Privacy Notice

2. Our Commitment to your Privacy

We are committed to:

• Protecting your personal information
• Processing your data lawfully, fairly, and transparently
• Keeping your information secure
• Allowing you control over how your data is used
• Not selling your personal data
• Providing you with access to your rights
• Ensuring all suppliers follow strict security and confidentiality standards

3. About Us

Data Controller:

No1 Police Credit Union trading as No1 CopperPot Credit Union
Registered address: Slater House, Oakfield Road, Cheadle Royal Business Park, Cheadle, Cheshire SK8 3GX
ICO Registration Number: Z7902893
Authorised and regulated by the FCA and PRA: 213301
Registered in England and Wales under company number: IP000078

Data Protection Requests:

Email: info@no1copperpot.com
Phone: 0161 741 3160
Address: Slater House, Oakfield Road, Cheadle Royal Business Park, Cheadle, Cheshire SK8 3GX

4. Where We Collect Your Personal Information From

Information You Provide Directly

Information from Third Parties

5. Types of Personal Data We Collect

6. How We Use Your Personal Data & Our Lawful Bases for Processing

We only use your personal data where we have a lawful reason to do so under the UK GDPR and the Data Protection Act 2018. This section explains why we process your information, how it is used, and the relevant lawful basis.

We may rely on more than one lawful basis depending on the processing activity.

How We Use Your Personal Data – Lawful Basis Explained

Call Monitoring and Recording

Calls may be monitored or recorded to check instructions, resolve queries, improve service, or prevent fraud. Conversations may also be used for staff training.

Special Category Data

In some circumstances, we may need to collect and use special category data. This type of information is more sensitive and receives additional legal protection under the UK GDPR and the Data Protection Act 2018. We do not routinely collect special category data. We only process it when:

• You choose to provide it
• It is strictly necessary for a specific service, legal requirement, or to protect you from financial harm
• We have a lawful condition under Article 9, plus any required UK exemptions under the Data Protection Act 2018.

Whenever we process special category information, we:

• Collect as little as possible
• Apply additional security
• Use it only for the purpose explained to you, and

The categories below explain when and why this type of data may be processed, and the lawful condition that applies. This list does not mean we always collect these data types, only that we may need to in limited, clearly defined situations.

These are extra situations where the law allows us to use special category or criminal offence data. We only use the minimum amount needed, and only when it is strictly necessary.

Criminal Offence Data

Under UK GDPR, criminal offence data is not special category data, but it does require strict additional protection under Data Protection Act 2018, Schedule 1. We only process this information when the law allows it, and we keep it secure, restricted and audited.

Children’s Data

Any information collected about children is strictly used for providing and managing credit union services and is never used for marketing or shared with third parties unless required by law. We comply fully with relevant data protection legislation to safeguard children’s privacy, and parents or guardians may request details about the data held or ask for corrections at any time.

7. Automated Decision-Making & Profiling

How we use automated systems

We sometimes use automated systems to help us make decisions about you. This can include decisions about creditworthiness, affordability, or identifying potential fraud. These systems may use information from your applications, account activity, Credit Reference Agencies (CRAs), Fraud Prevention Agencies (FPAs), and internal risk models.

Important: We do not necessarily use all these automated processes at the moment, but we may do so in the future. We will always make sure any automated decisions are fair, legal, and secure.

Automated assessment for account opening

When you apply for a loan or savings account, we may use automated systems called to help assess your application.

• The system may provide a recommendation to our colleagues to support decision-making.
• Automated decision making tools are designed to use only the personal information necessary for their purpose and operate under strict access controls. They help make decisions more quickly and consistently and are subject to measures intended to promote fairness.
• Multiple checks may appear on your credit file, but for credit scoring purposes, these usually have the same effect as a single application.
• These checks may use information from credit reports, affordability assessments, or other relevant sources.
• Identity verification or account checks may be required by law, for example, to prevent fraud or comply with anti-money laundering rules.

Automated decisions help with:

• Credit scoring and lending decisions
• Affordability assessments
• Fraud prevention and detection
• Behavioural analysis for responsible lending

Your rights regarding automated decisions

Where an automated decision has a legal or significant effect, you have the right to:

• Request a human review
• Express your point of view
• Challenge the decision
• Receive an explanation of how the decision was reached

Table of common automated decision types

8. AI Chatbot

We may use an AI powered chatbot to assist with enquiries, provide product information, and guide you through our services.

Current Data Use:

• Currently, the chatbot only sees limited information, such as your IP address and a generalised location. Chat conversations are not stored against your IP and cannot be used to identify you.
• Our chatbot provider has a dedicated Data Protection Officer to ensure all data is handled securely and in line with UK GDPR.
• Visitor data is automatically deleted 30 days after a chat conversation.
• The provider has a dedicated Data Protection Officer to oversee data handling.

Potential Future Use:

In the future, the chatbot may be enhanced to access additional personal information you provide (for example, account or membership data) to deliver a more complete and personalised service. Any expansion of data use will still comply with UK data protection law, and only the information necessary for the chatbot to function will be processed.

Your Rights with the Chatbot

• You can request human assistance instead of interacting with the chatbot.
• You can ask what information is being used for responses.
• You can object to the processing of personal data for chatbot interactions if this is based on legitimate interest.

9. Sharing and Disclosing Your Personal Information

We only share your personal information where it is necessary to provide services, comply with legal obligations, or protect against fraud. All processors acting on our behalf must follow our instructions, comply with this Privacy Notice, and meet appropriate confidentiality and security standards.

We use a range of measures to keep your data safe, including encryption, secure networks, and access controls.

Organisations we may share your information with:

Sharing Anonymous or Aggregated Data

We may share anonymised or aggregated data for research, marketing, or trend analysis. This data cannot identify you.

10. Credit Reference & Fraud Prevention Agencies

We work with external agencies to help us manage accounts, prevent fraud, and meet regulatory requirements. These include Credit Reference Agencies (CRAs) and Fraud Prevention Agencies (FPAs).

We may use one, two, or all three of the main CRAs (Experian, Equifax, TransUnion), and may also use other CRAs as required, depending on the purpose. Information may be shared with these agencies, and they may also provide information about you.

We only share your personal information when it is necessary for a specific purpose, such as credit checks, fraud prevention, regulatory compliance, or providing our services. Any third party processing your data must follow our instructions and comply fully with data protection laws. We may also share anonymised or aggregated data for research, statistics, or service improvements, but this is not personal data.

Some of the data we receive from CRAs and FPAs may be used to support automated or semi automated decisions, for example assessing credit applications or detecting potential fraud. You have the right to request a human review, contest a decision, or receive an explanation if such a decision has a legal or significant impact on you.

Credit Reference Agencies (CRAs)

CRAs may record multiple searches, link your record with spouses, partners, or co applicants, and retain settled or defaulted account details. For more information, see the CRA Information Notices (links above).

CRAs may record multiple searches, link your record with spouses, partners, or co applicants, and retain settled or defaulted account details. For more information, see the CRA Information Notices (links above).

Fraud Prevention Agencies (FRAs)

We use your personal information to help detect and prevent fraud, financial crime, and money laundering. This includes:

• Checking account activity for unusual or potentially fraudulent behaviour.
• Temporarily blocking accounts or restricting access if a risk is identified.
• Sharing information with FPAs and law enforcement when required by law.
• Keeping records of potential risks for up to six years.

Important: Both we and FPAs can only use your personal information if there is a valid reason, either to comply with the law or under a legitimate interest. Data may also be shared with law enforcement agencies to detect, investigate, prevent, and prosecute crime. Automated decision making may be applied to detect suspicious activity.

CRA and FPA records may be retained for up to six years, depending on the type of data and applicable regulations. This includes records of credit agreements, settled or defaulted accounts, and fraud prevention data.

CRA and FPA records can affect your ability to access credit or other services in the future. Your records may be linked with a spouse, partner, or co-applicant. You have the right to request that such links are removed, provided you can show that you no longer share financial responsibilities.

11. Your Rights

You have several rights regarding the personal information we hold about you. If you wish to exercise any of these rights, we may ask you to verify your identity to protect your data.

Your key rights:

12. Audits and Regulatory Requirements

We may share your information with auditors and regulators to comply with legal and regulatory obligations.

• External Audits: Required by law to ensure compliance and assess processes.
• Internal Audits: Conducted by the Credit Union or appointed auditors.
• Regulators: The Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) and other authorities may request information, which we must provide.

13. Safeguarding and Security Measures

We take your privacy seriously and use multiple layers of security to protect your information, including:

• SSL/TLS encryption
• Access restrictions and IT authentication
• Firewalls and anti-malware protection

Sensitive data relating to you is not subject to any additional encryption methods. It is safeguarded using the same security measures applied to all other data, as outlined above.

All colleagues and third party providers are required to follow strict security and compliance measures.

14. Transfers Outside the UK and EEA

We may transfer your personal information outside the UK and European Economic Area (EEA) only to:

• Follow your instructions (e.g., issuing a statement)
• Comply with legal duties (e.g., tax reporting)
• Work with suppliers who help run our services

When we transfer data outside the UK/EEA, we ensure it is protected to the same standards as in the UK/EEA by using:
• Data sharing agreements/contracts
• Transfers only to countries with equivalent privacy protections to the UK

15. Marketing, Cookies, and Email Tracking

Marketing

We may use your personal data to suggest products or services that may interest you, based either on your consent or our legitimate interests, provided these do not override your rights. Marketing communications will only be sent with your consent or where we have a valid business reason. You can opt out of marketing at any time and we may ask you to update preferences if you take a new product or service. If you consent, we may send marketing material via email, post, or text. You can withdraw your consent at any time. Some marketing may rely on cookies, which require your acceptance. Regardless of your preferences, we will continue to send essential updates about your existing products and services.

We use information you provide, data from your use of our services, and external sources (such as credit reference agencies) to determine relevant offers, a process known as profiling. You may ask us to stop using your data for these purposes at any time.

We do not sell the personal information we have about you to outside organisations.

Cookies and Tracking

We use cookies and similar tracking technologies on our website and emails to improve user experience. Cookies may store information about your preferences, but not your personal identification unless you’ve consented. Cookies are small computer files that get sent down to your PC, tablet, or mobile phone by websites when you visit them. They stay on your device and get sent back to the website they came from when you go there again. All data is protected by this Privacy Notice. To find out more about how we use cookies please see our cookie privacy notice by clicking here.

Email Tracking

We track emails to help us improve the communications we send. We use small images called pixels within our emails to tell us things like whether you opened the email and how many times. We may also set a cookie to find out if you clicked on any links in the email.

16. Consequences of Not Providing Data

Providing personal information is necessary for us to deliver services and comply with legal obligations. If you do not provide the required information:

• It could delay or prevent us from meeting our legal or contractual duties.
• We may be unable to offer a product or service you request.
• We may need to cancel a product or service you hold with us.

Whenever information we ask for is optional, we will make this clear when we collect it.

17. How Long We Keep Your Data

We keep your personal information only for as long as we need it. This depends on our legal obligations, our business needs, and your relationship with us.

While You Are a Member

We keep your personal information for the duration of your membership so we can manage your accounts, provide services, and meet our legal and regulatory duties.

After Your Membership Ends

Most of your personal information is securely deleted six years after you leave the Credit Union. However, we may keep some information for up to 10 years for reasons such as:

• Responding to questions, complaints, or legal claims
• Proving we met our obligations and provided fair outcomes
• Meeting legal or regulatory record-keeping requirements (for example, Money Laundering Regulations require us to keep some records for between 5 and 10 years)
• Internal analysis or research that does not identify you individually

When We Need to Keep Information for Longer

In some cases, we may need to keep certain information beyond 10 years if we cannot legally delete it. For example, we must keep specific details on our member register (name, address, date of birth, email address, dates of joining and leaving, and some account information) under Section 30 of the Co-operative and Community Benefit Societies Act.

Defaulted Accounts

If an account is not fully repaid, we keep information about the default indefinitely. This is because you continue to be classed as a member, and we may need this information to make responsible decisions about any future accounts or applications.

18. How to Make a Complaint

We want you to be happy with how we use and protect your personal information. If you are ever unhappy or concerned, please tell us so we can put things right.

How to contact us

You can make a complaint about how we have handled your personal information by:

Email: info@no1copperpot.com

Phone: 0161 741 3160

Post: No1 CopperPot Credit Union Slater House, Oakfield Road Cheadle Royal Business Park Cheadle, Cheshire SK8 3GX

We will investigate your complaint and respond as soon as possible.

If you are still not satisfied You also have the right to complain to the Information Commissioner’s Office (ICO), who oversees data protection in the UK. They can be contacted:

• Online: via the ICO website https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113

The ICO will usually ask that you try to resolve your complaint with us first.

No1 CopperPot Credit Union, Privacy Notice, Version 10, updated 10th January 2026.