Last updated October 2020
This privacy notice is to let you know how Lendable gathers and processes your personal information.
We are committed to ensuring that your personal data is kept safe and we have put in place appropriate technical and other security measures to protect it.
Who are we?
We are Lendable Limited, trading as Level. Our registered office is at 128 Shoreditch High Street, London, E1 6JE and we are registered in England and Wales under company number 08828186. We are registered on the Information Commissioner’s Office (ICO) Register of Data Controllers under registration number ZA041704.
We can be contacted:
by post at Level Card, PO Box 76887, London, E1W 9RX;
Our Data Protection Office can be contacted by post at the address above.
How do we collect personal information?
We collect personal data about you in the following ways:
directly from you when you fill in forms on our site, manage your card in the Level App or correspond with us by email, phone or otherwise;
by observing how you access and use our products and services. For example, how you use our website or how you manage your accounts with us;
from organisations that have your consent to share your data with us or for a separate legal basis for a specific or defined purpose. This could include for direct marketing or assessing your eligibility for a partner’s product which may be suitable for you; and
from public sources, for instance the Companies House register, the individual insolvency register, the ‘Open Register’ part of the electoral register
from search engine results;
from third party organisations such as Credit Reference and Fraud Prevention Agencies. The Credit Reference Agencies provide information on your financial behaviour. This is referred to as your credit history and gives lenders information on how you manage your finances (including things like your mortgage, credit cards overdrafts, loans, mobile phone contracts, and utilities)
What personal information do we collect?
We may hold and use various types of personal information collected at the start of, and during your relationship with us. We will limit the collection and processing of these personal data to what is necessary to achieve the purposes identified in this notice.
The information you provide to us is must be correct, accurate, complete and not misleading.
Personal information may include:
personal details including your name, address, previous address, phone numbers, email address, date of birth, employment status and home ownership details;
financial and banking information including account details and transactional information;
demographic and lifestyle information;
information collected from Credit References and Fraud Prevention agencies. We will collect this information at the point you first enquire about your Level card and on a continuing basis as we manage your card;
details of the Level card(s) you hold and have held with us;
details of any contacts that we have had with you;
details of how you applied for your Level card (for example which browser you applied with);
Details of any contact with us including any telephone, email or other communication with you; and
information collected through customer feedback surveys;
in some circumstances we may also collect and process special categories of personal information. This is to help ensure that our services are accessible and so that we can offer appropriate levels of support where required. We will only process special category data with your explicit consent.
How do we use your personal information?
We may use your information:
to process and complete your application for a credit card;
to search Credit Reference Agencies’ and Fraud Prevention Agencies’ records;
to make an initial lending decision and to assess your eligibility for additional borrowing;
to set up and process payments and prevent fraudulent transactions;
to communicate effectively with you when applying for, agreeing to and undertaking the Level card agreement, to effectively answer and manage any questions, concerns or complaints you may have;
to update our records and maintain your account with us;
to offer you products and/or services that may be of interest to you, where you have consented to be contacted for such purposes. This may us include making periodic searches at Credit Reference Agencies;
to monitor, review and improve the content and appearance of our website, to ensure it is presented in the most effective manner for you;
to maintain and develop our business systems, including without limitation, testing and upgrading them;
to trace your whereabouts if we cannot contact you;
to recover any money you owe us;
to comply with our legal and regulatory obligations;
for any other specific purpose which we notify you of at the time your personal information is collected;
to pre-populate fields on our site to make it easier for you to navigate when you return to our website and login as an existing customer;
to help us analyse our business and develop marketing strategies, develop products and improve our advertising materials
We may monitor and record calls, emails, SMS and other communications to ensure transactions are executed correctly and for security, quality control, training and fraud prevention purposes.
Why do we process your personal information?
We will only collect and use your personal information where it is necessary for us to carry out our lawful business activities. Our grounds for processing your data are as follows
We may process your information where it is necessary to enter into a contract with you or to perform our obligations under that contract. This may include processing to:
Assess your eligibility for the products and services we provide, and
Provide and administer the products we offer, including:
setting up your account;
verifying your contact information;
collecting and providing to you required information and documents including statements and formal notices;
disbursing money and processing payments;
to manage fees, charges and interest due on your account;
to send you service communications and notices required by law;
to collect and recover outstanding sums owed to us; and
to address any enquiries or complaints we receive from you or a representative you have appointed.
We may process your data where it is a legal or statutory obligation on us. This may include processing to:
confirm your identity;
detect, investigate and report transactions in order to comply with laws relating to money laundering, financial crime and international sanctions;
assess affordability of any credit products for which you apply;
detecting, investigating and reporting financial crime, and taking measures to prevent this;
maintain records of our business as required by law, e.g. creating and keeping record of company accounts;
complying with laws which require us to provide information, directly or indirectly to any national authority, for the purpose of calculating and collection of tax;
responding to enquiries and requests for information by any of our Regulators including the Financial Conduct Authority and Information Commissioner’s Office;
creating and submitting reports required by any of our Regulators;
to otherwise meet our obligations under all laws and regulations based on law which apply to our business activities; and
where we have a duty to protect vulnerable customers.
We may process your information when we have a business or commercial reason to do so. If we do, it must not unfairly go against what is right and best for you. If we rely on our legitimate interest, we will tell you what that is. This may include processing to:
develop new products and services and identifying which may be of interest to you;
Contacting you to make you aware of such products and services, where we have the relevant permission to do so. This may include a reasonable period after your relationship has ceased with us;
statistical analysis, analytics and profiling, for example, to create scorecards, models and variables in connection with the assessment of credit, fraud, risk or to verify identities, to monitor and predict market trends, and for analysis such as loss forecasting;
monitor, review and improve the content and appearance of our website, to ensure that content from our website is presented in the most effective manner for you assess how our customers use our website, products and services;
maintain and develop our business systems, including without limitation, testing and upgrading them;
Sharing information with organisations who introduce you to us under a commercial agreement;
Sharing information to assess your creditworthiness;
To assess your eligibility for credit line increases and similar products including fixed term loans. This may include making periodic searches at Credit Reference Agencies;
To recover monies owed;
To sell debts to other firms;
To share with third parties for the purpose of preventing fraud and financial crime; and
to obtain finance for the products we provide.
Who do we share your personal information with?
We may use third party companies to provide services on our behalf. This may require these organisations to access and process your personal data.
Credit Reference Agencies;
Fraud Prevention Agencies including CIFAS;
communications service providers offering mail, email and SMS text services;
Debt Collection Agencies and Debt Management Companies and companies specialising in customer reconnection and general information gathering visits;
customer survey providers in order to receive feedback and improve our services;
IT service providers;
digital and direct marketing service providers;
trusted lenders and brokers who will assess your eligibility for their products;
A prospective assignees of your account
One of our communications service providers that we use to send customer emails is located in the USA and is covered by Privacy Shield. Data in or attached to these emails will be processed outside the EEA. It may also be processed by staff operating outside the EEA who work for our provider.
You can find out more about international controls on the ICO Website by clicking on https://ico.org.uk .
How do we use Credit Reference Agencies?
To process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take services from us we may also make periodic searches at CRAs to manage your account with us. To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
We will use this information to:
assess your creditworthiness and whether you can afford to take the product;
verify the accuracy of the data you have provided to us;
prevent criminal activity, fraud and money laundering;
manage your account(s);
trace and recover debts; and
ensure any offers provided to you are appropriate to your circumstances.
We will continue to exchange information about you with CRAs while you have a relationship with us. (Periods after where will have an obligation to report) We will also inform the CRAs about your accounts including settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt and payment performance. This information may be supplied to other organisations by CRAs.
When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
Where you have a financial association with someone your records may be linked, so you should discuss your application with them before you make it. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully file for a disassociation with the CRAs to break that link.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at https://www.transunion.co.uk/crain. Credit Reference Agency Information Notices (CRAIN) is also accessible from each of the three CRAs – clicking on any of these three links will also take you to the same CRAIN document:
How do we work with Fraud Prevention Agencies?
Before we lend to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.
The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity
Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details and device identifiers including IP address.
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
Consequences of Processing
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.
Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.
How can you amend your preferences?
When we first collect your data we will give you the opportunity amend your preferences. Any electronic marketing communications we send you will include clear and concise instructions to follow should you wish to unsubscribe at any time. You may also amend your contact preferences in the following ways or by logging into your online account and amending details there;
What are your personal data rights?
As a data subject, you have a number of rights:
the right to access the personal data we hold about you;
the right to rectify inaccurate personal data or complete it if it is incomplete;
the right to have your personal data deleted;
the right to request restriction of or suppression of your personal data;
the right to obtain and make use of your personal data for your own purposes across different services (“portability”);
the right to object to the processing of your personal data in certain circumstances; and
rights related to automated decision-making including profiling.
Your data protection rights are subject to certain restrictions and conditions and financial organisations are required to retain a range of your information for legal and regulatory reasons including responsible lending and the prevention of financial crime. We are required to keep a record of the information reported to the Credit Reference Agencies about you and will therefore retain repayment information regarding your account for six years from the end of the relationship (where your account settled and closed). If your account is recorded as defaulted, the data is kept for six years from the date of the default. This may be extended where we require this to bring or defend legal claims.
If you think that any of the personal data we hold about you is wrong or incomplete you have the right to challenge it.
We will not make a charge for handing your rights request, unless we consider it to be manifestly unfounded or excessive involving a disproportionate effort (particularly if this is repeated request). If you would like to exercise any of the rights outlined above, you can make a request by calling 020 3322 9128 or in writing by emailing firstname.lastname@example.org
We will assess your request and if we decided not to act upon it or place certain restrictions on it, we will inform you of our reasons for this.
You have the right to complain to us and to the data protection regulator; the Information Commissioner’s Office. Their address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. They can be contacted by phone on 0303 123 1113 (local rate) or 01625 545745 if you prefer to use a national rate number.
You can find details on how to report a concern at: https://ico.org.uk/make-a-complaint/
Where we require your explicit consent
We will not typically ask you for any ‘special categories’ of personal data. This is also referred to as ‘sensitive personal data’ and includes information revealing an individual's political opinions, racial or ethnic origin, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning health or data concerning an individual's sex life or sexual orientation.
We may process personal data about your health or medical conditions, where we need to understand this to provide you with support, or to make adjustments in how we provide you with information. Companies acting on our behalf specialising in customer reconnection and information gathering visits may also process personal data about your health or medical conditions for this purpose.
This information will only be processed where you have provided your consent or we are otherwise allowed or required to by law.
How long do we keep your personal information?
We will retain your personal data for as long as we are required to under relevant legislation and regulation, and where no specific rules apply, for no longer than it is necessary for our lawful purposes. This will usually be no more than six years from the end of our relationship with you. The retention period of your personal data may need to be extended where we require this to bring or defend legal claims.
We may also retain data for longer periods for statistical purposes, and if so we will anonymise this.
How do we use automated decisions?
We may use your personal data in automated processes to make decisions about you. You have the right not to be subject to a decision based on solely automated processing, if this will have a legal or other significant effect on you (certain exceptions apply).
We use automated decision making in:
credit scoring and affordability assessment. We use data collected from yourself through online forms, your use of our site and Credit Reference Agencies and other third parties to assess your creditworthiness and affordability of the product applied for. If you do not agree with the decision you have the right to appeal the outcome of these automated decisions;
risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with information that you have provided previously, or you appear to have deliberately hidden your true identity we may decide that you pose a fraud and money laundering risk
we may use your personal data in profiling to identify whether you are suitable for products and services we offer and to inform you of these. This profiling will be conducted by ourselves when assessing suitability of existing customers for new loans or credit limit increases on the Level card. We will use profiling in conjunction with our partners when developing new prospect marketing campaigns.
How do we link to other sites?
This policy explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others and how we keep it secure.
TPL is committed to safeguarding the privacy of your information. By “your data”, "your personal data”, and “your information” we mean any personal data about you which you or third parties provide to us.
We may change this Policy from time to time so please check this page regularly to ensure that you’re happy with any changes.
Who are we?
Transact Payments Limited (“TPL”, “we”, “our” or “us”) is the issuer of your card and is the Data Controller for the personal data which you provide to us in relation to the credit card only. TPL is an e-money institution, authorised and regulated by the Gibraltar Financial Services Commission. Our registered office address is 6.20 World Trade Center, 6 Bayside Road, Gibraltar, GX11 1AA and our registered company number is 108217.
Lendable Limited manages your card program and is the Data Controller for any personal data which you provide which is not related to the card. Lendable Limited is incorporated in England and Wales under company number 08828186 with its registered office at 128 Shoreditch High Street, London, E1 6JE.
How do we collect your personal data?
We collect information from you when you apply online or via a mobile application for a payments card which is issued by us. We also collect information when you use your card to make transactions. We also obtain information from third parties (such as fraud prevention agencies) who may check your personal data against any information listed on an Electoral Register and/or other databases.
On what legal basis do we process your personal data?
Your provision of your personal data and our processing of that data is necessary for each of us to carry out our obligations under the contract (known as the Cardholder Agreement or Cardholder Terms & Conditions or similar) which we enter into when you sign up for our payment services. At times, the processing may be necessary so that we can take certain steps, at your request, prior to entering into that contract, such as verifying your details or eligibility for the payment services. If you fail to provide the personal data which we request, we cannot enter into a contract to provide payment services to you or will take steps to terminate any contract which we have entered into with you.
We may also process your personal data to comply with our legal or regulatory obligations.
On occasion we may have a legitimate interest or those of a third party to process your personal data.
What type of personal data is collected from you?
When you apply for a card, we, or our partners on our behalf, collect the following information from you: full name, physical address, email address, mobile phone number, phone number, date of birth, gender, login details, IP address, identity and address verification documents.
When you use your card to make transactions, we store that transactional and financial information. This includes the date, amount, currency, card number, card name, account balances and name of the merchant, creditor or supplier (for example a supermarket or retailer). We also collect information relating to the payments which are made to/from your account.
How is your personal data used?
We use your personal data to:
maintain and administer your account, including processing your financial payments, processing the correspondence between us, monitoring your account for fraud and providing a secure internet environment for the transmission of our services.
comply with our regulatory requirements, including anti-money laundering obligations.
Who do we share your information with?
When we use third party service providers, we have a contract in place that requires them to keep your information secure and confidential.
We pass your information to the following categories of entity:
identity verification agencies to undertake required verification, regulatory and fraud prevention checks;
information security services organisations, web application hosting providers, mail support providers, network backup service providers and software/platform developers;
document destruction providers;
anyone to whom we lawfully transfer or may transfer our rights and duties under this agreement;
any third party as a result of any restructure, sale or acquisition of TPL or any associated entity, provided that any recipient uses your information for the same purposes as it was originally supplied to us and/or used by us.
regulatory and law enforcement authorities, whether they are outside or inside of the EEA, where the law requires us to do so.
Sending personal data outside of the EEA
To deliver services to you, it is sometimes necessary for us to share your personal information outside the European Economic Area (EEA), e.g.:
with service providers located outside the EEA;
if you are based outside the EEA;
where there is an international dimension to the services we are providing to you.
These transfers are subject to special rules under European and Gibraltar data protection law.
These non-EEA countries do not have the same data protection laws as Gibraltar and EEA. We will, however, ensure the transfer complies with data protection law and all personal information will be secure. We will send your data to countries where the European Commission has made an adequacy decision, meaning that it has ruled that the legislative framework in the country provides an adequate level of data protection for your personal information. You can find out more about this here.
Where we send your data to a country where the European Commission has not made an adequacy decision, our standard practice is to use standard data protection contract clauses that have been approved by the European Commission. To obtain a copy of those clauses, please go to the European Commission’s website.
If you would like further information please contact our Data Protection Officer on the details below.
How long do we store your personal data?
We will store your information for a period of five years after our business relationship ends in order that we can comply with our obligations under applicable legislation such as anti-money laundering and anti-fraud regulations. If any changes to applicable legislation require us to retain your data for a longer period of time, we shall retain it for that period. We will not retain your data for longer than is necessary.
Your rights regarding your personal data?
You have certain rights regarding the personal data which we process:
You may request a copy of some or all of it.
You may ask us to rectify any data which we hold which you believe to be inaccurate.
You may ask us to erase your personal data.
You may ask us to restrict the processing of your personal data.
You may object to the processing of your personal data.
You may ask for the right to data portability.
If you would like us to carry out any of the above, please email the Data Protection Officer at DPO@transactpaymentsltd.com.
How is your information protected?
We implement security policies and technical measures in order to secure your personal data and take steps to protect it from unauthorised access, use or disclosure.
While we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
We hope that our Data Protection Officer can resolve any query or concern you may raise about our use of your personal information.
The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in Gibraltar is the Gibraltar Regulatory Authority. Their contact details are as follows:
Gibraltar Regulatory Authority, 2nd floor, Eurotowers 4, 1 Europort Road, Gibraltar.
How to contact us