How we use your information

Under data protection law, an organisation that decides how the personal information it collects and holds is used is called a ‘data controller’. We call this use of personal information ‘processing’.

If you submit your customer’s mortgages to Nationwide Building Society, the data controller of your personal information is Nationwide Building Society.

Nationwide Building Society has a number of subsidiary companies and overseas branches and is a member of various limited liability partnerships. These include The Mortgage Works, Nationwide Covered Bonds LLP, E-Mex Home Funding Ltd, Derbyshire Home Loans Ltd, UCB Home Loans Corporation Limited and Home Propositions Limited.

In some cases, one of these companies or partnerships will be the data controller.

In this notice, when we say ‘Nationwide’, ‘we’, ‘us’ or ‘our’, we mean The Nationwide business that is the data controller of your personal information.

The information we might collect and hold about you includes:

• Personal information to identify and contact you, such as your name, address and contact details that you submit as part of your registration.
• Information about your company, work or profession, your nationality, education and social and economic demographic.
• Details of the accounts and products your customers hold and/or previously held with us.
• Personal information gathered from when you’ve applied for a product or service on behalf of a customer, including where an application was declined.
• Details of when you contact us and when we contact you.
• Details of the type of device you are using (e.g. whether it’s an Apple phone or a Windows computer).
• Information on your location, gathered from your mobile phone or other devices, where you access the internet.
• Details of how you use our website and online services.
• Details you make public on social media e.g. Facebook/Twitter.
• Information about your interactions with Nationwide online or by telephone.
• Other information that you supply to us or that we obtain from our relationship with you. For example, your marketing preferences.     

When we talk about ‘information’ throughout this page, we’re referring to all of these items.

Most of the information we hold about you comes directly from you. This includes information you give us when you:

• apply for our products or services on behalf of a customer
• update your information (such as when you change your email address)
• speak to us on the phone (we may record some calls for training and quality purposes)
• use our websites or web chat services
• send us letters, emails or other documents.

In certain situations, we may use information that you’ve made public such as tweets or social media content too (e.g. when you interact with our social media profiles, like referencing Nationwide on LinkedIn).

We might collect or receive information from certain third parties too. These include:

• Credit reference agencies
• Government bodies and agencies
• HM Revenue & Customs and other tax authorities
• Regulators
• Law enforcement agencies
• Fraud prevention agencies
• Insurers
• The Electoral Roll and other sources of publicly available information (e.g. Sanctions list, media)
• Our service providers
• Companies and organisations that introduce you to us
• Financial advisers
• Land agents
• Card associations
• Comparison websites
• Market research providers
• Tracing and debt recovery agents
• Organisations providing data services to support us in managing our relationship with you and operating our business.

We collect and use your information so we can open and manage your customers mortgage accounts, provide services and also operate our business. Examples of how we use your information include:

• Processing your registration.
• Checking your identity and confirming that it is you.
• Managing your relationship with us.
• Preventing and detecting fraud and financial crime.
• Considering any business from you for administrative purposes including contact management.
• Checking the Financial Services Register to confirm that appropriate and current agreements indicating or giving rise to an agency, joint venture or authorisation and permissions are in place.
• Making any other relevant searches and checks in respect of you and your owners/principles.
• Conducting statistical analysis.
• Managing any queries and complaints you might have.
• Providing products and services of our partners.
• Enhancing your experience of our products and services.
• Meeting our legal and regulatory obligations.
• Testing our systems and processes.
• Sharing relevant marketing about our products and services. We will always provide you with the option to unsubscribe from those communications and/or change your future preferences.

We’re able to use your information for the purposes outlined above, where one of the following applies:

• We use the information to carry out our obligations to you, as part of an agreement between you and Nationwide.
• We must use the information to comply with the law or in the public interest.
• We use the information to carry out our legitimate business interests.
• You have given us consent to use the information.
• We use your information to protect your vital interests (e.g. in very exceptional circumstances when we believe it’s in your best interests).

You can find out more about how we use your information in the next sections.

We collect and use your personal information to check your identity when you open a mortgage account, product or service with us on behalf of a customer, and from time to time throughout our relationship.

How do we use your information in this way?

We use your information to check that it’s you when you open a mortgage account on behalf of a customer. 

Why do we use your information in this way?

It’s all about keeping your personal details safe. We check your identity to:

• Make it harder for criminals to use false names and addresses, steal the identities of innocent people and access financial products and systems by pretending to be you.
• Help prevent fraud and stop money laundering.
• Uphold our legal obligations and complete necessary due diligence checks to make sure we know our brokers and customers.

We may also check your identity for our legitimate business interests. For example, to follow guidance and best practice set by our regulators. However, we’ll always make sure that the way we process your information is not unfair to you.

In certain circumstances, you have the right to object to us processing your personal information. Discover more about this, and your other rights, on the Your information rights page.

We need to use your personal information to keep in touch with you. We’ll collect and use your details to: 

• Provide services based on your relationship with us.
• Manage your relationship with Nationwide and keep in touch with you.
• Send you communications to service your customer’s accounts, products and services.
• Manage any queries and complaints you might have.
• Make sure the data we hold about you is correct and up to date.

In managing your relationship with us, we may use information we already hold about you (e.g. your address and contact details). This is so we provide you with the best experience (e.g. by pre-populating sections on certain application forms, so you don’t have to) and ensure that we hold consistent and correct information about you across our systems.

How do we use your information in this way?

We’ll process your information in this way when it’s required as part of the terms and conditions agreed between us, and also when you ask us to carry out activities that need your authorisation.

We may also need to use profiling (where we use your information to categorise groups of brokers together based on their behaviours and interactions). This helps us make sure that we’re being fair and consistent in the way we treat our brokers.

We may need to use your information when it’s necessary for our legitimate business interests. This will mainly be so that we can uphold our commitment as a responsible lender and follow guidance from our regulators. We’ll always ensure the way we process your information is safe and not unfair to you.

You have the right to object to us using your information for legitimate interests. Find out more about this on the Your information rights page.

At Nationwide, our brokers and customers’ safety is our number one priority. And that’s exactly why we collect and use your information to confirm that you are who you say you are, and to help stop financial crime including fraud and money laundering.

How do we use your information in this way?

We share your personal information with fraud prevention agencies to help prevent financial crime. If required for fraud or criminal investigation reasons, we (and the fraud prevention agencies) may also allow law enforcement agencies to access and use your information.

What information do we share?

The personal information we might need to share in this way includes your:

• name
• address
• employment details
• identifying information (such as your IP address).

We’ll share your information in this way when it’s necessary as part of the terms and conditions agreed between us, either when you’re applying for a product on behalf of a customer or as part of our ongoing relationship.

Why do we share your information in this way?

We have a legitimate business interest to check people’s identity, and identify and prevent financial crime including fraud and money laundering. Sharing your information in this way, when necessary, allows us to protect financial security of brokers and customers. It also makes sure that we’re complying with the law.

You have the right to object to us processing your information in line with our legitimate interests. Find out more about this on the Your information rights page.

A little bit about automated decisions

Sometimes when processing people’s personal information, we might use technology that makes automated decisions about our brokers and customers. This means that we may automatically decide that someone poses a financial crime risk if:

• The information processed reveals behaviour that indicates financial crime.
• The information provided is different to information previously given.
• Someone appears to have deliberately hidden their true identity.

You have rights related to automated decision making. You can find out more about these by taking a look at the Your information rights page.

What happens if a financial crime risk is detected?

We take financial crime seriously. And if we, or a fraud prevention agency, believe that someone poses a financial crime risk then we may refuse to provide the services that they’ve asked for. We can also stop providing services they already have with us.

If they apply for a job with us, and financial crime is detected, we may not employ them. Or, if they work for us already, we may stop their employment.

A record of any fraud risk will be kept by the fraud prevention agencies and this could mean that other providers refuse to offer services, finances or employment. Fraud prevention agencies can hold onto someone’s personal data for different periods of time, depending on the situation. If someone is considered a fraud risk, their data can be held for up to six years.

If fraud prevention agencies transfer your personal information outside of the European Economic Area (EEA), they impose contractual obligations on the recipient to protect your personal information to required standards. They may also ask the recipient to subscribe to international frameworks that enable data sharing.

Any questions?

If you have any questions about financial crime prevention, and how we use your information in this way, don’t hesitate to get in touch.

Sometimes, we might need to collect and use your information to provide, introduce or distribute products and services from our partners.

How do we use your information in this way?

We’ll share necessary information with our partners when:

• Discussing any queries or complaints that may arise.
• To help them provide products and services to us.
• We need to update them about a change to your address or contact details.

Our partners will also collect and use your information to manage the products and services that you have with them. As this then makes them the ‘data controller’, they’ll provide more details on how they process your information at the time when it’s collected by them or shared by Nationwide.

When selecting our partners, we take appropriate steps to make sure that they have adequate protection in place and that they follow data protection legislation.

Why do we need to use your information for this?

We’ll use your personal information to meet the promises we’ve made in the terms and conditions of your product or service. We also use your information to understand your needs so that we can accurately advise on the products and services that are right for you.

We may also use it for our legitimate business interests. For example, when we need to make sure that the terms you’ve agreed to will be upheld, or to follow best practice from regulators.

We’ll always keep your best interests at heart and make sure that the way we process your information isn’t unfair to you.

You have the right to object to us using your information for legitimate interests. Find out more about this on our Your information rights page.

How do we use your information in this way?

We want you to get the most out of your relationship with Nationwide. One of the ways we might help you do this is by using the contact details you’ve supplied us to send you marketing information about products or services we think you’ll find interesting. For example, it might be a monthly e-newsletter keeping you updated on what’s happening with the housing market.

We also collect and use your information to help us plan and tailor the delivery of our marketing campaigns. Discover more about this in our enhancing your experience of our products and services section.

Our marketing on websites and social media

We want you to get the most out of your relationship with Nationwide. So we use social media and websites to let you know about the products and services we offer that might be of interest to you.

One of the ways we do this is by matching the personal details we hold about you, such as your email address, with the details social media companies or websites hold about you. This is done in a controlled, anonymous way so your identity is never revealed.

By doing this, social media and websites can share tailored marketing messages with you about our products and services.

We have strict processes in place to keep your personal information safe and we won’t use it in a way that’s unfair to you.

We keep your information safe by:

• Never sharing any other personal information about you with social media companies or websites.
• Making sure your information doesn’t give your identity away by making it anonymous in a secure and controlled environment.
• Using carefully selected social media companies and websites. We take steps to make sure the information we share with them about you will not be used for any reason other than showing you marketing messages from us that we think you’ll be interested in.
• Never agreeing to social media companies or websites sharing or selling your information to third parties.
• Making sure that social media companies or websites securely delete any information we give them about you.

You have the right to object to us using your information for legitimate interests. You can find out more about this, and your other rights, on our Your information rights page.

Just so you know, if you do submit a ‘right to object request’ we will stop sending you marketing messages tailored to you. However, you might still see some general marketing messages from us, but these won’t be targeted to you.

If you want to control the adverts you see on social media platforms, you can manage your marketing preferences through their settings page. In some cases, you can opt out of receiving targeted marketing messages. You’ll still see adverts, but these won’t be tailored to you.

At Nationwide, we’re required to collect and use your personal information in a number of circumstances to meet our legal and regulatory obligations.

These include using your personal information to carry out a range of activities that ensure we comply with the requirements set out by our regulators (e.g. Financial Conduct Authority – FCA – and Prudential Regulation Authority – PRA) and in relevant legislation (e.g. Data Protection Legislation and Anti-Money Laundering Regulations). We also disclose information to HMRC and other government bodies when we are required or permitted to do so.

How do we use your information in this way?

Sometimes, we’re required by law to produce reports or statistical modelling that we disclose to regulators or government bodies (e.g. when we need to report our complaints statistics to the FCA. To produce these reports, we may need to use profiling (where we categorise your behaviours, interactions and/or characteristics alongside other customers). This helps us make sure that our reporting is accurate.

In certain circumstances, we’ll process your personal information in this way for our legitimate business interests. This is when we have legal obligations to process your information but flexibility in how we do this.

You have the right to object to us using your information for legitimate interests. Find out more about this on our Your information rights page.

We’re constantly looking to improve how we do things – and understanding more about you helps us do exactly that.

We collect and use your personal information to help us make our business better, improve products and services and enhance how we engage with customers.

What type of information do we put in?

• Personal information to identify you
• Details about the products you hold and account activities
• Information about your work or profession, your nationality, education and social and economic demographic
• Information you put into our online services (e.g. our mortgage calculators)
• Information about how you interact with us (e.g. when you call us)
• Information about our online content which you have viewed
• Details of feedback you have provided, either directly to us or you make public e.g. on social media
• Information about the services you use and how you use them
• Details of the devices you use to interact with us
• Information about how you respond to our communications (e.g. whether you read an email)
• Information on your location, gathered from your mobile phone or other device, where you access the internet or where you make a payment
• Information gathered from third parties.

We’ll also use information we have collected from credit reference agencies and other organisations to profile your information (e.g. where we categorise behaviours, interactions and/or characteristics, both now and in the future). We’ll do this whether or not you, or Nationwide, choose to proceed with the application. This is part of what we call ‘statistical modelling’, helping us to review our risk appetite when making lending decisions.

What do we do when profiling your information?

Profiling your information alongside other customers also helps us to ensure that we’re providing a consistent service and giving people the best products at the right times. We may:

• Make predictions about you and your behaviours to understand the likelihood that you may do something
• Segment customers (e.g. grouping you with people with similar traits) to make sure you receive the correct service message for the product you hold and your personal circumstances (e.g. time left on mortgage)
• Analyse your interactions with Nationwide e.g. when you telephone our call centre or visit our website
• Assess the performance of communications we provide you with
• Monitor the performance of our products and services in the market place
• Produce anonymised reports for internal use and to meet our legal and regulatory requirements.

How does this benefit Nationwide and you?

Your information and views help us understand the ever-changing needs of our customers, putting you at the heart of decisions we make about our products and services. By doing this, we can keep evolving what we offer and growing as a business. This includes:

• Helps us to grow and offer the right customer benefits
• Ensures we are fair and consistent and offer the best outcome for our customers
• Ensures our communications are appropriate
• Allows us to develop new products which meet the needs of our customers
• Allows us to continuously improve our content and the way we interact with you
• Helps us improve our productivity (e.g. reduce our call waiting times)
• Helps us develop new services based on emerging trends
• Helps Nationwide have a ‘big picture’ view of our customers and our business so we can identify improvements to our products and services
• Allows us to offer a personalised service
• Helps us make investment decisions so that we can provide the services our customers require.

We’ll always make sure the way we process your information is safe and not unfair to you. Where possible, we’ll keep your details anonymous and use your information only to produce statistical reports.

You have the right to object to us processing your information for our legitimate interests. You can find out more about this, and your other rights, on our Your information rights page.

We’re constantly looking to improve our products, services and systems. And, when it’s essential, we may use your personal information for testing so that we can make them even better.

How do we use your information in this way?

We have stringent processes in place to keep your personal information safe and we won’t use it in a way that’s unfair to you. When we use your information for testing, we:

• Always do this in a secure and controlled environment.
• Only use the minimum amount of data necessary for the testing.
• Only use carefully selected specialist service providers, where necessary.
• Only hold your information in this way for as long as needed to carry out testing.

Why do we use your information in this way?

Using your information for testing is necessary for our legitimate business interests as it allows us to maintain and improve the security, integrity and performance of our systems. Also, being able to develop systems with customers in mind enhances the experiences you have with Nationwide.

You have the right to object to us processing your information in this way. For more details on this, and your other rights, take a look on our Your information rights page.

Your information will be shared with:

• The Nationwide Group, for the purposes explained in the how we use your information section.
• Partners and suppliers that support the operation of the business.
• Specific third parties that you’ve authorised us to deal with (e.g. professional advisors, family members or representatives for you).
• Third parties, when we’re required to do so under the terms of any secured wholesale funding programmes.

When necessary, we may also share information with other organisations, including:

• Credit reference agencies
• HM Revenue & Customs and other tax authorities
• UK Financial Services Compensation Scheme
• Regulators e.g. FCA
• Financial Ombudsman Scheme
• Law enforcement agencies
• Fraud prevention agencies
• Government bodies and agencies
• Land agents
• Card associations (e.g. Visa)
• Comparison websites
• Market research providers
• Organisations providing data services to support us in managing our relationship with you and operating our business.

You’ll find out more about when we’d need to share your information with partners in our section about providing products and services from our partners.

If you’ve authorised us to, or in exceptional circumstances when we believe it’s in your interests, we might also share your information with healthcare or other wellbeing organisations. But we’ll only share the minimum amount of information needed (for example, your contact details).

Also, in the event that we transfer, sell or merge parts of our business, your information will be shared accordingly.

Our aim is to keep your information for as long as we need to, in order to manage your relationship with us and comply with legal and regulatory requirements.

Your relationship withNationwide	How long we hold your information for
You have submitted a mortgage application on behalf of a customer	We’ll keep the information we have collected between 18 months and 6 years, depending on the stage in the application process you are at (e.g. whether your customer didn’t choose Nationwide but we have completed a credit check against them).
Your customer has a mortgage with Nationwide	We’ll keep the information we hold about you as long as your customer has a mortgage with Nationwide. There may be times when we don’t need certain pieces of information about you while you’re a customer, such as data we collect and use about you when developing our products and services.
Your customer used to have a mortgage with us but it’s closed now.	If your customer had a mortgage with Nationwide, your information will be retained for 12 years following the redemption of the mortgage. This is so Nationwide can comply with its regulatory obligations.

Just so you know, we may keep your information for longer than indicated if we cannot delete it for legal, regulatory, or technical reasons. We may also keep it for research or statistical purposes. If we do, we’ll make sure that your privacy is protected and only use it for those purposes.

Keeping your information safe

We’re committed to taking good care of your personal information safe and we have stringent security measures in place to keep it well-protected.

You have certain rights when it comes to your personal information and there are a number of requests you can make.

Please see Your information rights page to see how you can do this.

We need you to keep your personal details up-to-date so that we can get in touch with you about your customers, product or service you have with us.

If you change your name, address, phone number or email address, please let us know straight away. You can update your contact details on our Placing business page.

At Nationwide, we sometimes use advanced technology to make automated decisions about our customers. This could be when you’re applying for a mortgage on behalf of your customer.

When do we use automated decision making?

1. To assess your client's application and check if we can approve you for credit, to make sure that we’re lending responsibility.
2. To assess if we can offer your customer a financial product and work out the level of interest that they’ll pay. This helps us make sure that we’re fair and consistent in our product offerings.
3. To check if someone’s making a fraudulent application or if there’s activity that needs further review. This is so we can protect you from financial crime.
4. To decide if your customers are, or continue to be, eligible for the product or service you’ve chosen.

What information we put in

• Information you provide us as part of your customer’s mortgage application
• Information about how you use our services
• Information about the devices you use
• Information held with credit reference and fraud prevention agencies
• Existing data we hold for modelling purposes
• Information gathered from third parties.

How we use this information

• To validate the information you have provided us
• To make sure our credit scoring system is fair
• To create profiles about you through analysing the information
• To better understand trends in traits and behaviours
• To make predictions on potential fraudulent behaviour
• To analyse the data to improve our services.

Why we do this and how it benefits you and Nationwide 

• To comply with our requirements as a responsible lender
• To prevent fraud and money laundering by keeping your money and identity safe
• To make sure we are fair and consistent in how we treat our customers
• To make our processes efficient
• To manage our risk appropriately
• To trigger alerts when there is unusual activity.     

Profiling

Profiling is used to make automated decisions. This is where we combine your information with information about others so that we can:

• Understand trends in traits and behaviours.
• Make predictions about how you might use our products and services in the future.
• Analyse data to improve our service and generate alerts (e.g. where we suspect that you may be the victim of financial crime).

In certain circumstances, you have the right to ask for a decision to be reviewed by a person. For more information on this, take a look at Your information rights page.

We may transfer personal information to countries outside the UK when:

• You request for us to do so.
• We’re required or permitted to by law.
• We’re sharing data with a third party to support us in managing your account and running Nationwide.

When working with our suppliers and/or transferring information to countries outside the UK, we take appropriate steps to ensure that there is adequate protection in place and that data protection legislation is followed.

This could be by:

• Ensuring that we transfer information to countries that we believe have comparable data protection legislation to the UK.
• Putting suitable clauses in our contracts so that organisations take appropriate steps to comply with UK data protection law.

If you would like more information on this, please contact us.

To find out more about how we use cookies on our websites and digital services, please see our cookies page.

Nationwide’s Data Protection Officer (DPO) is responsible for protecting personal information held by Nationwide Building Society and its subsidiaries.

You can contact them by writing to:

The Data Protection Officer
Nationwide Building Society
Nationwide House
Pipers Way
Swindon
SN38 1NW