Privacy Notice

Privacy Notice

Who we are:

We are Oxbury Bank Plc, One City Place, Queens Road, Chester, CH1 3BQ. Our Company Registration Number is 11383418 and we are registered with the Information Commissioner’s Office (ICO) under reference ZA511261. The United Kingdom supervisor authority, the ICO is designated as our Lead Supervisor Authority. Oxbury Bank Plc is the data controller. We recognise that the correct and lawful treatment of Personal Data will maintain confidence in Oxbury. Protecting the confidentiality and integrity of your Personal Data is a critical responsibility that we take seriously at all times. As such all our staff are responsible for protecting your Personal Data. To support them we have in place a number of policies which are regularly reviewed, and we also provide training to all staff.

Please be aware if you are using our systems from outside of the United Kingdom, you may be subject to lower privacy laws. Although we list all locations where we store or process your information to provide the service, we cannot list all locations that you as a user may choose to access your data from.

If you have any questions relating to the use of your data, or your rights please contact the Data
Protection Officer, Oxbury Bank Plc, One City Place, Queens Road, Chester, Cheshire, CH1 3BQ or at privacy@oxbury.com.

If you do not accept and agree with this Privacy Policy, you must stop using our services immediately. If you are providing information other than directly related to yourself, such as a joint account holder, you should ensure they have read this notice, by continuing to provide this information, you are confirming their acceptance of this notice.

This Privacy Notice was last updated in March 2025 and will be reviewed annually and updated, if
necessary.

How we collect and manage your data:

We collect your data in a number of ways (this is not an exhaustive list);
- Recorded telephone calls – Please be aware, inbound and outbound calls made to and from
Oxbury are recorded for training and monitoring purposes. These records are kept secure, in line with our wider privacy policy.
- Applications and expressions of interest submitted by you.
- Emails sent by you, our approved distributor network or introducer.
- Requests for documentation to support your application.
- IP addresses.

As part of your application for one of our products or to use a service from Oxbury you will share some information with us. This may be personal information, business information or farm business information. We may also receive information about you from other parties.

Throughout your relationship with Oxbury, you may also provide us with sensitive information, such as health information, which will enable us to support you and your individual needs. This data may also be shared with relevant third parties and will be kept securely, in line with the bank’s data protection policies and procedures. The following table provides a guide on whose data we receive, the types of data we receive and who gives us the data.

The technology used by Oxbury may require you to use biometric data, however Oxbury and its suppliers do not receive your biometric data. Any biometric data used in the creation of an account or authentication of your identity is only stored on your device software and is not processed by Oxbury or linked suppliers.

Why we use this data:

To provide our services to you, we use your personal data to:

• Confirm your eligibility for an account or service.
• Support us in maintaining your account and carrying out your instructions.
• Monitor, analyse and improve the services we provide.

To meet our legal obligations, we use your personal data to:

• Validate your identity.
• Prevent illegal activities such as money laundering, fraud, and tax evasion.

To meet our legitimate interests for purposes where they are not overridden because the
Processing prejudices your interests or fundamental rights and freedoms, we use your personal
data to:

• Market products and services generally to you.
• Search your record at credit reference and fraud agencies when you apply for a product or service with us.
• Increase security controls minimising the risk of fraud, this may include monitoring.
• Trace and recover debts.
• Ensure the correct technical version of the system or services are presented to you.
• Improve our services to our customers.

With your permission, we use your personal data to:

• Check your credit history if you apply for a credit product with us.
• Market products and services specifically to you via email or text message. You can unsubscribe
from these messages at any time by emailing privacy@oxbury.com
• Develop and manage our relationship with you

Passing your data to other parties:

Protecting the confidentiality and integrity of your data is a critical responsibility that we take seriously at all times. We may however, for the reasons outlined above, sometimes share your data with third parties to help deliver the products and services we provide to you. Specifically, we may share your personal data when:

• We are meeting our contractual obligations in line with our Terms and Conditions; this may include where:
o Your information relates to a joint account, where the other person(s) may be entitled to
see your transactions;
o Other parties connected to your account (e.g. guarantors) require it; and
o We need to share information with other lenders who also hold security.
o We send you communications and marketing (subject to positive opt in to receive marketing
communications)
o We wish to develop or manage our relationship with you e.g. send a welcome gift, conduct
a soil carbon assessment or confirm the geolocation of your farm.
• We are meeting our legal obligations. Specifically, we may share your personal data where:
o HMRC or other authorities require it;
o Law, a regulatory body or the public interest require it;
o Our duty to protect you requires it (e.g. Financial Services Compensation Scheme “FSCS”);
and
o To detect, investigate or prevent crime or fraud.

• You specifically give us permission to do so.
• We need to share data with partners and subcontractors who help us deliver our services to you.

Credit Reference Agencies

When you apply for a product or service with Oxbury we will perform identity and credit checks on you with a credit reference agency. We may also make periodic searches to support us in the management of your account with us.

To do this we will share your personal data with the credit reference agency and receive from them
information about you. This will include information from your credit application and about your financial situation and history. It will also include public information (e.g. electoral register) as well as shared credit, financial situation, financial history and fraud prevention information.

As long as you retain a relationship with Oxbury we will continue to exchange information with credit reference agencies. Oxbury will also advise them of your settled accounts. If you borrow from us and do not pay in full or on time the credit reference agencies will record the outstanding debt.

For further information on how credit reference agencies use data please read the Credit Reference Agency Information Notice. You can do this at www.experian.co.uk/crain 

Fraud Prevention Agencies

To help Oxbury make its contribution to fighting terrorism, money laundering, modern slavery and other criminal actives, the UK Government requires us to screen applications made to us. To support us to achieve this we share data with fraud prevention agencies. If we believe there is a risk of fraud on your account, we may block access or stop activity on it.

On an ongoing basis we will monitor your account for patterns of activity, look out for unusual transactions and monitor devices used to access Oxbury’s systems. This includes Internet Protocol (IP) addresses and may include using widely available geographical mobile phone technology to assess the location.

Cookies - What Do We Use and What For?

Our site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by us and are used only by us. We may use 3rd party Cookies to facilitate and improve your experience of Our site and to provide and improve Our products and services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy is always protected and respected. More information is found in our cookie policy here.

All Cookies used by and on our site are used in accordance with current UK Privacy and Electronic
Communications Regulations and EU Cookie Law.

General:

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, tailor any service experience and to verify your identity. These checks require us to process personal data about you.

Details of the personal information that will be processed include, but is not exhaustive, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details.

We may also process certain special categories of information which could include physical or
psychological health details or medical conditions. We will only process special categories of
information where we've obtained your specific consent or are lawfully permitted to do so, and we will only process special categories of information to detect and prevent financial crime, where it is in the wider public interest or to improve the service we offer to you.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime in accordance with the law supported by a valid request.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

We also collect, process and store your personal data to help us supply the services that we offer to you. This includes providing you the capability to access our services in a manner which protects your data confidentiality.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are
considered to pose a fraud or money laundering risk, your data can be held for up to six years.

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide on an outcome to a processing activity, for example; Your application for a lending product may have a decision made by automated means, resulting in an acceptance or decline based on the information processed as part of your application. You have rights in relation to automated decision making: if you want to know more please contact us using
privacy@oxbury.com. 

All data is stored, transformed, and transferred in accordance with our internal Information Security Policies.

All data is assessed for suitability, and we ensure Privacy Impact Assessments are done to protect your data.

Consequences of Processing:

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, we may refuse to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing, or employment to you. If you have any questions about this, please contact us on the details above.

Data Transfers:

Any data transfer to another party is assessed to ensure your data is protected.

We may transfer the data you share with us outside the UK. Where this is the case, this may be to a country where the UK Government has decided that your data will be protected to UK standards. If the transfer is to another type of country, then we will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

How long will we keep your data for?

Where you have applied for a product or service from us, we will keep your data for as long as you are a customer at Oxbury, and for a period of seven years after the end of any contractual relationship between us.

In some circumstances, for example cases of anti-money laundering or fraud, we may keep data longer if regulation or the law requires us to do so.

When you have expressed interest in our products and services but have not progressed to an
application, we will keep your personal information for a period of 36 months from your last interaction with us.

We will review marketing preferences periodically to ensure they remain up to date.

Where we store your data:

We may transfer the data you share with us outside the European Economic Area (“EEA”). Where this is the case, we will only do so with organisations and countries that:

• The European Commission say have adequate data protection standards in place; or
• We have agreed standard data protection clauses with our data processing agreements.

Before we transfer your information outside of our environment, we will ensure that suitable safeguards are in place, as required by law. We will also take reasonably necessary steps to ensure that your information is treated securely in accordance with the relevant legal requirements.

Your Rights:

You have rights over your data, and these are:

Right to be informed: You have the right to be informed about the collection and use of your personal information. This means that we should provide you with details of how we use your personal information. This Data Privacy Notice is an example of this.

Right to Access: You have the right to know what data we hold about you and the right to ask for a
copy of it - known as a Subject Access Request (SAR)

Right to Rectification: If the information we hold about you is incorrect or incomplete you have the right to tell us to correct it.

Right to Object: You have the right to object to how we use your personal data. As an example, for
marketing purposes, where we will stop if you ask us to. You should note that if we are using the data to fulfil our legal obligations we may continue to do so even if you object.

Right to Erasure: You may have the right to have some, or all, of the data we hold about you deleted. However, you should be aware that we have legal obligations to hold information about you, including after you have ended your contractual relationship with us.

Right to restrict processing: You have the right to restrict processing of your personal information. This means it can only be used for certain things, such as legal claims or to exercise legal rights. You can ask us to do so if your personal information is not accurate, has been used unlawfully, is not relevant anymore, or if you have already asked us to stop using your personal information but you are waiting for us to tell you if we are allowed to keep on using it. If we do restrict your personal information in this way, we won’t use or share it in other ways while it is restricted.

The right to data portability: You have the right to get certain personal information from us as a digital file. This means you can keep and use it yourself, and give it to other organisations if you choose to. If you want, we will give it to you in an electronic format that can be easily re-used, or you can ask us to pass it on to other organisations for you.

Rights in relation to automated decision making and profiling: You have rights around automated decision making and profiling. Automated decision making means a decision made solely by automated means, without any human involvement. Profiling means the automated processing of your personal information to evaluate certain things about you.

You have the right to information about these kinds of processing, and the right to ask for human
intervention or to challenge an automated decision. You can do this when an automated decision is made about you.

Right to withdraw Consent: You may have the right to withdraw any consent you have previously given to us.

Complaints: You have the right to complain. We will look to resolve any complaint or request with you. For details of how to complain to Oxbury please click on this https://www.oxbury.com/complaints/  or visit the complaints page on the Oxbury website. If you are not satisfied with the resolution of your complaint, you have the right to complain to the Information Commissioner’s Office which regulates the processing of personal data. You can do this at https://ico.org.uk