Privacy Policy

Availability and Governing Law

Step One Finance’s services and products, described on this website, are available to UK residents applying through our network of selected brokers or directly to us. The content and terms of use of this site will be governed by English law and we will only communicate and contract in English.

Complaints

We operate a full customer care service. If you are ever unhappy with any aspect of our service we welcome your feedback. You can e-mail your thoughts to customerservice@steponefinance.co.uk, or write to Step One Finance Limited at Premier House, 15 – 19 Church Street West, Woking, Surrey, GU21 6DJ. You can review a summary of our complaints handling policy here.

Tariff of Fees and Charges

You can review our Tariff of Fees and Charges for Mortgages here.

Privacy Policy – Use of Your Personal Information

This Privacy Policy explains when and why we collect personal information about you, the conditions under which we may disclose it to others and how we keep it secure. It is relevant to anyone who uses our services, including borrowers, prospective borrowers and users of our website.

We may change this policy from time to time. Updates may be found at www.steponefinance.co.uk/legal-notices. By providing your information to us, you agree to be bound by this policy.

Any questions regarding this Policy and our privacy practices should be sent by email to customerservice@steponefinance.co.uk or by writing to us at Step One Finance Limited, FAO Compliance Department, Premier House, 15 – 19 Church Street West, Woking, Surrey, GU21 6DJ. Alternatively, you can phone us on 01483 661 100.

Who are We?

Step One Finance Limited (“Step One Finance/we/us/our”) of Premier House, 15 – 19 Church Street West, Woking, Surrey, GU21 6DJ is a specialist consumer lending business, authorized and regulated by the Financial Conduct Authority (706087). We are members of the Finance & Leasing Association.

How do we collect information from you?

We collect your personal information from you either directly including application forms, correspondence, email, telephone and via our website or indirectly from intermediaries (including price comparison websites), and in the case of joint or guaranteed applications, by a spouse or relative or a person nominating you to act as guarantor. In cases where an application is being made on a joint or guaranteed basis, we will also collect information about the other person(s). You must ensure the other person(s) acknowledges this Privacy Policy.

We may also obtain your personal information by making enquiries with and obtain information from other sources such as Credit Reference Agencies (CRAs), Fraud Prevention Agencies (FRPs), your employer, landlord, other lenders, government tax, welfare and law enforcement agencies, debt recovery and/or tracing agents.

What happens if you or your Broker do not provide your personal information to us?

Where your personal information is not provided to us, we are unable to consider a loan application for you.

What type of information is collected from you and why?

We process your personal information for the primary purpose of providing our services and products to you in our capacity as a lender. The personal information we generally process includes:

Your title, full name, your contact details, including for instance your email address, home and mobile telephone numbers;
Your home address, correspondence address (where different from your home address) and address history;
Your date of birth and/or age and any other relevant characteristics to make sure that you are eligible to apply for the product and/or that it is suitable for you;
Identification documents including document type, date of expiry and country of issue;
Your nationality, if this is necessary for us to comply with our legal and regulatory requirements;
Records of how you have contacted us and, if you get in touch with us online, details such as your mobile phone location data, IP address and MAC address;
Details of shareholdings, prominent functions, directorships and/or employment including for instance your occupation, salary, employer and length of service;
Information about your employment status including whether you are employed, retired or receive benefits;
Information about your occupier status, such as whether you are a tenant, live with parents or are an owner occupier of the property in which you live at the time of your application;
Details of your services with us including for instance application information, affordability assessments, credit history, customer ID number, account number, account balance, account history, security or collateral held by us, and details relating to any other signatories and/or guarantors;
Security identifiers;
Personal information which we obtain from Credit Reference Agencies (CRAs) and Fraud Prevention Agencies (FPAs);
Some special categories of personal data such as about your health or if you are a vulnerable customer (more details below);
Information which is relevant for your residency and/or citizenship status, such as your nationality, your length of residency in the UK and/or whether you have the permanent right to reside in UK; and
Your marital status, family, lifestyle or social circumstances if relevant to the loan product (e.g. the number of dependants you have or if you are a widow or widower).

Legal Basis for the Processing of Your Personal Information

Below we set out the legal basis for which we process your personal information and the types of parties with whom we may share this information. In certain cases, more than one legal basis may be relevant.

Processing necessary for the performance of our contract with you or for taking steps to enter into such a contract

To process your application for a loan
To verify your identity
If the application is successful to enter into a contract with you
To share your personal data with payment services providers, to the extent necessary
For use by our profiling and other automated decision-making tools
To administer your loan until it is fully repaid
If you do not make your loan repayments, to trace your whereabouts and recover debts
To deal with complaints
To meet our statutory and regulatory obligations
To prevent and detect crime (including for example, to detect or prevent fraud/money laundering)

Processing necessary for the following legitimate interests:

To process your application for a loan
To verify your identity
If the application is successful to enter into a contract with you
To share your personal data with payment services providers, to the extent necessary
For use by our profiling and other automated decision-making tools
To administer your loan until it is fully repaid
If you do not make your loan repayments, to trace your whereabouts and recover debts
To deal with complaints
To meet our statutory and regulatory obligations
To prevent and detect crime (including for example, to detect or prevent fraud/money laundering)
To test the performance of our products, services and internal processes
For management and audit of our business operations including accounting and insurance
To carry out searches at Credit Reference Agencies pre-application, at the application stage, and periodically after that. Where you have been introduced to us by a broker or other intermediary they may do these searches on our behalf
For market research and analysis and developing statistics
For direct marketing communications.
When we share your personal information with:
Joint account holders, trustees and beneficiaries and any person with power of attorney over your affairs (in each case only if relevant to you);
Members of our Group;
The broker or other intermediary who introduced you to us;
Our legal and other professional advisers, auditors and actuaries;
Financial institutions and trade associations;
Other organisations and businesses who provide services to us such as loan servicers, debt recovery agencies, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions;
Insurers of any asset securing or proposed to secure your liabilities;
Buyers, counterparties, rating agents and other relevant parties and their professional representatives as part of any restructuring or sale of any or all of our business or assets or any transaction in respect of which we raise finance on the security of our assets (including by way of a securitisation or similar transaction);
Credit Reference Agencies and Fraud Prevention Agencies; and
Market research organisations who help us to develop and improve our products and services.

Processing necessary to comply with our legal obligations:

We also process your personal data, retain records and share records on the basis that this is necessary for compliance with the statutory and legal obligations and regulations applicable to us as a lender (including crime prevention and regulatory reporting) and for the establishment, exercise, defence and enforcement of our legal rights. In this regard, your data may be shared with joint account holders, trustees, beneficiaries and holders of powers of attorney, FPAs, CRAs, law enforcement and regulatory bodies.

Processing in the VITAL INTERESTS of the individual

From time to time in the course of representing individuals who may be troubled, in danger, very young or otherwise unable to exercise due care for their own safety, we may in extreme circumstances use information about our client or a person connected with them in order to take action to protect them.

Processing with your consent:

If you provide your consent, we may (i) share your personal information with a third party in relation to a credit application or a product, (ii) engage in direct marketing communications with you, and (iii) send your information to carefully selected third party organisations who may provide products of interest to you.

You should be aware that for much of what we do, we process your personal information based on legal grounds other than on the basis of your consent. However, for any of your personal information which we process solely based on your consent, you may withdraw your consent at any time by contacting us at the details above.

How we share your information with CRAs and FPAs

In order to process your application and before we provide services or financing to you, we will perform credit, fraud and money laundering prevention and identity checks on you with one or more CRAs and FPAs. These checks require us to process personal data about you. If you take a loan from us, we may also make periodic searches at these agencies to manage your account with us.

To do this, we will supply your personal information to CRAs and FPAs and they will give us information about you. This will include information from your credit application and your financial situation and financial history. CRAs and FPAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to review your credit application, including to:

Assess your creditworthiness and whether you can afford to take the product
Verify the accuracy of the data you have provided to us
Prevent criminal activity, fraud and money-laundering
Manage your account(s)
Trace and recover debts; and
Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs and FPAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

We and FPAs may also enable law enforcement agencies to access and use your personal data to detect, investigate and solve crime.

Consequences of Processing

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together, so make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAS, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share information, data retention periods and your data protection rights with the CRAs are explained in more detail in their Credit Reference Agency Information Notice (CRAIN) by clicking on any of these three links below. Each one will take you to the same CRAIN document:

TransUnion – www.transunion.co.uk/crain
Equifax – https://www.equifax.co.uk/privacy-hub/crain
Experian – www.experian.co.uk/crain

If we, or an FPA, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested or may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details provided.

Special categories of Personal Data

At certain times whilst any loan is in existence, we may need to process special categories of personal data (i.e. sensitive personal data) regarding your physical or mental health where a condition has an effect on your ability to understand the contract you are entering into or to repay your loan with us. This will usually be with your explicit consent to record this information but may also be recorded in order to protect your vital interests if you are unable to provide consent as you are physically or legally incapable.

Data Transfers Outside of the EEA

Step One may need to share some or all of your personal data with organisations outside of the European Economic Area. Where this is absolutely necessary, we will impose contractual obligations on the recipients of that data to protect your data to the standard required in the European Economic area.

Whenever FPAs transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘International frameworks’ intended to enable secure data sharing.

Retention of Information

Your personal data will be retained on our systems for a period of time to enable us to administer the loan with you until completion and to meet our statutory, legal and regulatory obligations. Whether your application is successful or not, your details will be held in line with our Record Keeping Requirements which are set out below.

FPAs can hold your personal data for different periods of time and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Record Keeping Requirements

When your personal information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your personal information.

However, for loans that complete, most of the personal information is or will be stored by us for a maximum of six years after your account is closed, unless a longer retention period is required in case of queries from you, legal claims by you and/or legal or regulatory requirements. In cases where an application is made and does not result in a contract between us, we will retain the application data for up to one year.

Your Rights

Your personal data is protected by legal rights:

Right to object to our processing of your personal data
If we rely on your consent for the processing of any of your personal data, you have the right to request that we stop processing it. (e.g. marketing purposes). However, the majority of the personal data is collected on grounds (outlined above) other than in reliance on your consent and you would not be able to object to us processing it for these purposes.
Right to request that your personal data is erased or corrected
If you believe that some personal information we hold about you is incorrect, you have the right to ask for it to be corrected and in certain circumstances erased.
Right to request access to your personal data
You have a right to request a copy of the personal data we hold about you. Please contact us to make your request. Upon receipt of your request, we have 30 days to send the information to you.
Right to restrict us from processing your personal data
This right may apply if you have requested us to correct some of your personal data and we are verifying the accuracy of the data to be corrected or you have objected to the use of your personal data and we are considering whether our legitimate interests override your objection. You may also ask us not to erase your data but to restrict its use, if we no longer need it but you want us to keep your information to establish, exercise or defend a legal claim.
Right of Data Portability
You have the right to request that we transmit the personal data you have given us, where the processing of such data is carried out by automated means, to you or to another organisation. In this event, we will provide the information in a machine-readable format so that another organisation’s software can understand that information. We will provide this information to you within 30 days of request.
Right to a manual review of an automated decision
If the decision has had a legal or similarly significant effect on you. Please note that any automated decision making we carry out is done for the performance of a contract between you and us so this right may not apply in certain circumstances.

For more information or to exercise your data protection rights please, contact us using the contact details provided. You also have the right to complain to the Information Commissioner’s Office which regulates the processing of personal data.

ICO – https://ico.org.uk

Telephone Number -0303 1231113 ICO textphone 01625 545860

For a PDF version of this notice, please click the following link: Privacy Policy.

Cookies Policy

You can view our cookies policy by clicking here.

Ownership

Step One Finance owns and maintains this website. No act of downloading or otherwise copying from this website will transfer title to any software or material on this website to you. Step One Finance reserves all rights with respect to copyright and ownership of all material on this website, and will enforce such rights to the full extent of the law.

External Websites

Please note Step One Finance is not responsible for the content of external websites.

No Warranty

Step One Finance assumes no responsibility for, and makes no warranties that, functions contained on this website will be uninterrupted or error-free, that defects will be corrected, or that this website or the server that makes it available will be free of viruses or other harmful components. Step One Finance shall not be liable to any damages to, viruses that may infect, or services, repairs or corrections that must be performed on your computer.