Privacy Policy

General Introduction

This privacy notice is issued on behalf of Oplo Group (“we”, “us” and “our”).

Oplo Group consists of:

• Oplo HL Ltd (Company Registration Number 05667257)
• Oplo CF Ltd (Company Registration Number 07213812)
• Oplo PL Ltd (Company Registration Number 08457740)
• Oplo Group Ltd (Company Registration Number 05438114)

We will let you know which entity will be the controller for your data when you purchase a product or service with us. However, by providing your data to one of the legal entities above, your data will be shared with the 1^st Stop Group as described above.

Oplo Group Ltd is responsible for our Website.

Oplo Group respects your privacy and is committed to protecting your personal data.

This privacy notice will inform you as to how we collect and process your personal data when you apply for a loan with us and tell you about your privacy rights and how the law protects you.

If you use a finance broker or an introducer to make an application to us, they are the Data Controller of your personal data up to the point we fund you a loan and their privacy policy will apply.

Data Controller Information & Our Contact Details

Oplo Group companies are registered with the Information Commissioners Officer (ICO) as Data Controllers with the following details:

Oplo Group Ltd – ICO Registration Number ZA011770
Oplo HL Ltd – ICO Registration Number Z1245955
Oplo PL Ltd – ICO Registration Number ZA006742
Oplo CF Ltd – ICO Registration Number Z3274560

The postal address for Oplo Group Ltd, Oplo HL Ltd and Oplo PL Ltd is:

Viscount Court,
Sir Frank Whittle Way,
Blackpool,
Lancashire
FY4 2FB

The postal address for Oplo CF Ltd is:

Unit 2
Lumley Court
Drum Industrial Estate
Chester-Le-Street
DH2 1AN

Our telephone numbers are as follows:

Oplo HL Ltd – 01253 603 950
Oplo PL Ltd – 01253 603 952
Oplo CF Ltd – 0191 492 1919

Data Protection Officer’s Contact Details

Our Data Protection Officer is Mark Robins. You can contact him at:
dataprotectionofficer@myoplo.co.uk

Viscount Court,
Sir Frank Whittle Way,
Blackpool,
Lancashire
FY4 2FB

Your Data Protection Rights

Your personal information is protected under data protection law and you have several rights (see below) available to you depending on our reason for processing. Please contact our Data Protection Officer should you wish to exercise these rights. We will need to verify your identity before we can act on your request.

You have the right to:
Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, subject to certain exceptions.

Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Request erasure of your personal data. You may ask us to delete information we hold about you in certain circumstances, this is often referred to as the ‘right to be forgotten’. This right is not absolute and only applies in certain circumstances. It may not always be possible for us to delete the information we hold about you, for example, if we have an ongoing relationship with you or we are required to retain information to comply with our legal obligations.

Object to processing of your personal data when it is based upon our legitimate interests or for the purpose of statistical analysis, profiling or direct marketing.

Request restriction of processing of your personal data. This is not an absolute right and only applies in certain circumstances. For example, where you contest the accuracy of your personal information, it may be restricted until the accuracy is verified, or where the processing is unlawful but you object to it being deleted and request that it is restricted instead.

Request data portability of your personal data to you or to a third party. You have the right to receive, move, copy or transfer your personal information to another controller.

We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

How we collect your personal information

We collect Personal Data directly from you via our Website (www.myoplo.co.uk) and other communications between us when you use or apply for our services. This includes:

Direct interactions.

• Applying for our loan products.
• Creating an account on our Website.
• Subscribing to our on-line portal.
• Requesting marketing to be sent to you.
• Information you make public when you interact with our social media profiles.
• Completing a survey; or
• Giving us some feedback.

Automated technologies or interactions.

• From your browsing actions and patterns when visiting our website (Collected by our Website Cookies. Please refer to the section on Website Cookies for more information).

We also obtain your personal information from third parties including:

• When you apply to us for a loan via a credit broker and they transfer your personal data to us in accordance with your agreement with them.

• Comparison Websites.

• If another person provides your information to us when they apply to obtain a product from us jointly with you.

• From fraud prevention agencies including Cifas, the Fraud Prevention Agency.

• From searches of credit reference agencies of their records relating to you and other people with whom you are linked financially.

• From tracing, debt collection and recovery agents acting on our behalf.

• From public records (e.g. sanctions list, media, the electoral roll).

• From the Land Registry, Registers of Court Judgements, Bankruptcies.

• If you have a credit agreement with another lender and we buy it from that lender (for example, if we buy a portfolio of credit agreements and your credit agreement is included within that portfolio).

• From analytics providers such as Google and Facebook based outside the EU.

Website Cookies

Our website contains Cookies. For more information about the Cookies we use, please see our Cookie Policy.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become inaccessible or not function properly.

The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect different kinds of personal data about you which we have grouped together follows:

Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, passport information, driving licence information or other identification information.

Employment Data includes the name of your employer and contact details.

Contact Data includes address, email address and telephone numbers.

Financial Data includes bank account details, salary details, assets, liabilities, details on any dependants, income and expenditure and payment card details.

Transaction Data includes details about payments you make and receive, details of any arrears, details of arrears charges and associated costs.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the Website.

Profile Data includes your username and password, loan applications made, payments made by you, your financial situation, marketing preferences, feedback and survey responses.

Usage Data includes information about how you use our Website, loan products and services.

Marketing and Communications Data includes your preferences in receiving marketing from us and any third-party supplier and your communication preferences.

Other Personal Data you voluntarily provide, which may include people appointed to act on your behalf and special category personal data, for example data which you provide about your health where this relates to your ability to meet your obligations under the agreement.

Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

How we use your personal data

We will only use your personal data we collect to:

• Verify your identity, income and employment status before we provide you with a loan and throughout our relationship with you.

• Assess your credit history and make credit decisions about you.

• Assess whether the loan applied for is affordable.

• Prevent fraud and money laundering before we provide you with a loan and after your loan has been granted.

• Register you as a new customer.

• Administer your account, collect loan payments, manage any arrears, trace you and recover debts owed by you.

• Communicate with you by telephone, email, SMS, chatbot, post or any other digital communication method. Including providing you with regulatory notices and account statements and handling any complaints you may have.

• Meet our legal, regulatory and contractual obligations arising from any loan agreement you enter into with us.

• Report positive, delinquent and default data to Credit Reference Agencies.

• Provide and improve customer service and support.

• Administer our Website, enhance operational capabilities and for internal operations.

• Provide you with information about other products and services that we offer that may be of interest to you.

Your data may also be used:

• For due diligence purposes if another lender or debt purchaser was buying a portfolio of credit agreements where your credit agreement is included within the portfolio.

• For due diligence if the Group was to be involved in a merger or acquisition.
• Automated decisioning to assess your loan application. Please refer to the Automated Processing section for more information.

If you have any concerns about the processing above, you have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see “Your Data Protection Rights” section above.

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you choose not to provide it, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

Marketing and Opt-Out Rights

We may send marketing to you about our products and services, and the products and services of other members of the Group (unless you have opted out of marketing, or we are prevented by law from doing so).

This may be sent by post, telephone, email, SMS and through digital channels including social media.

We may ask you from time to time for your preferred methods of contact.

It is in our legitimate interests to give you information about our products and services that you may be interested in.

You do however have the right at any time to ask us not to use your Personal Data for marketing purposes. Please email preference@myoplo.co.uk to unsubscribe.

Third-party marketing

If we wish to pass your information to selected third parties, so that party can market their products to you, we will inform you of which company we wish to share your details with and we will ask for your consent before doing so.

You can ask us or any third parties to stop sending you marketing messages at any time by emailing us at preference@myoplo.co.uk and confirming what you want us to do.

Where you opt out of receiving these marketing messages, this will only apply to marketing preferences and not how we communicate to you in respect of any current loan product you may have with us.

Automated Processing

We may use automated decision-making software to underwrite your loan.

Our automated systems include but are not limited to:

• A credit assessment
• Affordability assessment
• Employment verification
• Income verification
• Fraud prevention and anti-money laundering databases

You have the right to request that we manually review the results of the any automated decision. You can do this by contacting us at dataprotectionofficer@myoplo.co.uk.

Changing the purpose that we collected your data

We will only use your personal data for the purposes described above.

Any changes to this would only be made if the purpose were compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Our Legal Basis for using your personal data

We must have a legal basis (lawful reason) to process your personal data. In most cases, the legal basis will be one of the following.

• Contract:the processing is necessary for the loan or agreement you have with us, or because we must take specific steps before you enter into a loan or agreement with us such as ensuring the loan is affordable.

• Legal obligation:the processing is necessary for us to comply with the law. For example, the Consumer Credit Act, Mortgage Regulation or Money Laundering Regulation and associated laws.
• Legitimate interests:the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. For example, to understand how customers use our services so we can develop new services and improve the services we currently provide.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws.

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you choose not to provide it, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

Where our use of your data is not necessary for one of the purposes outlined above we may seek your consent to use it in a particular way, for example for marketing or to pass your information to named third parties for the purposes of marketing to you by electronic means.

Where we ask for your consent you are free to refuse our use of the data for those purposes and you may withdraw your consent at any time by contacting us.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal basis we rely on to do so. Where the legal basis is ‘legitimate interests’ a further explanation will be provided in italics.

Who we may share your Personal Data with

We may share your personal information with:

• Service providers acting as processors based in the UK who provide data hosting, data storage, electronic messaging services, call recording services and system administration services.
• Service providers acting as processors based in the UK who provide outsourced services such as call centre activity, customer service, marketing, credit score information, open banking, and business support services such as the collection of arrears or financial advice.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, debt recovery services, tracing agents, repossession agents, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Cifas, a fraud prevention agency based in the United Kingdom who provide fraud prevention services and who we also report to.
• Customer satisfaction survey administrators.
• Third parties to which we transfer, charge or assign your agreement.
• The purchaser or seller of or investor in any business or asset which we are selling or contemplating selling or purchasing and their advisors or service providers. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
• Law enforcement agencies or regulatory bodies where we are required to do so by law.
• Credit Reference Agencies.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Credit Reference Agencies

To process your application, we will perform credit and identity checks on you with one or more Credit Reference Agencies.

To do this, we will supply your personal information to Credit Reference Agencies, and they will give us information about you.

We will also continue to exchange information about you with credit reference agencies while you are our customer. This includes informing the Credit Reference Agencies if you borrow and do not repay in full and on time. Credit Reference Agencies will record the outstanding debt.

We also inform the Credit Reference Agencies about your settled accounts.

The credit reference agencies may in turn share your personal data with other organisations, which those organisations may use to make decisions about you.

Examples of circumstances when your information may be shared include the following.

• Verifying the accuracy of the data you have provided us.
• Making credit and affordability assessments to decide whether to accept your application.
• Checking your identity details.
• Preventing criminal activity, fraud and money laundering.
• Tracing your address so that we can continue to contact you about any existing or previous products you held with us, as well as recovering debts that you owe.
• Understanding your financial position. This includes the amount you borrow and your payment history, including any payment arrangements.

Ensuring any offers provided to you are appropriate to your circumstances.

When Credit Reference Agencies receive a search from us, they will place a search footprint on your credit file that may be seen by other lenders. Our initial search may be a ‘soft footprint’ which cannot be seen by other lenders but if you proceed to take out a loan with us this footprint will be visible to others who search your credit record.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before applying for a loan with us.

Credit Reference Agencies will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the Credit Reference Agencies to break that link.

The identities of the Credit Reference Agencies, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the Credit Reference Agencies are explained in more detail at https://www.transunion.co.uk/crain. The Credit Reference Agency Information Notice is also accessible from each of the three Credit Reference Agencies – clicking on any of these three links will also take you to the same document:

TransUnion           https://www.transunion.co.uk/crain
Equifax                  www.equifax.co.uk/crain
Experian                https://experian.co.uk/crain/index.html

Fraud prevention agencies

The personal information we have collected from you will be shared with fraud prevention agencies to help us make credit related decisions. Fraud prevention agencies can hold your personal data for different periods of time.

We may also share your personal data with law enforcement agencies to detect, investigate and prevent crime. If fraud is detected, we may refuse to provide the loan you have requested, or we may stop providing our service to you.

A record of any fraud will be retained by the fraud prevention agencies and may result in others refusing to provide services, financing or employment to you. Fraud prevention agencies can hold your personal data for different periods of time.

Third-Party Links

Our Website or communications may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Transferring your data abroad

We do not transfer your personal data outside the European Economic Area (EEA), apart from to analytics providers such as Google and Facebook based outside the EU.

Keeping your information accurate

It is important that the personal data we hold about you is accurate and current. Please keep us informed of any changes during your relationship with us. This should include any change of address, telephone numbers and marital status.

Retention of your information

The length of time we retain your information is determined by the purpose for which we use that information and our obligations under laws and regulation. We do not retain personal information in an identifiable format for longer than necessary.

In most cases we will keep your personal data for a period of 6 years once our relationship with you comes to an end. This period may be reduced depending on the nature of the data, the purpose it was obtained and legal/regulatory requirements.

We may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

In certain circumstances you can ask us to delete your data: see the Data Protection Rights section for further information.

If your information is transferred to a third party their Data Retention Policy may differ to ours.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any breaches where we are legally required to do so.

How we monitor your communications

Subject to applicable laws, we will monitor and record calls, emails, text messages, social media messages and other communications. We will do this for the purposes of complying with applicable laws and regulations and our own internal policies and procedures, to prevent or detect crime, and for quality control and staff training purposes.

Complaints

If you have any questions about how we treat your personal data and protect your privacy please email dataprotectionofficer@myoplo.co.uk or call us on one of the numbers below.

Oplo HL Ltd – 01253 603 950
Oplo PL Ltd – 01253 603 952
Oplo CF Ltd – 0191 492 1919

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) https://ico.org.uk/make-a-complaint/ or call 0303 123 1113.

We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this Privacy Policy

This version was last updated on 4^th May 2020 and historic versions can be obtained by contacting us at dataprotectionofficer@myoplo.co.uk. If changes to this privacy notice have a major effect on what we do with your personal data or on you personally, we will give you enough notice to allow you to exercise your rights (for example, to object to the processing).

V5/052020