Allay may also collect and receive the following information:

• a) Complaint Information relating to the nature of a complaint
• b) Billing and other information. Customer payment information for processing the collection of a fee along with a billing address retained securely only until the appropriate payment of the fee has been made
• c) Whenever you visit Allay.co.uk we may record your IP address, device information such as desktop or mobile etc. and operating systems or software versions and browser type/version
• d) A password to enable you to log into your dedicated account within our client management system and associate information as and when you access the system
• e) Third party data. We may also receive information from selected data suppliers, our regulators, The Financial Ombudsman, our partners, or others that we use to provide our service/s to you.

The information we collect about you is used for the purpose for which it was provided. We may also use data relating to your claim to make decisions about what services and offers we think you may be interested in. If you are a client, you can update your communication preferences by emailing mydata@allay.co.uk. We may also use your information to provide and improve our products and services.

We also use your information for other parts of our service. This includes:

• a) Researching and analysing trends to better understand how users are using the services and improve to them.
• b) Communicating with you by responding to your queries or requests.
• c) Sending service and administrative emails and messages to inform you about changes in our services, and important service related notices.
• d) Important service related notices such as security and fraud advice. Under current legislation, these notifications are considered compulsory and for your protection, you cannot opt-out of them.
• e) Sending communications about new product features or other news about Allay. You can opt out of these at any time by emailing mydata@allay.co.uk to have your preferences updated.
• f) Billing and account management information to administer accounts and keep track of billing and payments, such as communicating with you for invoicing, account management and similar reasons.
• g) Carrying out investigations to keep our services secure and to prevent abuse and fraud.
• h) Making you aware of services we think you may be interested in.

You provide us with details of what we ‘can do’ with your Data and have the right to opt-in and importantly to opt-out by emailing mydata@allay.co.uk to have your preferences updated.

If you are a client, you can request to see a copy of what personal data we hold relating to you. As a client, you have the following rights:

• To know that your data is being processed
• To access your personal data free of charge
• To data portability
• To have your information corrected if inaccurate (Including ensuring any third party puts right any inaccuracy)
• To request that your data be erased
• To restrict processing
• To object to processing and;
• To rights relating to automated decision making

If you have a complaint about our information rights practices and data protection, please contact our Data Protection Officer at mydata@allay.co.uk. If we are unable to resolve your concern, you can raise the matter with the Information Commissioner’s Office (ICO) by telephoning their helpline 0303 123 1113.

The ICO will use the information you have provided, including our response to your concerns, to decide if your concern provides an opportunity to improve information rights practice.

If the ICO think it does provide that opportunity, they will take appropriate action. This could take a variety of forms. You should raise the matter with the ICO within three months of your last meaningful contact with us regarding the complaint.

There may be times when you contact us to discuss a specific aspect relating to the service/s we provide. You will usually communicate with a member of our team. To provide the most effective service we may share the subject matter of your communication with any of the third parties with whom we need to share information to fulfil our obligation to you. The following are recipients of personal data: lenders, investment companies, insurers, administrators, Financial Ombudsman Service, our regulator.

Of the data we process, we retain the data for no longer than necessary in accordance with our Legal Basis for Processing Table (please see further down) and maintain a data retention policy. When a data subject contracts with us to provide a service, the data is retained within secure electronic archives as required by law but for no longer than 6 years after the conclusion of the service provided.

*Where reasonably practicable access to data is restricted so not to be identifiable unless required by law or is subject to a Subject Access Request.

The Allay Group recognise the personal nature of the information we collect, process and store. As we are committed to ensuring that your information is secure we have put in place suitable physical, electronic and managerial procedures to prevent loss, unauthorised access, misuse or disclosure and to make sure that your online information is safe and secure. If password access is required for certain parts of our website/application, you are responsible for keeping this password confidential.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

You may not transfer any of your rights under this privacy policy to any other person. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected. If any court or competent authority finds that any provision of this privacy policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this privacy policy will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.

LEGAL BASIS FOR PROCESSING TABLE – ALLAY GROUP