Global Arvest Banking Privacy Policy

1. Introduction

Global Arvest Banking ("Global Arvest Banking", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our banking services, visit our websites or mobile applications, or otherwise interact with us in England.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who we are

Global Arvest Banking is a bank operating in England, providing retail, commercial, and digital banking services. We are a data controller for the personal data we process about you, meaning we determine the purposes and means of processing that data.

3. Personal data we collect

We collect and process different types of personal data depending on your relationship with us and the services you use. This may include:

3.1 Identification and contact data

• Full name
• Date and place of birth
• Residential and correspondence address
• Email address and phone numbers
• Nationality and residency status
• Identification documents (e.g. passport, driving licence, national ID), including document numbers and copies where permitted by law

3.2 Financial and account data

• Bank account numbers, sort codes, IBANs
• Payment card details (stored and processed in line with industry standards)
• Account balances and transaction histories
• Direct debit and standing order details
• Credit history and credit scores (where applicable)

3.3 Regulatory and due diligence data

• Information obtained for know-your-customer (KYC), anti-money laundering (AML), and counter-terrorist financing checks
• Information about sources of funds and sources of wealth (including, where relevant, information relating to agricultural income or harvest-related revenue streams)
• Sanctions and politically exposed person (PEP) screening results

3.4 Device and technical data

• IP address
• Device identifiers and type
• Browser type and version
• Operating system and platform
• Usage data about visits to our websites, apps, and online banking services, including log-in and activity records

3.5 Communication and interaction data

• Records of your communications with us (for example, calls, emails, in-app messages, secure messages, and letters)
• Chat and complaint records
• Marketing preferences and responses to surveys or promotions

3.6 Special category and criminal offence data We do not seek to collect special category data (such as health, biometric, or ethnic origin data) or criminal offence data unless required to do so by law or necessary for specific purposes (for example, identity verification, fraud prevention, or regulatory reporting). Where we must process such information, we will do so only when legally permitted and with appropriate safeguards.

4. How we collect your personal data

We collect personal data from different sources:

• Directly from you: when you open an account, apply for a loan or card, use our online banking, visit branches, contact us, or participate in surveys or promotions.
• Automatically: when you use our digital channels, including through cookies and similar technologies (see Section 10 below).
• From third parties: including credit reference agencies, fraud prevention agencies, public databases, business partners, payment service providers, and social media platforms (when you choose to connect with us through them).
• From publicly available sources: such as company registries, government databases, and public websites.

5. Legal bases for processing

We process your personal data only when we have a lawful basis to do so under applicable data protection laws in England. These legal bases include:

• Performance of a contract: to provide you with banking services, manage your accounts, process transactions, and fulfil our contractual obligations.
• Legal obligations: to comply with laws and regulations, including banking regulations, KYC/AML requirements, tax laws, and reporting obligations.
• Legitimate interests: to manage and improve our business, prevent fraud and misuse, secure our systems, develop new products and services (including those relating to seasonal or harvest-based income), and maintain accurate records, provided your rights and freedoms do not override these interests.
• Consent: where required by law, for certain marketing activities, use of cookies, or specific data processing operations. When we rely on consent, you may withdraw it at any time.

6. How we use your personal data

We use your personal data for the following purposes:

6.1 Providing and managing banking services

• Opening, operating, and closing bank accounts
• Processing payments, transfers, card transactions, and cash operations
• Providing loans, mortgages, overdrafts, and other credit facilities
• Assessing eligibility for and managing financial products, including those tailored to agricultural or harvest-related income patterns

6.2 Compliance and risk management

• Conducting identity verification and due diligence checks
• Complying with AML, counter-terrorist financing, and sanctions requirements
• Monitoring and investigating fraud, suspicious activities, and security incidents
• Managing risk, auditing, and regulatory reporting

6.3 Customer service and communication

• Responding to your enquiries, requests, and complaints
• Providing account statements, alerts, and service communications
• Informing you of changes to our terms, conditions, or policies

6.4 Improvement, research, and analytics

• Monitoring and improving our websites, apps, products, and services
• Analysing how customers use our services, including patterns and trends (for example, seasonal or harvest-related income flows for relevant clients)
• Developing new products and services and enhancing existing ones

6.5 Marketing and personalization

• Providing you with information about our products, services, offers, or events that may be of interest to you, including products designed for customers whose income is linked to agricultural or harvest cycles
• Personalising content, offers, and recommendations based on your profile and preferences
• Conducting surveys, market research, and customer satisfaction studies

We will not use your personal data for purposes that are incompatible with those described in this Privacy Policy unless required or authorised by law or with your consent.

7. Sharing your personal data

We may share your personal data with:

7.1 Within Global Arvest Banking

• Our branches, subsidiaries, and affiliates, where necessary for the provision of services, internal administration, or risk management.

7.2 Service providers and partners

• IT, cloud, and data hosting providers
• Payment processors and card scheme providers
• Communications, mailing, and customer support providers
• Professional advisers (e.g. lawyers, auditors, consultants)
• Credit reference agencies and fraud prevention agencies

These third parties are required to process your data only on our instructions and to implement appropriate security measures.

7.3 Legal and regulatory recipients

• Regulators, supervisory authorities, and governmental bodies
• Law enforcement agencies and courts
• Public or regulatory registers where we are required to report

7.4 Other parties

• Another financial institution or third party when you ask us to share data (for example, to process payments or when you instruct us to switch services)
• Potential or actual purchasers, transferees, or merging entities in the event of a reorganisation, merger, or sale of all or part of our business, subject to appropriate confidentiality safeguards

We do not sell your personal data.

8. International transfers

Your personal data may be transferred to and processed in countries outside England and the United Kingdom. When we transfer your data internationally, we ensure a level of protection equivalent to that required under applicable UK data protection law by:

• Transferring to countries that have been deemed to provide an adequate level of protection; or
• Using appropriate safeguards, such as standard contractual clauses or binding corporate rules; and
• Implementing technical and organisational measures to protect your data.

You can contact us for more information about international transfers and the safeguards used.

9. Data security

We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption and pseudonymisation of data where appropriate
• Access controls and authentication mechanisms
• Network and system security measures
• Regular security testing and monitoring
• Staff training and confidentiality obligations

Despite our efforts, no system can be completely secure. You are responsible for keeping your login details, passwords, PINs, and other credentials confidential and for notifying us immediately if you suspect any unauthorised use of your account.

10. Cookies and similar technologies

We use cookies and similar technologies on our websites and digital platforms to:

• Enable core site functionality and secure log-in
• Remember your preferences and improve user experience
• Analyse traffic and usage to help us improve our services
• Support marketing and personalised content where permitted by law

You can control cookies through your browser settings and, where applicable, through our cookie management tools. Some cookies are essential and may be necessary for the site or online banking services to function properly.

11. Data retention

We keep your personal data only as long as necessary for the purposes for which it was collected, including to:

• Provide services and maintain your accounts
• Comply with legal, regulatory, accounting, and reporting obligations
• Resolve disputes and enforce our agreements

Retention periods vary depending on the type of data and our legal obligations. In most cases, we will retain customer and transaction data for a period specified by applicable banking and financial regulations after the end of the customer relationship. When data is no longer required, we will securely delete or anonymise it.

12. Your rights

Depending on applicable law, you may have the following rights in relation to your personal data:

• Access: to obtain confirmation whether we process your data and to receive a copy of that data.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request deletion of your data in certain circumstances.
• Restriction: to request limitation of processing under specific conditions.
• Portability: to receive the data you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller where technically feasible.
• Objection: to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
• Withdrawal of consent: where we rely on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact us using the details provided in Section 15. We may need to verify your identity before responding to your request and may be legally permitted or required to refuse certain requests.

13. Children’s data

Our services are not directed at children under the age at which they can lawfully enter into a banking contract in England. We do not knowingly collect personal data from such children without appropriate parental or guardian consent where required by law. If you believe we have inadvertently collected such data, please contact us so we can delete it or obtain the necessary consent.

14. Automated decision-making and profiling

We may use automated decision-making and profiling in certain situations, for example:

• Credit scoring and affordability assessments
• Fraud detection and prevention
• Transaction monitoring and risk scoring (including where income streams may be seasonal or harvest-related and thus require specific risk models)

Where automated decisions have legal or similarly significant effects on you, we will ensure that you have the right to obtain human intervention, to express your point of view, and to contest the decision, as required by law.

15. Contact details

If you have any questions about this Privacy Policy or how we process your personal data, or if you wish to exercise your data protection rights, you can contact our data protection representative using the contact details provided on our official website or in your account documentation.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. When we make changes, we will revise the "last updated" date at the top of the policy and, where appropriate, notify you through our digital channels or other communication methods.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.