data Privacy Notice to meet this obligation. In addition, if we process your personal information, you have a right to request a copy of the personal information that we process. If we have provided a copy of this personal information within the previous 12 months, we will not provide the same copy to you again but will provide any additional personal information we have obtained and processed since the last request. Fees: Typically there is no fee for a copy of your personal information although we have the right to apply a reasonable fee in exceptional circumstances if your request is manifestly unfounded or excessive. Format of response: You may request that the information is provided to you orally, in a hard copy format or in electronic format. If you require the information in electronic format, you will need to provide us with your email address. We will email the information to you encrypted with a password and you will need to contact us by telephone to provide you with the password. It is important to be aware that email is not a fully secure means of communication. Exclusions: Some personal information is exempt from the right of access, such as personal information that is not available from a reasonable and proportionate search, privileged information, confidential expressions of opinion or where providing a copy would adversely affect the rights and freedoms of others. 4.2 Right to correct your personal information We try to ensure that the information we have about you is accurate and up to date. Sometimes we may ask you to verify that the information we have is still accurate. If you believe certain personal information we hold about you is incorrect, incomplete or out of date, you can contact us to correct the information. Restrict processing: While we are considering your query, you may request that we restrict processing your personal information. 4.3 Right to delete your personal information You may request deletion or erasure of your personal information in the following circumstances, provided there are no legal obligations or overriding legitimate grounds that require us to keep it: Where the personal information is no longer necessary for the purpose for which it was collected. Where you withdraw your consent (in the case of data held in reliance on your consent such as those in 2.4 above). Restrict processing: While we are considering your query, you may request that we restrict processing your personal information. 4.4 Right to withdraw your consent If you have provided us with your consent to process your personal information, for example in the circumstances set out in 2.4 above, you have the right to withdraw that consent. Provided there is no other legitimate reason for us to process that personal information we will stop processing that personal information. 4.5 Right to request your information be transferred You can request that certain personal information which you have provided to us be transferred to you or to another service provider. This applies to information that we are processing for the performance of your contract or based on your consent. 4.6 Right to object Where your personal information is being processed on the basis of our legitimate interests, we must ensure that there is a fair balance between our legitimate interests and your rights. If you disagree with your personal information being processed in this manner, you are entitled to object. 5. How do we use Automated Decision Making To help us make decisions quickly and to improve our service to customers, we may use automated decision making as part of our loan application process. This means that some parts of the decision making process are fully automated with no human intervention. Currently we use automated decision making for our mortgage loan ‘Approval-in-Principal’ (“AIP”) process based on information provided by you. In certain cases however, the decision may be referred to an underwriter to review. This type of processing is necessary to assist us in making a decision in relation to your application. You have the right to express your point of view and contest an automated decision by contacting us through the channels in Section 12 below. 6. How do we use your personal information for direct marketing? Sometimes we may want to make you aware of products and services which we think may be of interest to you based on the product or service you have already received from us, and the personal information we hold about you. If you have consented to direct marketing we may send you marketing communications. You may also have consented to us sharing your personal information with carefully selected third parties and partners whose products or services we think may be of interest to you. If you would like to withdraw your consent at any time, please refer to Section 2.4 above. 7. How we keep your information safe We make every attempt to ensure your personal information is protected and secure. We do this by considering data privacy when developing, designing, selecting and using new systems, products and processes that are used to hold or process that personal information and by limiting access to your personal information. We use a variety of technical and organisational security measures to protect your personal information. These include computer safeguards; ensuring files are stored securely and that our offices have adequate security. 8. Who has access to your information and who do we share it with? 8.1 Staff and onsite suppliers Your personal information may be accessed by our staff including staff of other members of the Pepper group of companies in order to perform their duties and some of our suppliers including contractors and IT support staff, in connection with any of the purposes set out in Section 2 above. You will find details of our group companies at www.peppergroup.ie/about-us. 8.2 Third parties within the European Economic Area (“EEA”) In certain circumstances we may share your information with third parties who will act on our instruction in relation to any processing of your personal information. For example: We may share your information with insurers, solicitors, accountants, valuer, estate agents, advisers and other consultants who act on our behalf or to obtain advice. We may share your information with the original lender or a beneficial owner of your loan or other parties with an interest in your loan. We may use third parties such as print providers and document storage providers. We use the services of a number of IT suppliers of systems and technology. We may share your information with third parties to comply with our legal obligations. 8.3 Third parties outside the EEA We may transfer your personal information to organisations (including other Pepper Group companies) in countries outside of the EEA, but we will only do so where: The European Commission has decided that the country or organisation we are sharing your information with will protect it adequately; We have entered into a contract with the organisation with which we are sharing your information to ensure it is adequately protected on terms approved by the European Commission; or The transfer has been authorised by a relevant data protection authority. 8.4 Central Credit Register (CCR), credit reference and fraud prevention agencies We may access and use your personal information from the CCR when you apply for a loan with us and periodically thereafter: To manage and take decisions about your accounts, including assessing your creditworthiness when you are applying for a new product, and checks to avoid indebtedness. If you apply to have your existing loan restructured. If an amendment is required to the records held on the CCR. For prevention of fraud, money laundering or criminal activity. To trace debtors and recover debt. While you have a loan with us, we will continue to share your personal information, including information about the performance of your loan, with the CCR. This will include the outstanding balance on your loan, the regularity of repayments, number of overdue repayments, any arrears and the date of the next payment. This information will be made available to other organisations, including financial services providers, so they can make decisions about you (such as considering any application for credit and credit related services), to trace debtors, recover debts, prevent or detect money laundering and fraud, and to manage your account. If you want further details of how your information will be used by the CCR, please visit their websites or contact them directly at: CCR Website: www.centralcreditregister.ie Email: consumerinfo@centralcreditregister.ie Phone: +353 (0)1 224 5500 8.5 Loan acquisitions or transfer of rights Your personal information may be disclosed to prospective purchasers of loans and anyone else to whom we may or purport to assign or transfer our rights under the loan in connection with a securitisation or other form of funding arrangement. Whenever we disclose your personal information to prospective acquirers of your loan, we will do so under strict conditions of confidentiality. 9. How long do we retain your personal information? By providing you with a loan, we create records that contain your personal information. Records can be held on a variety of media (physical or electronic) and formats. Your personal information is retained for different periods of time depending on the purposes for which they are required to be retained. We hold your personal information while you are a customer and for a period of time after that. If you have a loan with us, normally we keep customer account records for up to seven years after your relationship with us ends. Other personal information may be kept for shorter periods. Sometimes we may have to keep your information for longer periods, for example where we need to retain information or documents relating to actual or prospective legal proceedings, a court order or an investigation by law enforcement agencies or our regulators. 10. Use of Pepper websites 10.1 Introduction This Data Privacy Notice, together with our Website Terms and Conditions, sets out the basis on which we will process any personal information we collect from you or that you provide to us on our websites – www. peppergroup.ie or www.peppermoney.ie (together “the Websites”). Before using the Websites, it is important to be aware that the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the Websites. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. 10.2 Use of your personal information We may hold and process the following information from you obtained from the Websites: Information that you provide by filling in forms on the Websites, including your name and the account number for your loan. We may also ask you for information when you report a problem with the Website or when you use the Website to contact us. If you contact us, we may keep a record of it. Details of transactions you carry out through the Website, including payments made in respect of loans held by us but not details of debit cards used to make such payments. Details of your visits to the Website, including, but not limited to, traffic data, location data, web logs and other communication data, whether this is required for our own purposes or otherwise, and the resources that you access. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Data Privacy Notice. Any payment transactions will be encrypted using SSL technology. The Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that they have their own privacy statements and that we do not accept any responsibility or liability for these statements. Please check these statements before you submit any personal data to these websites. 10.3 Types of information we collect and how it is used IP Addresses: We may collect information about your computer, including, where available, your IP address, operating system and browser type, for system administration. This is statistical data about our users’ browsing actions and patterns and does not of itself identify any individual. Cookie technology: Our websites use ‘cookie’ technology. The Cookies Policy on our website explains what cookies we use and how you can adjust your preferences. 11. Updates to this Data Privacy Notice This Data Privacy Notice may be updated from time to time. You will always find the most up to date version on our websites at www.peppermoney.ie or www.peppergroup.ie. 12. How you can contact us If you have any queries about your data protection rights, you can contact us in the following ways: By phone at the following number or in writing at the following address: For Pepper Money: Write to: Data Protection Officer, Pepper Money, 4th Floor Two Park Place, Upper Hatch Street, Dublin 2 Phone: 0818 866 666 For Pepper Asset Servicing: Write to: Customer Services, Pepper Asset Servicing, PO Box 687, Shannon, Co. Clare Phone: +353 (0)61 705900 If you wish to raise a query or make a complaint in relation to how we handle(d) your personal information, you can write to our Data Protection Officer, at the following address. Data Protection Officer, Pepper Money & Pepper Asset Servicing, 4th Floor Two Park Place, Upper Hatch Street, Dublin 2. In the event that you are not satisfied with our response to your query or complaint, you may be entitled to complain to the Office of the Data Protection Commission: Write to: Office of the Data Protection Commission, Canal House, Station Road, Portarlington, Co. Laois. Phone: +353 57 868 4800 or LoCall: 1890 252231 Email: info@dataprotection.ie Website: www.dataprotection.ie Speak with a member of our Commercial Property Finance team today Call us on 0818 866 666 Email us Repayment difficulties About Us About Pepper Leadership Team CSR Careers News Information Complaints Data Privacy Notice Terms & Conditions Terms of Business Reference Interest Rates Fees & Charges Legal & Regulatory © Copyright 2020 All rights reserved. Pepper Finance Corporation (Ireland) DAC, trading as Pepper Money and Pepper Asset Servicing is regulated by the Central Bank of Ireland. By using our website you agree to the terms and conditions for use of it. Pepper Finance Corporation (Ireland) DAC Cookie Notice Pepper uses cookies to improve your browsing experience. Some cookies are required to enable our website to operate while other cookies improve the performance and functionality of our website. You can find out more about the different types of cookies we use and manage your cookie settings on this website by clicking Manage Cookie Settings. To find out more about how we use cookies please read our cookie policy By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyse site usage, and assist in our marketing efforts. Cookies Settings Reject All Accept All Cookies