Privacy Policy

Brent Shrine Credit Union Limited trading as My Community Bank
Effective date: 27 August 2026

You can also download this privacy policy as a PDF, or phone 0113 487 2491 if you would like a copy sent to you.

Contents

  1. About this Policy
  2. Contacts
  3. What Is Personal Information?
  4. What Information We Collect And Process About You
  5. How We Collect Information About You
  6. How And Why We Use Your Information
  7. Marketing
  8. Information We Share
  9. Consequences Of Processing
  10. Consolidation Loans Supported By Fair4all
  11. What Cookies And Other Technologies Do We Use?
  12. International Transfers
  13. Your Rights
  14. How Do We Use Automated Decision-Making?
  15. Data Retention
  16. How Do We Link To Other Sites?
  17. How To Find Out More

About this Policy

My Community Bank is a trading name of Brent Shrine Credit Union Limited. My Community Bank is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Reference number 213245.

The purpose of this policy is to inform you how My Community Bank gathers and processes your personal information. This policy explains how we use your personal information when you are a member of My Community Bank, when you get a quote from us, apply for a product or when you visit our website www.mycommunitybank.co.uk.

When we collect and use your personal data we are subject to the UK General Data Protection Regulation (GDPR). My Community Bank is the “Controller” of your personal information under the GDPR. We are registered with the Information Commissioner’s Office (ICO), the supervisory authority for data protection within the United Kingdom; our registration number is Z7810002.

This policy provides you with information regarding your rights and obligations, and explains how, why and when we collect and process your personal data. It also explains how to contact us or supervisory authorities in the event you have a complaint.

We may update this policy at any time but if we do so, the updated copy of this policy will be available at: https://mycommunitybank.co.uk/privacy-policy/

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you.

Contacts

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If anything is unclear or you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details set out below:

Data Protection Officer

  • Email address: mcblegalcompliance@mycommunitybank.co.uk
  • Postal address: Data Protection Officer, My Community Bank, 30 Churchill Place, Canary Wharf, London E14 5RE, UK.
  • Telephone number: 0113 487 2491.

What Is Personal Information?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

What Information We Collect And Process About You

We need to collect certain types of information to allow us to make a decision on your request for financial products and membership of the credit union. We also need to comply with legal and regulatory requirements relating to Anti-Fraud, Anti-Money Laundering and Know Your Customer. If you choose not to provide some or all of the information requested, we cannot make a decision whether to provide you with a product or accept you as a member.

We will only collect the information we need to be able to make you a member and provide you with the product you have requested. You need to make sure that the information you provide is accurate, complete and not misleading.

Your personal information may need to be disclosed when we are obliged to by law, for purposes of national security, taxation, defence of a legal claim or criminal investigations.

Personal Information we collect about you depends on the particular products we provide to you. We may collect and use the following personal information about you:

  • personal details including your name, postal address, phone number(s), email address, date of birth, employment status and home ownership details;
  • financial and banking information including account details and transactional information;
  • demographic and lifestyle information;
  • information collected from politically exposed persons (PEPs) and sanction screening providers, Credit and Fraud Prevention agencies at the point you first enquire about your loan and on an ongoing basis as we manage your account;
  • details of the products you have with us including all related transactions;
  • details of any contact that we have had with you;
  • details of how you applied for your product (for example which browser you applied with, location and device information);
  • notes of any telephone, email or other communication with you;
  • information collected through customer feedback surveys;
  • information that we gather to check that you are eligible to become a member, including information such as your professional online presence (e.g. your LinkedIn profile and other public websites which show your professional occupation); and
  • other details provided by you to help us to assess the suitability for our products.

In some circumstances, we may also collect and process certain “special categories” of information, that are given a higher level of protection under GDPR. The special category information we may collect about you is information about your:

  • trade union membership (if applicable); and
  • health.

How We Collect Information About You

We collect your personal information in the following ways:

  • Information submitted through our website or through our partner websites. Partner websites include comparison websites that you may use to identify potential products and obtain quotes, and any credit broker that we partner with to find customers. This information includes information gathered through any application forms which you complete on either our or our partners’ websites;
  • Information which we receive from third parties when making a decision about you, your product application including information collected from Credit Reference Agencies, Fraud Prevention Agencies and politically exposed persons (PEPs) and sanction screening providers;
  • Information that we gather through your interactions with us, including when you correspond with us and information we gather when you make loan repayments;
  • From public sources that we use to check your eligibility to become a member, for instance the Companies House register and LinkedIn;
  • From the insolvency register;
  • From the ‘Open Register’ (which is an extract of the electoral register) and search engine results; and
  • from cookies on our website – for more information on our use of cookies, please see our Cookie Policy.

How And Why We Use Your Information

Under data protection law, we can only use your personal information if we have a proper reason, known as a “lawful basis” under GDPR. The lawful bases that we can rely on to use your personal information under GDPR include:

  • where you have given consent;
  • to comply with our legal and regulatory obligations;
  • for the performance of a contract with you or to take steps at your request before entering into a contract; or
  • for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. Please note that if you do not agree to provide us with requested information, it may not be possible for us to continue to operate your account and/or provide products to you.

The table below explains what we use your personal data for and why. Please note that if we have offered you a consolidation loan, we may collect further personal data about you. For more information about our use of your data in this context, please see the section titled “Consolidation Loans Supported By Fair4all”.

What we use your personal data for Our lawful basis
Providing products to you To perform our contract with you or to take steps at your request before entering into a contract
Preventing and detecting fraud against you or us For our legitimate interest, i.e. to minimise fraud that could be damaging for you and/or us
Conducting checks to identify our customers and verify their identity To comply with our legal and regulatory obligations
Screening for politically exposed persons (PEPs), financial and other sanctions or embargoes To comply with our legal and regulatory obligations
Other activities necessary to comply with legal and regulatory obligations that apply to our business, e.g. under rules issued by our regulator To comply with our legal and regulatory obligations
To enforce legal rights, recover any debt you owe us or defend or undertake legal proceedings For our legitimate interests, i.e. to protect our business, interests and rights
Gathering and providing information required by or relating to regulatory audits, tax reporting, enquiries or investigations by regulatory bodies To comply with our legal and regulatory obligations
Ensuring business policies are adhered to, e.g. policies covering security and internet use For our legitimate interests, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you
Operational reasons, such as improving efficiency, training and quality control For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best price
Ensuring the confidentiality of commercially sensitive information Depending on the circumstances:
— for our legitimate interests, i.e. to protect trade secrets and other commercially valuable information;
— to comply with our legal and regulatory obligations, i.e. to keep your personal information secure
Statistical analysis to help us manage our business, e.g. in relation to our customer base, product range or other efficiency measures and research to help us to improve our products and our credit models For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best value
Protecting the security of our systems and our data Depending on the circumstances:
— for our legitimate interests, i.e. to prevent and detect criminal activity that could be damaging for you and/or us;
— to comply with our legal and regulatory obligations
Updating and enhancing customer records Depending on the circumstances:
— to perform our contract with you or to take steps at your request before entering into a contract;
— to comply with our legal and regulatory obligations to keep our records up to date;
— for our legitimate interests, e.g. making sure that we can keep in touch with our customers about existing and new products
Statutory returns To comply with our legal and regulatory obligations
Marketing our products to:
— existing and former customers;
— third parties who have previously expressed an interest in our products;
— third parties with whom we have had no previous dealings.		 Depending on the circumstances:
— with your consent;
— in other cases, and where permitted by law, for our legitimate interests, i.e. to promote our business to existing and former customers
Credit reference checks via external credit reference agencies For our legitimate interests, i.e. to ensure our customers are likely to be able to afford our products
— to comply with our legal and regulatory obligations
External audits and quality checks, e.g. for the audit of our accounts — to comply with our legal and regulatory obligations
— for our legitimate interests in ensuring service quality, compliance, and effective internal audit
To share your personal data with third parties that will or may invest in our business (and professional advisors acting on our or their behalf) in connection with a corporate transaction or restructuring, including a merger, acquisition, asset sale, or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary. Depending on the circumstances:
— to comply with our legal and regulatory obligations;
— in other cases, for our legitimate interests, i.e. to protect, realise or grow the value in our business and assets.

How And Why We Use Your Personal Data – Special Category Personal Data

When we process special category data, we also need a special category data condition under GDPR. We rely on the following special category data conditions:

  • personal data revealing trade union membership – we process this data with your explicit consent when this is necessary to confirm your eligibility for membership.
  • data concerning health – we process this data when we have your explicit consent or where the processing is necessary to protect your vital interests where you are physically or legally incapable of giving consent.

Marketing

Where we have your consent or we are otherwise legally permitted, we may use your personal data to send you updates (by email and text message) about our products, including exclusive offers, promotions or new products.

You have the right to opt out of receiving marketing communications at any time by:

  • by logging into your online account and amending details there;
  • by emailing us at friends@mycommunitybank.co.uk,
  • by calling us on 0113 487 2491; or
  • clicking on the link in marketing communication itself.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never share it with other organisations for marketing purposes.

Information We Share

Subject to applicable data protection law, we may share your personal data with our service providers and other third parties as explained below.

We share personal data with:

  • firms and businesses that help us provide you with the right product and services such as Credit Reference Agencies such as TransUnion LLC and Experian, ID verification services and fraud prevention agencies;
  • any organisation which supports our business or any of our products that you have applied for. e.g. our IT partners such as Greenlight Computers Ltd and Mambu GmbH;
  • Our outsourced service provider Lantern Debt Recovery Services Limited;
  • Payment processors such as Acquired Ltd and Bottomline to process your card and Direct Debit payments. More information on how they process your personal data and your data protection rights, including your right to object, is available in the Acquired Privacy Policy and Bottomline Privacy Policy respectively;
  • communications service providers offering mail, email and SMS text services such as Critiqom Ltd;
  • debt collection agencies, debt tracing services and debt management companies such as TDX Group Limited, Sonex3 Ltd (trading as Lantern), Town & Country Legal Services LLP, The Digital DRA, ARC Europe Limited and Credit Resource Solutions Limited, Philip Cohen Associates;
  • Credit Reference Agencies such as TransUnion and Experian;
  • customer survey providers in order to receive feedback and improve our services;
  • our legal and other professional advisors including auditors and direct marketing service providers;
  • third parties who you give us explicit permission to share your personal data with, for example, debt charities, your authorised third-party representative or the police if you have been the victim of fraud;
  • if you receive a loan that is supported (in whole or in part) by our partner Fair4All Finance, we share your loan details, including customer ID, name, address, age and gender with their data analytics partner to enable them to analyse the effectiveness of their funding (see the section on Consolidation Loans Supported By Fair4all below for more information);
  • applicable third parties, if we must disclose your personal data to comply with the law, or to enforce our Terms and Conditions or other agreements; or to protect the rights, property or safety of us, our customers, or others; and
  • if we are required to by law (law enforcement bodies), or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example the Police, Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), Financial Ombudsman Service (FOS) and other appropriate authorities (including authorities outside of the UK). If we identify or suspect suspicious or criminal activity we may not be able to inform you that a disclosure has been made or the reasons for it.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies and GDPR.

How Do Credit Reference And Fraud Prevention Agencies Use Your Personal Information?

In order to process your application, we will perform credit and identity checks on you with one or more Credit Reference Agencies (“CRAs”). Where you take banking services from us we may also make periodic searches at Credit Reference Agencies to manage your account with us.

We will check the following records about you (and others where applicable):

  • any records we may already have about you;
  • those held by Credit Reference Agencies (“CRAs”); and
  • those held by Fraud Prevention Agencies (“FPAs”).

CRAs supply us with public information (including from the electoral register, county court judgements and bankruptcies registers) and shared credit and fraud prevention information, including information about previous applications and the conduct of accounts in your and your financial associate(s)’ name(s).

You should be aware that whether or not your loan or savings application is successful, when you apply for a product from us and CRAs receive a search from us they will place a footprint on your credit file that may be seen by other lenders. Large numbers of applications within a short time period may affect your ability to obtain credit. This is applicable whether your application is accepted or declined.

We will send the information that you submit through our website to CRAs. This information will be recorded by them. We and other organisations may access and use this information to prevent fraud and money laundering and CRAs and FPAs may use your information for statistical analysis.

Information held by CRAs and FPAs will be disclosed to us in order to:

  • prevent criminal activity such as fraud and money laundering;
  • assess your creditworthiness and whether you can afford to take the product;
  • recover debts that you owe and trace your whereabouts;
  • manage credit accounts and other facilities and decide appropriate credit limits;
  • verify the accuracy of the data that you provide to us; and
  • make decisions on credit and other facilities for you or your business.

When you borrow from us, we will give details of your loan and how you manage it to the CRAs. If you borrow and do not repay in full and on time, the CRAs will record the outstanding debt and, in some cases, the length of time that the debt remains outstanding. Other organisations may see these updates and this may affect your ability to obtain credit in the future.

If you fall behind with your payments on a loan and a full payment or satisfactory proposal is not received within 14 Days of a “Notice of Default” being issued then a “Formal Demand” will be issued and a default registered on your credit file with CRAs.

This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe.

False Information

If you give us false or inaccurate information and we have reasonable grounds to suspect fraud or we identify fraud we may record this and may also pass this information to FPAs and other organisations involved in crime and fraud prevention including law enforcement agencies who may then access this information. If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

The Fraud Prevention Agency that we use is TransUnion LLC.

Fraud prevention agencies can hold your information for different periods of time. For the applicable periods, please see:

The Credit Reference Agencies we use are:

  • TransUnion LLC.
  • Experian

You can contact the CRAs currently operating in the UK. The information they hold may not be the same so it is worth contacting them all. They will charge you a small statutory fee.

The contact details for the CRAs we use are:

Consequences Of Processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the products you have requested, or we may stop providing existing products to you.

Consolidation Loans Supported By Fair4all

Where we have offered you a consolidation loan as part of a consolidation loan pilot project, we may collect and share some information as part of that pilot with an organisation called Fair4All Finance Limited (“Fair4All”). We are working together with Fair4All to run the consolidation loan pilot, and to see whether consolidation loans can help people to improve their financial position.

In particular, as mentioned above in the section on Information We Share, we share the following details: customer ID, name, address, age and gender with Fair4All’s data analytic partner to enable Fair4All to analyse the effectiveness of its funding. In order to share your personal data with Fair4All, we will typically rely on the lawful basis that this is in our (both My Community Bank’s and Fair4All’s) legitimate interests, i.e. our interests in being able to provide consolidation loans and understand how they are working.

In addition, we collect the following personal data and share it with Fair4All on an aggregated and anonymised basis:

  • information to see if particular people are eligible for a consolidation loan. This will help Fair4All understand which groups of people are and aren’t eligible and to make changes accordingly to try and help as many people as possible. Fair4All may also use this data for case studies to demonstrate the wider value of the pilot, and to improve future pilots and other services;
  • demographic data (including information relating to age, background (including ethnic origins), gender, disability, housing type, education level, work experience, and caring responsibilities) to help Fair4All understand how the pilot is working overall, who it is reaching, and if there are any groups of people we are not reaching who may benefit from consolidation loans;
  • certain information in the course of tracking, monitoring and analysing how people repay their loans, so that Fair4All can understand the potential benefits of consolidation loans for people in different situations, to identify common obstacles and to develop products that may be helpful to members, customers or other people;
  • information about people’s financial circumstances after they have repaid their loan (for example any changes to their credit score) so that Fair4All to assess how effective the pilot is in the long run; and
  • information that people provide to us as part of any surveys that we or Fair4All ask them to complete at different stages of the loan process.

We will only share this data with Fair4All on an aggregated and anonymised basis, meaning that it will not be personal data at the point that we share it with Fair4All, and Fair4All will not be able to identify you from the data – we are sharing the data so that Fair4All can understand if the pilot is working, how they can make it better, and how they can help more people in the future.

What Cookies And Other Technologies Do We Use?

Our Cookie Policy explains in more detail what types of cookie we use, why we use them and how to identify and disable them.

We may use cookie technology on our website to collect some of the information detailed in this policy. Cookies are small text files stored on your device or internet browser when you visit us. We use cookies mainly to improve the performance of the My Community Bank website and our service for customers.

When a visitor requests any page from our web site, our web servers automatically obtain that visitor’s domain name and IP address. This information does not contain sensitive data about our users and is critical to the functioning of all websites. An IP address serves as the return address, much like a post code, of your device when you request to see a webpage which allows us to send the information you want back to you. We only use this data to investigate and prevent fraud or abuse of our website.

As part of our commitment towards transparency and customer data privacy, we need to ask for your consent to set some of the cookies described in our cookie policy. When you arrive on our website you will be asked for your consent to place these cookies on your device. If you, or another user of your computer, wish to withdraw your consent at any time, you can do so by changing your settings in the cookie consent tool.

International Transfers

We may transfer your personal information outside the UK. For example, where one of our suppliers is based outside the UK, we will transfer your personal information to the country where the supplier is located.

Under GDPR, we can only transfer your personal data to a country outside the UK where:

  • the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the GDPR. A list of countries the UK currently has adequacy regulations in relation to is available from the Information Commissioner’s Office;
  • there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
  • a specific exception applies under relevant data protection law.

Where we transfer your personal information outside the UK, we do so on the basis of an adequacy regulation or (where this is not available) legally-approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

Your Rights

You have certain rights in relation to your information including a right to access or to correct the information we hold on you. We have listed the rights you have over your information and how you can use them below.

These rights may only apply in certain circumstances and may be limited if there are outstanding contracts between us, if we are required by law to keep the information or if the information is relevant to a legal dispute.

You have the following rights, which you can exercise free of charge:

Access The right to be provided with a copy of your personal data
Rectification The right to require us to correct any mistakes in your personal data
Erasure (also known as the right to be forgotten) The right to require us to delete your personal data—in certain situations
Restriction of processing The right to require us to restrict processing of your personal data in certain circumstances, e.g. if you contest the accuracy of the data
Data portability The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To object The right to object:
— at any time to your personal data being processed for direct marketing (including profiling);
— where our legal basis for processing is legitimate interests as explained in the table above) unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims
Not to be subject to automated individual decision making The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
The right to withdraw consents If you have provided us with a consent to use your personal information you have a right to withdraw that consent easily at any time. Withdrawing a consent will not affect the lawfulness of our use of your personal information in reliance on that consent before it was withdrawn.

For more information on each of those rights, including the circumstances in which they apply, please contact our Data Protection Officer using the contact details at the beginning of this policy or see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights.

If you would like to exercise any of those rights, please contact our Data Protection Officer using the details at the beginning of this policy and:

  • provide enough information to identify yourself e.g. your full name, email, home address and number and any additional identity information we may reasonably request from you; and
  • let us know what right you want to exercise and the information to which your request relates.

Please note that where you ask us to erase, correct, object to process, or seek to restrict our processing of data we may refuse your request where we have a legal obligation, contractual, or other legitimate business interest to refuse your request. If we refuse your request then we will notify you of this refusal and explain our reasoning.

For more information on the rights set out above and when they apply, please contact us at mcblegalcompliance@mycommunitybank.co.uk or see the guidance from the UK Information Commissioner on individuals’ rights.

If you are not happy with our response, or have any other concerns about the processing of your personal data or in relation to the exercise of any of your rights, you have the right to make a complaint to us at any time. Our data protection complaints procedure, which includes details of how you can make a complaint, can be found here: Complaints Policy – My Community Bank.

You also have the right to make a complaint about the processing of your personal data or in relation to the exercise of any of your rights at any time to the ICO (www.ico.org.uk) or by telephone: 0303 123 1113. We would, however, appreciate the chance to deal with your concerns before you approach the ICO. Our data protection complaints procedure can be found here.

How Do We Use Automated Decision-Making?

We may use your personal information in automated processes to make decisions about you. You have the right not to be subject to a decision based on solely automated processing, if this will have a legal or other significant effect on you (certain exceptions apply).

We use automated decision making in:

  • checking eligibility for our products and carrying out affordability assessment. We use data collected from yourself through online forms, your usage of our site and Credit Reference Agencies and other third parties to assess your creditworthiness and affordability of the product applied for. You have the right to appeal the outcome of these automated decisions and your appeal will be reviewed by a member of our team (please contact complaints@mycommunitybank.co.uk should you wish to appeal);
  • fraud and money laundering risk identification. We may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity;
  • we may use your personal information to carry out profiling to identify whether you are suitable for products we offer and to inform you of these. This profiling will be conducted by us when assessing suitability of existing customers for top up offers. We will use profiling in conjunction with our partners when developing new prospect marketing campaigns.

Data Retention

We are legally required to keep our membership register data indefinitely, this is your:

  • name and postal address
  • email address
  • number of membership shares held
  • date you became a member
  • date you ceased to be a member

In relation to all other personal information, we will keep your personal data while you are our customer and for 7 years after you stop being a customer with us, for the following reasons:

  • to respond to any query or complaint you may have;
  • to fulfil our legal record keeping obligations; and/or
  • to defend legal claims.

After this retention period, we’ll then delete your personal data securely and safely.

How Do We Link To Other Sites?

Our website may contain hyperlinks to websites that are not operated by us. We urge you to review any privacy policy posted on any site you visit before using the site or providing any personal information about yourself.

How To Find Out More

Should you have any queries, please contact us.