Your privacy and personal information

We will collect and process various types of personal information about you. This includes information that you provide to us (by communicating with us, whether face-to-face, by phone, e-mail or otherwise); information we collect or generate about you (such as call recordings or information relating to your use of our registration platform); information that we obtain from other sources (for example publicly available sources, such as the press, the electoral register, company registers and online search engines), or information provided by third parties (such as credit reference, fraud prevention or government agencies).

This information may include:

• personal details such as name, address, date of birth ; information obtained during screening and due diligence checks;
• communications to and from the us, and information stored or processed on bank IT systems, databases, and document management systems; and
• where permitted by law, information relating to criminal convictions or offences and alleged offences for specific and limited activities and purposes, such as to perform checks to prevent and detect crime, to comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption, and for international sanctions.

Your personal information may be stored and processed in the following ways and for the following purposes;

• to check your identity and process and manage your appointment as a mortgage broker including assessing your suitability
• to carry out adverse media checks, screening against external databases and sanctions lists and establishing connections to politically exposed persons. This may include information relating to criminal offences obtained from pre-registration screening;
• for the day to day management of your role as a mortgage broker (such as processing your registration, interactions with our regulators; statutory and regulatory filings within all jurisdictions where we operate; providing you with advice and support; for inclusion on internal and external websites; and communicating with you)
• to monitor and record communications and telephone conversations between us and you. We will only undertake monitoring for preventing and detecting possible criminal activity; to ensure compliance with the bank’s internal policies; to comply with local laws and regulations and to check for viruses or other threats to our IT systems. We will comply with all local laws, regulations and internal policies when doing so.  Those recordings may be used by us in evidence in the event of a dispute with you or our customer with whom you are associated; and
• to provide you with the fees to which you are entitled.

We are entitled to use your personal information in these ways because:

• it is necessary for the performance of our contract with you (for example for the provision of your services and for remuneration);
• we have legal and regulatory obligations to prevent and detect crime, money laundering, fraud, terrorist financing, bribery and corruption, and to comply with international sanctions;
• the use of your personal information is necessary for our legitimate business interests (or the legitimate interests of one or more of our affiliates), in the course of running our business, or to establish, exercise and defend our legal rights; or
• in relation to processing information relating to criminal convictions or offences, to comply with relevant laws and regulations, to prevent or detect unlawful acts, to exercise or defend our legal rights or in connection with legal proceedings, or where we have obtained your explicit consent.

We may need to share your personal information with colleagues in the bank (including our suppliers and other NatWest Group companies). We will take steps to ensure that the personal information is accessed only by employees that have a need to do so for the purposes described in this notice.

We may also share your personal information outside of the NatWest Group:

• with credit reference and fraud prevention agencies for the purposes of confirming your identity and to comply with regulatory obligations to prevent and detect crime, money laundering and fraud;
• to third party suppliers, agents or vendors for the purposes of providing services to us, including third parties carrying out due diligence and screening checks on our behalf. These third parties will be subject to confidentiality requirements and they will only use your personal information as described in this privacy notice;
• if we sell any of our business or assets or if we are acquired by a third party, in which case we may disclose your personal information to the prospective buyer for due diligence purposes;
• courts, regulators, government bodies and similar organisations as required by law (such as the Financial Conduct Authority, Prudential Regulatory Authority, or local equivalents);
• with compliance departments responsible for overseeing your conduct where they reasonably request it
  
• corporate auditors and legal or other advisors; and
• to the extent required by law, for example if we are under a duty to disclose your personal information in order to comply with any legal obligation, or to establish, exercise or defend our legal rights.

Your personal information may be transferred outside the European Economic Area (“EEA”) and processed by us, our affiliates or suppliers outside of the EEA.

Where we transfer your personal information outside the EEA, we will ensure that it is protected in a manner that is consistent with how your personal information will be protected by us in the EEA. This can be done in a number of ways, for instance the country that we send the information to might be approved by the European Commission; or  the recipient may have signed up to a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal information. In other circumstances the law may permit us to otherwise transfer your personal information outside the EEA.

In all cases, however, we will ensure that any transfer of your personal information is compliant with applicable data protection law.

You can obtain more details of the protection given to your personal information when it is transferred outside the EEA (including a copy of the standard information protection clauses which we have entered into with recipients of your personal information) by contacting us in accordance with the “Contacting us” section below.

Your information will be retained in line with our internal records management policies and retention schedules. How long we hold your personal information for will vary. The retention period will be determined by various criteria including the type of record in which your information is included; the purpose for which we are using it (we will need to keep the information for as long as is necessary for that purpose); and legal obligations (laws or regulation may set a minimum period for which we have to keep your personal information).

We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies or our regulators. This is intended to make sure that the bank will be able to produce records as evidence, if they're needed.

You have a number of legal rights in relation to the personal information that we hold about you. These rights include:

• the right to obtain information regarding the processing of your personal information and access to the personal information which we hold about you;
• where we rely on your consent, the right to withdraw your consent to our processing of your personal information at any time. Please note, however, that we may still be entitled to process your personal information if we have another legitimate reason (other than consent) for doing so;
• in some circumstances, the right to receive some personal information in a structured, commonly used and machine-readable format and/or request that we transmit those information to a third party where this is technically feasible. Please note that this right only applies to personal information which you have provided to us;
• the right to request that we rectify your personal information if it is inaccurate or incomplete;
• the right to request that we erase your personal information in certain circumstances. Please note that there may be circumstances where you ask us to erase your personal information but we are legally entitled, and in some cases obliged, to retain it;
• the right to object to, and the right to request that we restrict, our processing of your personal information in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your personal information but we are legally entitled to continue processing your personal information and / or to refuse that request; and
• the right to lodge a complaint with the data protection regulator (details of which are provided below) if you think that any of your rights have been infringed by us.

You can exercise your rights by contacting us using the details set out in the “Contacting us” section below. It is important to understand that in some cases, exercising your rights may mean that we are no longer able to use your services.

You can find out more information about your rights by contacting the Information Commissioner’s Office, or by searching their website at https://ico.org.uk/

If you would like further information on the collection, use, disclosure, transfer or processing of your personal information or the exercise of any of the rights listed above, you can contact us at 0345 900 1110.