Your personal information will be held securely so that we and any other companies in our Group that you have dealings with, either now or in the future, can manage your relationship with us. This will include information you provide when you apply to us, and any additional information provided by you or others.

Payment Services Directive 2 (PSD2) and your data (applies to 118 118 Money)

The Payment Services Directive 2 (PSD2) is a regulation which has been introduced to help protect you from online fraud. You may have had communications already from other suppliers or heard of it being referred to as Strong Customer Authentication or SCA.

This regulation means we'll take additional steps to verify your identity when you log in to your online account to manage your loan or credit card, rather than just asking for your password or fingerprint.

Every time you log in to your 118 118 Money online account, we will send you a one-time passcode and you will need to enter this to complete your log in. If you use our app to manage your account you won't have to do this every time you log in but we will be asking you to verify your identity every so often.

The passcode is sent to the mobile phone number you have registered with us as a text message. Please ensure that your mobile phone details are up-to-date and should you need to change them, please contact our Customer Assistance team on 02920 548118 or via the 118 118 Money mobile app.

What is Eligibility Check? (applies to 118 118 Money)

Eligibility Check is an online service we offer which will tell you if you might be eligible for one of our products and services (such as a loan or a credit card) without it affecting your credit rating.

If you wish to use Eligibility Check you will be asked to submit certain personal information to us— please see the Using credit reference agencies (CRAs) section below for further details of the information you will be asked to provide.

Eligibility Check allows us to check your credit record (you’ll be able to see our search on your credit file, but other organisations won’t be able to see it which means that it will not impact your credit rating). We will use our search, together with the information you have provided to tell you if we’re likely to accept you for our products and services, solely on a credit basis using our own credit scoring methods.

Following the Eligibility Check, we’ll tell you if you’re likely to be accepted by us for our products and services, but this is not an offer of credit.

If, following the Eligibility Check, you decide to complete your application for our products and services we will run further checks (including a credit check which other organisations will be able to see on your credit file) and, if:

• we find certain information on fraud prevention databases or we can’t verify your identity or other information you’ve given us; or
• based on the information you’ve given us we don’t believe that the product or service is affordable or sustainable for you,

we will not be able to offer you the product or service.

As we are a finance broker (as well as being a lender), if we are not able to offer you one of our products or services, we may pass your information to our lending partners Aspire Money Limited (Aspire) or Monevo Limited (Monevo). Aspire Money/Monevo is a consumer credit lending platform who may use your information to assist you in a finding an alternative appropriate product which meets your needs by sharing your application data with other providers.

To enable us to legitimately pass your application information (including personal data you have provided) to one of our lending partners, we will request your consent and this consent will be recorded for audit purposes.

Once your data has been passed to one of our lending partners, you will retain a relationship with both 118 118 Money and the lending partner in line with the terms as stated in the respective privacy policies.

For further information on Monevo, please visit www.monevo.com.

For further information on Aspire, please visit www.aspiremoney.co.uk.

Who do we share your personal information with?

Our Group companies

We may share your personal information with any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries. This enables us, and other companies within our Group, to better understand your needs and run your accounts in the efficient way that you expect. We will always treat your personal information as private and confidential.

Fraud prevention agencies (applies to 118 118 Money)

We will also need to confirm your identify before we can provide you with our products and services and will need to share your personal information to help detect fraud and money laundering risks. We use fraud prevention agencies to help us with this.

Should fraud or money laundering be suspected, we will pass your personal information to a law enforcement agency so that they can investigate, prosecute and prevent financial crime. A fraud prevention agency may also share your personal information with a law enforcement agency.

Online banking and you providing us with bank statements (applies to 118 118 Money)

As part of our checks in respect of your application for one of our products and services, we may also ask you to supply your bank statements in order to verify your identity and/or to verify details of your income and expenditure.

118 118 Money’s Use of Open Banking Services (applies to 118 118 Money)

What is Open Banking?

Open Banking is an initiative led by the UK's Competition and Markets Authority (CMA) to facilitate innovation, competition and collaboration between banks, financial technology and online service providers through the creation of new products and services for customers using the Application Programming Interfaces (APIs).

118 118 Money and Open Banking

118 118 Money provides you with a payment facility in the form of a credit card and is therefore defined as Account Servicing Payment Service Provider withinOpenBanking. This means that you may provide your consent to FCA regulated third party providers, so that your 118 118 Money related financial information is shared in a controlled and secure manner.

If you choose to share information, you will be automatically be asked to refresh your consent every 90 days to ensure that you continue to understand and consent to the information being shared. At any point you can remove your consent instantly through your online account with 118 118 Money, or through the third party provider's software.

Data that may be shared viaOpenBanking, with your consent, could include the following:-

• Account name
• Account number
• Balance
• Incoming transactions
• Outgoing transactions
• Detailed statement view
• Product details
• Offers available to you

Please be aware that if we share your data, with your consent, you will also be able to review this data within your chosen third party Open Banking provider.

118 118 Money and Money Dashboard (D•One) Open Banking (applies to 118 118 Money)

During your application process, we may need further information to help us assess your suitability to our credit card or loan products, and which one is right for you.

To help us with this, we have partnered with D•One to provide us with information relating to the categorisation of your spending habits. This will only occur if you provide consent, after reading D One’s privacy information, and connect your bank account. D•One will manage your personal data and send this back to 118 118 Money to aid our decisioning.

We are permitted to only use the categorised information for the purpose of assessing your eligibility or processing your application. We may share the categorised information with a third party to help us perform internal analytics to assess the information provided.

Once the information is received, your application will be reviewed and you or may not be approved for lending.

If you’d like to read more about Open Banking, please visit What is open banking? - Open Banking.

Using credit reference agencies (CRAs): (applies to 118 118 Money)

CRAs collect and maintain information about consumers’ and businesses’ credit behaviour. This includes Electoral Register, fraud prevention and credit information. This will include details of previous applications and the conduct of your accounts—and public information such as County Court Judgments, decrees, and bankruptcies.

We carry out credit and identity checks when you apply for our products and services. This helps us to:

• check the information you have given us;
• check your identity;
• assess your financial status;
• analyse your spending habits and your management of your accounts with us;
• determine your chances of being accepted for our products and services;
• help detect and prevent fraud and money laundering;
• identify and, where applicable, rank the most appropriate products and services for you, taking into account your personal circumstances.

We will use CRAs who will make credit searches and will pass your information to CRAs (such as TransUnion Limited, Equifax Limited and Experian Limited). We will give details of your accounts and how you manage it/them to CRAs. We will also do this on a periodic basis to manage your accounts with us.

The CRA will supply us with both public (including the Electoral Register) and shared credit and fraud prevention information. This information may be supplied to other organisations by CRAs and fraud prevention agencies to perform similar checks and to trace your whereabouts and recover debts that you owe. We may also ask CRAs to give us information about you.

The CRAs will keep a record of this search and place a “footprint” on your credit file, whether or not the application proceeds, this is deemed a soft search during the application process and is only viewable by you.

This information may be supplied to other organisations by CRAs and fraud prevention agencies to perform similar checks and to trace your whereabouts and recover debts that you owe. We may also ask CRAs to give us information about you.

The information we provide CRAs together with any information you provided us to assess your application may be shared between us, the CRAs and fraud prevention agencies and used by them and us to make decisions, for example when:

• checking details on applications made by you;
• managing your accounts;
• recovering debt;
• checking details of job applicants and employees;
• detect and prevent crime, fraud and money laundering;
• check your credit history;
• analyse your income;
• assess your spending habits;
• verify your identity if you apply, or someone financially linked with you applies, for products or services;
• trace your whereabouts;
• undertake research, statistical analysis and systems testing;
• manage your accounts, for example, in the event that we are considering, or you ask us to consider, changing your credit limit;
• to see if you might be eligible for any of our other products and services.

Where the data we have received, identifies that the data we hold on you is inaccurate, in accordance with the accuracy principle of UK GDPR, we will ensure that the data is rectified without delay.

Monitoring for fraudulent applications (applies to 118 118 Money)

118 118 Money utilises services provided by TransUnion which assist us in identifying potentially fraudulent applications and activity. These services are able to check ID, email addresses and characteristics about the mobile phone or computing device being used to apply for or use of our financial services. For this purpose the services may include, but not be exclusive to, CallValidate UK, EmailRisk, DeviceRisk, MobileRisk, MobileSimSwap and MobileKYC.

For TransUnion to provide these services, 118 118 Money automatically transfers these details to TransUnion for their analysis and to contribute to central databases. During normal service this information is stored within the UK and European Economic Area (EEA), however, during times of recovery or business continuity, this information may be stored by TransUnion outside of the UK and EEA.

TransUnion may also use other TransUnion group companies, or approved sub-contractors, to provide these services to you.

For further information, please review the TransUnion privacy policy, which can be found at:

https://www.transunion.co.uk/legal/privacy-centre

Relating to the DeviceRisk service, please see the privacy policy at the link https://www.iovation.com/privacy

Your rights to apply to the CRA

You have the right to apply to the CRAs for a copy of your credit file.

We use different agencies so please be aware that the information they hold may not be the same. There is a small fee that you may need to pay to each agency that you apply to. The addresses of the CRAs we currently use are:

Experian Consumer Help Service, PO Box 9000, Nottingham NG80 7WP or call 0844 481 8000 or log on to http://www.experian.co.uk/crain/index.html

TransUnion Consumer Services Team, PO Box 491, Leeds LS3 1WZ or call 0870 060 1414 or log on to www.TransUnion.co.uk/crain

Equifax Customer Service Centre, PO BOX 10036, Leicester LE3 4FS or call 0800 014 2955 or log on to

https://www.equifax.co.uk/crain

You can also find out more information about the CRAs we use by reading the Credit Reference Agency Information Notice each CRA makes available on its website (see http://www.experian.co.uk/, https://www.equifax.co.uk, and www.TransUnion.co.uk). This notice will:

• tell you about the CRA;
• provide further details on the information held by the CRA and how they use it;
• let you know who the CRA shares information with and why;
• explain how the CRA works with fraud prevention agencies;
• give you information on your rights.

Using fraud prevention agencies: (applies to 118 118 Money)

As part of our due diligence when assessing your application, we have systems that protect our customers and ourselves against fraud and other crime.

Customer information can be used to prevent crime and trace those responsible. We will share your personal information from your application with fraud prevention agencies.

If false or inaccurate information is provided and fraud is identified, details of this fraud will be passed to these agencies. We and other organisations may access and use from other countries the information recorded by fraud prevention agencies. Law enforcement agencies may access and use this information.

If your details are passed to these agencies because we believe that you have committed fraud, you may find it more difficult to obtain services, finance or employment with us and other participating organisations.

We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

• checking details on applications for credit and credit related or other facilities;
• managing credit and credit related accounts or facilities;
• recovering debt;
• checking details on proposals and claims for all types of insurance; and
• checking details of job applicants and employees.

We may also make periodic searches at fraud prevention agencies to manage your account with us.

The Fraud Prevention Agency we use is:

• CIFAS, with registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London, WC1H 9LT.
• You can contact CIFAS at https://www.cifas.org.uk/contact_us.

Using debt collection agencies (applies to 118 118 Money)

We may have referred the collection of your debt with us to a third party, and may have sent them your personal data (as per previous Privacy Policy versions), along with the financial standing of your account and advise of any missed payments, and/or balances outstanding.

There may be circumstances where your debt is returned to 118 118 Money and the third-party debt collection agency may retain your personal data for 180 days from the date the debt is returned. The purpose for this is to ensure that any queries by you or 118 118 Money can be adequately responded to. All other data retention is as per this statement.

The partner may need to refer to your personal data when contacting 118 118 Money with regard to a complaint or enquiry you raise with them.

118 118 Money does not use debt collection agencies at this time.

Using debt sale partners (applies to 118 118 Money)

We may review your debt as part of our overall collections strategy and decide that the debt is to be sold to a third party. We may negotiate with a number of debt sale organisations as part of this process.

The information we will need to send to these debt sale organisations will include personal data (contact details), banking details (your name, account number and sort code) and financial records denoting the performance of your debt with us.

In preparation for a sale, we may share this personal data with a prospective debt sale organisation where it is in our or the organisation's legitimate interests to do so, for example, to enable the organisation to process your personal data for data verification and pricing purposes.

If the sale goes ahead, we may share this personal data with a debt sale organisation where it is in our or the organisation's legitimate interests to do so, example, to enable the organisation to manage your debt and to meet its regulatory obligations or reporting requirements. In these circumstances, the organisation may use or disclose your personal data in the same way as set out in this Privacy Policy but will also be responsible for providing you with its own privacy information.

These organisations must keep your information confidential (though they may share it with credit reference agencies) and take all adequate and appropriate technical and organisational measures to keep your information confidential.

If your debt is sold by 118 118 Money to one of its debt sale partners then you will be informed by letter.

Using debt advice partners

In circumstances where your account may be in arrears or, you may be experiencing financial difficulty, we may suggest that you engage with a debt advice provider and may provide you with appropriate options.

Analysis of call recordings (applies to 118 118 Money and 118M8)

All calls to 118 118 Money are recorded for quality monitoring and training purposes. You are able to request an audio copy of your call recordings by emailing the Data Protection Officer at dpo@118118money.com.

Analysis of your journey on our website or mobile app (applies to 118 118 Money)

We use a partner called Glassbox to help us analyse your customer experience and journey through our website and mobile app. This process enables us to see where you stop on our web/app pages and how you manoeuvre within our pages, this helps us identify areas where our customers may experience difficulties or where areas of our customer experience/journey may need improvement or changes.

All personal data within the journey is masked and not stored or seen by Glassbox.

Communications with you (applies to 118 118 Money and 118M8)

We have partnered with Braze.com to provide a multi-channel communication platform between 118 118 Money and our customers.

Service messages will be sent via this channel, updating you of the terms of your financial product with us, regulatory notifications etc.

Where you have consented to receive marketing messages, we may also send these via Braze Inc.’s secure messaging platform.

We may occasionally reach out to you using Survey Monkey for your opinions to help us improve our services.
118 118 Money ensures that only employees that have a business need to access the data via our communications channels receive this access and we have performed industry-standard security reviews on all partners processing personal data to be assured that your data is protected at all times.

Privacy policies for our communications partners can be found below:

https://www.surveymonkey.co.uk/mp/legal/privacy/ (customer surveys)
https://www.braze.com/company/legal/privacy (messaging platform)
https://hightouch.com/privacy-policy (management of customer personal data between 118 118 Money and Braze)

Making payments via our telephone system (applies to 118 118 Money)

118 118 Money provides the option for you to use an electronic service for processing debit or credit card payments, for this we use the services of keyIVR. Following you choosing to make a payment, you are transferred automatically to the keyIVR service which will ask you to enter your card details (card number, expiry date and CVC) using your phone keypad. Once you have completed this, your details are processed by keyIVR and your card is tokenised, this is a secured method of ensuring that keyIVR do not store your card details.

keyIVR are a PCI-DSS compliant provider of payment services and has passed 118 118 Money’s stringent security due diligence procedures. Further information can be found at https://www.keyivr.com/pci-dss-solutions/payment-ivr/.

Our other service providers and agents

We will share your personal information with:

• third parties involved in managing accounts and services for you or collecting what you owe to us;
• our suppliers of underwriting and analysis services;
• IT service providers including those which provide our websites and mobile app hosting and maintenance services;
• sanction screening, identity and fraud prevention check providers;
• our call centre operators;
• business process outsourcing providers;
• your digital wallet provider (Samsung, Apple or Google) for the purpose of setting up your credit card in their digital wallet service;
• HM Revenue & Customs or other authorities;
• third parties where we are required to do so by law (for example, we are required to screen applications that are made to us to ensure we are complying with the international fight against terrorism and other criminal activities) or by our regulatory bodies such as the Financial Conduct Authority or if we require or are required by others to investigate or prevent crime;
• market research companies to assist in providing better products and services for you;
• third parties who may be connected with your accounts; and
• where we are required as part of our duty to protect your accounts, for example, we are required to disclose your information to the UK Financial Services Compensation Scheme (FSCS).

We will also share your personal information:

• with any person from whom we borrow funds to finance our business or part of it (or with whom we enter into negotiations to finance our business) and their professional advisers;
• with any person to whom we sell, merge or transfer (or enter into negotiations to sell, merge or transfer) our business or part or all of our business or assets or enter into a merger with it;
• to a potential buyer, transferee, or merger partner or seller and their advisers so long as they agree to keep it confidential and to use it only to consider the possible transaction;
• if the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your personal information in the same way as set out in this Privacy Policy.

We will always ensure your information remains safe and secure.

Why we may process special categories/sensitive personal information about you:

Some personal information under data protection law has special protection. This information is known as special categories of personal information but it may also be called sensitive personal information. This type of personal information includes information which relates to your racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, trade union membership, genetic or biometric data or data concerning your health, sex life or sexual orientation.

When you apply to us for our products and services and, as part of managing any products and services you have with us, we may ask you for special categories of personal information. We will only use this information to provide the service you require or help to manage your products and services and/or your account.

If we need to obtain special categories of personal information, we will ask for your explicit consent first.

Where will we transfer your personal information?

There will be times when we share your personal information within our Group and with our third party providers who are located in countries outside of the European Economic Area (EEA).

Your personal information will be transferred to countries outside the EEA such as the USA and the Philippines. For example, if you’ve got a loan or credit card with us, we use our call centre in the Philippines for customer service calls, payment reminder calls, payment collections calls and to obtain outstanding documentation from our loan customers.

When we transfer your personal information outside the EEA, we will take reasonable steps to ensure that your personal data is protected. To do this we use a set of standard data protection clauses which have been approved by the European Commission.

Whenever fraud prevention agencies transfer your personal data outside of the EEA, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the EEA. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

The above approach is compliant with data protection law (being Article 46.2 of the UK GDPR). For further information about these transfers and the safeguards in place, please get in touch via the Contacting us section below.

How we use your personal information to make automated decisions (applies to 118 118 Money)

When you apply for our products and services, we use both a manual and an automated system known as credit scoring to determine your eligibility for them. This is a method of assessing your likely conduct of an account based on a range of data, including the conduct of previous similar accounts. Credit scoring is a system widely used by credit providers to help make fair and informed decisions on lending.

This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

Some of these decisions do not involve human input and the systems apply pre-defined logic programming and criteria to make a decision. For example, we use information about your income, expenditure, other financial commitments and payment history. This information is analysed by automated means which uses statistical models and rule based systems to evaluate your credit worthiness, affordability and overall financial health.

Credit scoring takes into account information usually from three sources:

• the information you provide in connection with your application;
• information provided by searches conducted at CRAs and fraud prevention agencies; and
• information that may already be held about you by us or companies in our

A credit scoring system will consider information from these sources to make an overall assessment of your application. This assessment will extend to anyone with whom you are linked financially or other members of your household.

The information we obtain may be used:

• to check the information you have given us;
• debt tracing;
• analysing your income and spending habits;
• for the detection and prevention of fraud or money laundering;
• the management of our service to you.

If you provide a credit or debit card as part of your application or as part of a continuous payment authority (CPA), we may also use a third party to check the validity of the sort code, account code and card number that you submit in order to prevent fraud. The information you provide us will be transferred to CRAs and fraud prevention agencies who will record details of any search whether or not your application succeeds.

We may transfer personal and financial data to a partner called DataRobot Inc., they assist us in refining our lending strategy.

The credit scoring methods used are regularly tested to ensure they remain fair, effective and unbiased. Using a credit scoring system helps us to lend responsibly.

Your rights to challenge automated decision making

You have the right to challenge any automated decision with us directly. You can ask that we do not make automated decisions about you and you can object to an automated decision and ask that a person reviews it.

If you want to know more details about your rights, please get in touch via the Contacting us

section below.

Use of generative artificial intelligence (AI) technology

118 118 Money has published an Acceptable Use of Generative AI Policy and will not include any personal data of customers or employees into any generative AI tool (such as ChatGPT, CoPilot etc.) which is used for open learning.

Any tool where 118 118 Money has risk assessed and assured that the personal data is not used for training the AI is permitted, though use must be stated.

As of the date of this Policy, we use generative AI tools in the following ways:

• Amazon AWS AI – We employ a suite of AWS AI services and tools to screen and analyse all customer service channels, for the purpose of quality assurance, continuous improvement and all activities associated with improving customer satisfaction.
• Court Correct – use of Court Correct AI tools to review your complaints case and assist in providing a final response.
• Budgie – use of Budgie AI for helping you complete income and expenditure forms to help manage your account and payments with 118 118 Money.

Asking you for reviews of our products and services

After you have applied for one of our products, we may send your email address to TrustPilot who may ask you to leave a review of the service you have been provided. Should you not wish to leave a review or wish TrustPilot to stop processing your personal data, please contact TrustPilot as stated in their Privacy Policy, https://uk.legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Should you download our 118 118 Money or 118M8 app via the Google Play Store or Apple AppStore and leave a review, we may reach out to you to thank you for your review or to determine any issues you may have in accessing your account or with our app. We will only contact you if we are able to determine unique data to identify you as an individual and we will not divulge any personal data during that conversation (email or telephone) without requiring identification and verification checks to be passed to ensure that we are speaking to you.

Retention of your personal information

How long we keep your information for depends on the basis on which it was provided.

Generally, however, we will keep the information that is necessary to enable us to provide you with the products or services you have requested through our websites for as long as it takes us to provide that product or service.

If you have asked that we do not use your details for marketing purposes, we may still need to keep them to ensure our systems reflect your preferences.

We will keep records of any transactions you enter into on our websites for a minimum of 6.5 years from the end of our relationship with you. This is so that we can respond to any complaints or disputes that arise in that period.

Retention of your personal data can be demonstrated by this diagram for 118 118 Money:

Fraud prevention agencies may hold your personal data for different periods of time, and if

you are considered to pose a fraud or money laundering risk, they may hold your data for up to six years.

Retention for 118M8 data

If you use the 118M8 mobile application and do not register for an account, or you do not sign in using your 118 118 Money account, then your data is held locally on your mobile device and erasing the application removes the data.

Where you have registered for an account, or you use your 118 118 Money account to access the features of 118M8, your data is retained as above.

Links to third party websites

Our websites (www.118118money.com and www.118m8.com) contains links to other websites over which we have no control.

We are not responsible for privacy policies or practices of other websites to which you choose to link from our websites. We encourage you to review the privacy policies of those other websites so you can understand how they collect, use and share your information.

Marketing

If you opted in to receive newsletters, commercial emails or other communications from us or selected third parties but subsequently change your mind, you may opt-out by Contacting us as set out at the end of this Privacy Policy.

Cookies (applies to www.118118money.com and www.118m8.com)

We use cookies on our websites (www.118118money.com and www.118m8.com) to distinguish you from other users of the websites. This helps us to provide you with a good experience when you browse our websites and also allows us to improve the websites.

You have the option to customise the optional cookies, or reject all optional cookies as required by the Information Commissioner’s Office (ICO).

For information on the cookies we use, and the purposes for which we use them, please see our Cookie Policy.

App tracking technologies (applies to 118 118 Money and 118M8 mobile applications)

Our mobile applications use technologies that perform a similar function to cookies on websites. These include Software Development Kits (SDKs), device identifiers, and local storage tools that help us operate the app securely, understand how it is being used, and improve its performance.

Some of these technologies are essential for the app to work properly (for example, keeping you logged in, preventing fraud, or remembering your preferences). Others are optional, such as analytics or marketing SDKs, which help us measure performance or tailor our communications with your consent.

You can manage or withdraw your consent for optional tracking technologies at any time in your device settings or within the app’s privacy controls, as required under the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.

Where these tools are used to access or share data securely under frameworks permitted by the Data Use and Access Act 2025 (DUAA) — for example, to verify identity or prevent financial crime — we ensure those activities meet DUAA and data protection standards.

Changes to this Privacy Policy

If our Privacy Policy changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures that you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

Where appropriate we will give you reasonable notice of any changes.

This Privacy Policy was last updated in November 2025.

Contacting us:

If you have any questions about this Policy or your personal information and/or if you wish to see what information we hold about you, please contact the Data Protection Officer on dpo@118118money.com.

If you no longer wish to receive any marketing communications or wish us to stop using your personal information, please contact us:

By accessing your 118 118 Money customer portal or via the 118 118 Money app. Login to your account, via a browser, and go to the Marketing Preferences section.

By phone: 02920 548 118, this call will be charged by your provider as UK national number.

By mail: Data Protection Officer, 118 118 Money, 5^th Floor, 1 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ By email: dpo@118118money.com

How to complain

If you think there is a problem with how your personal information is being handled, you have a right to complain to the Information Commissioner’s Office (ICO).

The ICO can be contacted on 0303 123 1113 or please visit their website at www.ico.org.uk.

DATA PROTECTION STATEMENT

LOANS CUSTOMERS - 118 118 MONEY

WHEN APPLYING FOR A LOAN ON OUR WEB SITE OR VIA A MOBILE APP

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name (including Title, First name and Surname)	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)	You	Ireland & UK Internal customer databases Data-warehouse Email system EU ZeroBounce email verification	Yes TransUnion Experian Equifax (credit reference and scoring) ZeroBounce – email address verified by ZeroBounce to ensure that we have captured live email account details.	See application decision for retention periods ZeroBounce retain checked email addresses for a maximum of 30 days.
Email address	Contact during application process Checking for duplicate applications (potential fraud)
Mobile number
Date of birth	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)
Net monthly income	Affordability checks during application process
Monthly outgoings	Affordability checks during application process
Address including postcode	Identification during application process ID verification if you call us
Time at address	Identification during application process
Residential Status	Identification during application process	You	Ireland & UK Internal customer Databases Data-warehouse	Yes TransUnion Experian Equifax (credit reference and scoring)	See application decision for retention periods Maximum of 24 months if application is unsuccessful or not taken up by the customer. 6 years, 6 months from the termination of your credit card agreement with us, if application is successful
Bank Details (including account holder, sort code and account number)	During application as part of identification process

To help with checking your affordability of our product(s), we may also ask the number of dependants you have, your marital status, any additional household income, other credit commitments and essential expenses.

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

FOR LOANS PRODUCTS – CUSTOMERS OF 118 118 MONEY

IF YOU ARE REFERRED TO OUR UNDERWRITING TEAM (IN ADDITION TO THE APPLICATION PERSONAL DATA)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name (including Title, First name and Surname)	Identification during application process	You	Ireland & UK Loan management system Data-warehouse Email system EU ZeroBounce email verification	Yes Passed to credit reference agencies (TransUnion and Experian)	See application decision for retention periods ZeroBounce retain checked email addresses for a maximum of 30 days.
Email address	Contact during application process			Yes -ZeroBounce – email address verified by ZeroBounce to ensure that we have captured live email account details.
Mobile number	Contact during application process			No
Date of birth	Identification during application process ID verification if you call us			Yes Passed to credit reference agencies (TransUnion and Experian)
Employer	Identification during application process			No
Net monthly income	Affordability checks during application process			No
Monthly outgoings	Affordability checks during application process			No
Address including postcode	Identification during application process ID verification if you call us			Yes Passed to credit reference agencies (TransUnion and Experian)
Time at address	Identification during application process
Name, address, date of birth	PEPs and Sanctions checking	You	UK	Yes Factiva (Compliance Assist)	See application decision for retention periods
Marital Status	To review financial relationships with others	You	Ireland & UK Internal customer Databases Data-warehouse	No	See application decision for retention periods
Bank details	Identification during application process
Nationality or confirmation of being UK citizen	We can only provide service to UK citizens or those with right to reside in the UK
Debit card Details	Identification during application process

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

Where you have applied via a broker/affiliate (or comparison website) and not taken up our product(s) then data is anonymised (to remove personal data) after 30 days and is retained in the anonymised state for a further 6 months from the date it was anonymised.

CREDIT REPORT CHECKING AND ID VALIDATION

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
TransUnion (CallValidate)	Check validity of bank account	TransUnion	Ireland & UK Loan management system Data-warehouse	No	See application decision for retention periods
TransUnion (Credit Search)	Assessment of current and previous lending
TransUnion (TAC)	Affordability checks as required by FCA
Experian	Affordability checks as required by FCA	Experian	Ireland & UK Loan management system Data-warehouse		See application decision for retention periods
Bank statements	Affordability checks as required by FCA	You	Ireland & UK Loan management system Data-warehouse		See application decision for retention periods
Photo identification	Identification verification
Right to reside	We can only provide service to UK citizens or those with right to reside in the UK

REPORTING OF POTENTIALLY FRAUDULENT LOAN APPLICATIONS

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Personal information provided by you during the loan application process	To CIFAS for reporting potential fraudulent activity	Loan management system	Ireland & UK Loan management System Data-warehouse	Yes CIFAS	6 years from date uploaded
Loan application date

APPLICATION DECISION – IF YOU ARE AUTOMATICALLY DECLINED OR WE HAVE ASSESSED YOUR APPLICATION AS NOT BEING ELIGIBLE/YOU CHOOSE NOT TO PROCEED WITH YOUR LOAN APPLICATION/YOU WITHDRAW FROM THE AGREEMENT

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
CallValidate	Check validity of bank account	TransUnion	Ireland & UK Loan management system Data-warehouse	No	24 months
Credit Search	Assessment of current and previous lending
TAC	Affordability checks
Experian	Affordability checks	Experian	Ireland & UK Loan management system Data-warehouse
All personal information provided by you during application	To refine our scoring procedures	You (with permission to re-use)	UK Loan declines database Ireland Data-warehouse	Yes Passed to credit reference agency (TransUnion: https:// www. TransUnion. co.uk/crain) maximum twice within 24 months

LOAN APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN

Where we have declined your application, we may provide you with alternative options through our partners, by proceeding you will be asked to accept the partner’s data processing agreement.

Analytics and Scoring Procedures

As mentioned in row 5 above, 118 118 Money may retain your personal data if you are declined as a loan customer, or decide not to proceed with your loan application, for the purpose of improving the scorecards for our financial services products.

The legitimate interest requirement is to enable us to further refine our scoring based on the information submitted as part of the application process. This applies to both declined and approved customers. This information may be passed to relevant third parties (such as Credit Reference Agencies) to assist us in building better models for credit scoring in the future.

This information is retained for declined applications for 24 months.

APPLICATION DECISION – APPROVED FOR A LOAN

Type of data	Why do we need this information?	Source of data	Where stored?	Shared	Retained for?
Agreement number	For loan products, you are assigned a unique reference number.	System generated	Ireland & UK Loan management system Data-warehouse	No	End of product term + 6 years and 6 months
CallValidate	Check validity of bank account	TransUnion
Credit Search	Assessment of current and previous lending
TAC	Affordability checks
Credit score	Score indicating credit worthiness
Experian	Affordability checks	Experian	Ireland & UK Loan management system Data-warehouse	No	End of product term + 6 years and 6 months

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Financial Statement	Assessment of ability to repay your debt Analysing your payment behaviour with 118 118 Money and other creditors to assess whether we are able to help with your financial situation	Debt Management Company Insolvency Practitioner Credit reference agencies	Ireland & UK Loan management system Collections task system Internal Network Drive Data-warehouse	Yes Financial Ombudsman (where appropriate) Financial Conduct Authority (where appropriate)	End of product term + 6 years and 6 months
List of other creditors including reference numbers
Motor Vehicle details
Personal information of Partner/Family members
Age of dependent
Total Liabilities
Asset information including values
Estimated Deficiencies
Credit reference agency/credit file payment history
Customer circumstances		Medical Professional
Medical professional information including Name and address.
Medical History

MARKETING MESSAGES (WHERE YOU HAVE OPTED IN) (applies to 118 118 Money and 118M8)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name	For sending personalized marketing messages based on the preferences you have stated and your interest in our products and services.	You	Ireland & UK Customer Relationship Management System EU ZeroBounce email verification Braze – email system	Yes Email addresses are verified by ZeroBounce to ensure that we are sending to live email accounts.	Until you opt out of receiving marketing messages ZeroBounce retain checked email addresses for maximum of 30 days.
Address including postcode
Mobile number
Email address

You are able to manage your marketing preferences by logging into your online account, via the 118 118 Money mobile app or by calling our Customer Services team.

Marketing consent will demonstrate the ability to customise marketing by feature and channel.

The default setting for marketing is opt-out by all methods.

The above may be shared with selected third parties in circumstances where you have provided permission for this.

DATA PROTECTION STATEMENT

CREDIT CARD CUSTOMERS – 118 118 MONEY

WHEN APPLYING FOR A CREDIT CARD ON OUR WEB SITE OR VIA A MOBILE APP

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (including Title, First name and Surname)	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)	You	Ireland & UK Internal credit card customer databases Data-warehouse Email system EU ZeroBounce email verification	Yes TransUnion Experian Equifax (credit reference and scoring) ZeroBounce – email address verified by ZeroBounce to ensure that we have captured live email account details.	See application decision for retention periods ZeroBounce retain checked email addresses for a maximum of 30 days.
Email address	Contact during application process Checking for duplicate applications (potential fraud)
Mobile number
Date of birth	Identification during application process ID verification if you call us Checking for duplicate applications (potential fraud)
Net monthly income	Affordability checks during application process
Monthly outgoings	Affordability checks during application process
Address including postcode	Identification during application process ID verification if you call us
Time at address	Identification during application process
Residential Status	Identification during application process	You You	Ireland & UK Internal credit card customer Databases Data-warehouse Ireland & UK Internal credit card customer databases data-warehouse	Yes TransUnion Experian Equifax (credit reference and scoring) Yes TransUnion, for their CallValidate service to verify identification	See application decision for retention periods Maximum of 24 months if application is unsuccessful or not taken up by the customer. 6 years, 6 months from the termination of your credit card agreement with us, if application is successful
Bank Details (including account holder, sort code and account number)	During application as part of identification process
Balance Transfer (BT) product
Primary account number (PAN) Expiry date	Ownership check, to establish that the originating card belongs to you. For making the transfer from your new 118 118 Money card to your originating card.	You	Ireland & UK Internal credit card customer databases data-warehouse (masked to protect the card data)	Yes Transmitted to TransUnion to verify cardholder identity matches you.	6 months in all cases, to ensure data is available within an appropriate time for you to contact us about your transfer.

To help with checking your affordability of our product(s), we may also ask the number of dependants you have, your marital status, any additional household income, other credit commitments and essential expenses.

All of the above personal data types may also be used for ensuring that your application is not fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited, via their Compliance Assist software to ensure that we are legally permitted to lend to you.

REPORTING OF POTENTIALLY FRAUDULENT CREDIT CARD APPLICATIONS

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Personal information provided by you during the loan application process	To CIFAS for reporting potential fraudulent activity	Third Party TSYS (Credit card management)	Third Party TSYS (Credit card management)	Yes CIFAS	6 years from date uploaded
Credit card application date

CREDIT CARD APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN

Where we have declined your application, we may provide you with alternative options through our partners, by proceeding you will be asked to accept the partner’s data processing agreement.

Analytics and Scoring Procedures

118 118 Money may retain your personal data if you are declined as a credit card customer, or decide not to proceed with your credit card application, for the purpose of improving the scorecards for our financial services products.

The legitimate interest requirement is to enable us to further refine our scoring based on the information submitted as part of the application process. This applies to both declined and approved customers. This information may be passed to relevant third parties (such as Credit Reference Agencies) to assist us in building better models for credit scoring in the future.

This information is retained for declined applications for 24 months.

CREDIT CARD APPLICATION IS APPROVED

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (including Title, First name and Surname)	ID verification if you call us	You	Third Party – UK TSYS (credit card management) Ireland & UK 118 118 Money database records Data-warehouse Email system	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)	6 years, 6 months from the termination of your credit card agreement with us
Email address				Yes TSYS (credit card management)
Mobile number
Date of birth
Address including postcode				Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name (as shown on credit card)	To print plastic card showing your name To answer your questions through customer services, fraud investigations or collections team. To send you regular service-related mail and monthly statements	You	Third Party – UK TSYS (credit card management) Ireland & UK 118 118 Money database records Data-warehouse	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers)	6 years, 6 months from the termination of your credit card agreement with us
Primary Account Number (PAN – 16 digit credit card number)	To refer to your account along with your name, address and other personal data Printing on your credit card Used as a reference in reporting within 118 118 Money	Third Party TSYS (Credit card management) Originating from Mastercard	Third Party – UK TSYS (credit card management)	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon Group (management of outgoing mail and statements)	6 years, 6 months from the termination of your credit card agreement with us
Bank details (including Bank Account Number, Sort Code And Account Holder name for Direct Debit)	For taking regular payments via direct debit	You		Yes TSYS (credit card management)
Credit Card details (including card number, expiry date and balance to transfer)	For the purpose of transferring a balance from an existing credit card to the 118 118 Money Credit Card. We may also use this information plus your name to verify that the credit card is yours.	You		Third Party – UK TSYS (credit card management)	6 years, 6 months from the termination of your credit card agreement with us

IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Financial Statement	Assessment of ability to repay your debt Analysing your payment behaviour with 118 118 Money and other creditors to assess whether we are able to help with your financial situation	Debt Management Company Insolvency Practitioner Credit reference agencies	Ireland & UK Loan management system Collections task system Internal Network Drive Data-warehouse	Yes Financial Ombudsman (where appropriate) Financial Conduct Authority (where appropriate)	End of product term + 6 years and 6 months
List of other creditors including reference numbers
Motor Vehicle details
Personal information of Partner/Family members
Age of dependent
Total Liabilities
Asset information including values
Estimated Deficiencies
Credit reference agency/credit file payment history
Customer circumstances
Medical professional information including name and address		Medical Professional
Medical History

MARKETING MESSAGES (WHERE YOU HAVE OPTED IN)

Type of data	Why do we need this information?	Source of data	Where stored?	Shared externally?	Retained for?
Name	For sending personalized marketing messages based on the preferences you have stated and your interest in our products	You	Ireland & UK Customer Relationship Management system EU ZeroBounce email verification Braze – email system	Yes Email addresses are verified by ZeroBounce to ensure that we are sending to live email accounts.	Until you opt out of receiving marketing messages ZeroBounce retain checked email addresses for maximum of 30 days.
Address including postcode
Mobile number
Email address

You are able to manage your marketing preferences by logging into your user portal, via the mobile app or by calling our Customer Services team.

The default setting for marketing is opt-out by all methods.

The above may be shared with selected third parties in circumstances where you have provided permission for this.

The notifications you receive via our 118 118 Money and/or 118M8 mobile applications are controlled by you in the Notifications setting of your mobile device.

IF YOU CHOOSE TO ADD AN ADDITIONAL CARDHOLDER AT ANY TIME

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Name of additional cardholder (as shown on credit card)	To print plastic card showing their name Identification when you contact us	You	Third Party TSYS (credit card management)	Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers) Paragon, name for statements	6 years, 6 months from the termination of the main account holder’s credit card agreement with us
Name (including Title, First name and Surname) of additional cardholder	To register details	You (we assume that you have permission from the additional cardholder to use their personal information)		Yes TSYS (credit card management)
Date of birth of additional cardholder	To ensure that the additional cardholder is over the age of 18

Type of data	Why do we need this information?	Source of data	Where stored?	Shared with another company?	Retained for?
Address of additional cardholder (including postcode)	Requirement is that the additional cardholder lives at the same address as the main cardholder	You (we assume that you have permission from the additional cardholder to use their personal information)	Third Party TSYS (credit card management)	Yes TSYS (credit card management)	6 years, 6 months from the termination of the main account holder’s credit card agreement with us
Mobile number of additional cardholder	For providing service messages relating to the additional cardholder Identification when you contact us
Relationship to main cardholder	Terms and conditions require additional cardholder to be a family member
Primary Account Number (PAN – 16 digit credit card number)	To refer to your account along with your name, address and other personal data Printing on your credit card Used as a reference in reporting within 118 118 Money	Third Party TSYS (Credit card management) Originating from Mastercard		Yes TSYS (credit card management) Idemia (printing of plastics, card mailers, PIN mailers)

DATA PROTECTION STATEMENT

118M8 users

HOW WE COLLECT AND USE YOUR PERSONAL INFORMATION

The 118M8 mobile application will allow you to have an overview of your spending habits, and provides you with support and access to financial fitness products from 118 118 Money or other third parties that we may introduce you to upon request.

When you use our Financial Fitness App, we may need to collect certain personal information that you provide to us, either directly or through your 118 118 Money online account where applicable.

As of launch in November 2025, you are able to use the 118M8 mobile application as a Guest without providing any personal data.

If you register for an account, or connect your 118 118 Money account with 118M8, then limited personal data will be collected. This Privacy Policy will be updated regularly as the 118M8 application features evolve.

This personal information may include:

• Name
• Email address
• Mobile phone number
• Date of birth
• Postal address
• Residential status
• Your 118 118 Money account details

We have set out our reasons for using your personal information in the table below under the heading Legal Basis.

Purpose
To assist in the ongoing administration of your 118M8 products and services, in accordance with our terms and conditions which if entered into, will be a contract between us, we will use information we receive from you for the following purposes. • General account handling and service-based communications, such as those required by regulatory obligations; • Analyse your spending activities and provide summaries of your spending habits and “nudges” for what might improve your overall financial fitness; • Tell you about important changes or developments to the features and operation of your products and services;	Legitimate interests: we require your personal information to enable us to process your information and provide you with our financial assessment services. Performance of a contract: we have with you for the use of our 118M8 mobile application.
Where you request further information about a financial product that is offered by a third party, or wish to apply for a financial product that is offered by a third party, via our 118M8 mobile application, we may need to disclose your personal information with that third party. Please note that where you wish to apply for a financial product offered by a third party through the 118M8 mobile application, that product offering will be governed by the terms and conditions of that third party and 118 118 Money will not be responsible for such third party product.	Performance of a contract: we have with you for the use of our 118M8 mobile application.
To comply with legal and regulatory obligations, as well as legitimate interests, for example fraud prevention, we will: • Administer, update, consolidate, improve and manage the accuracy of our records and our business including but not limited to meeting legal, regulatory and compliance requirements and operating rules (such as anti-money laundering, regulatory reporting requirements and record maintenance). • Monitor and analyse the use of any account to detect, prevent, investigate, prosecute and/or report fraud, terrorism, misrepresentation, security incidents or crime. We will also use information we receive from fraud prevention agencies.	Necessary for compliance with a legal obligation to which we are subject.
When you download the 118M8 mobile application, we may collect information about your use of it including, where available: • your IP address, IP address location (city and country) and Internet Service Provider (ISP); • operating system and browser type and version; • the type of device(s) you use • your email address • your mobile phone number We use this information for system administration and product development.	Performance of a contract we have with you and our legitimate interests: to enable you to receive our products and services in certain formats.
When you login to your online account or access your account via our mobile application, we will use the mobile phone number you have provided to send you a one-time passcode to act as an additional verification during the login process.	Use for secure authentication of your login details to protect you from fraud.
Where you have, or subsequently are approved for, a 118 118 Money Credit Card, the transactions of payments and expenditure on that card will also be shown in your 118M8 mobile application to help you understand your credit position.	We rely on our legitimate interests as the lawful basis for this processing — to help you manage your credit more effectively and responsibly.
If you are a 118 118 Money customer, we will recognise you from the personal data you provide in 118M8 and connect your accounts, providing you with a single login across 118 118 Money services. If you are not yet a 118 118 Money customer, we will use the personal data you provide in 118M8 to create and connect accounts in both 118 118 Money and 118M8, giving you one secure login for accessing the services we deliver through both platforms. Because these form part of the same 118 118 Money service, accounts cannot be unlinked, but you may close your account or request deletion.	Performance of a contract and legitimate interests (to enable you to access and manage your 118 118 Money services securely and efficiently). To register, create, and maintain your account and the services we provide via the 118 118 Money website, app, and the 118M8 app.
To enhance your experience in our 118M8 and 118 118 Money proposition We use data about how you use our apps and services — together with any connected information or accounts — to understand what features are most useful, to tailor your in-app experience, and to provide timely and relevant offers that may benefit you. This may include profiling based on your behaviour in the app (for example, how often you log in, what tools you use, or how you interact with insights) and on data connected to your account (for example, transaction insights or budgeting trends). We do this to help ensure the content you see is meaningful, useful and aligned to your financial needs. Where our personalised recommendations amount to direct marketing, we will only send these in compliance with PECR and your marketing preferences. You can control these preferences at any time and will be provided an opt-out at each message.	Legitimate interests: We rely on our legitimate interest to improve and personalise how our services work, and to offer products or features that are relevant to your financial situation. We assess these interests carefully to ensure they do not override your rights and freedoms, and you can object to this type of processing at any time within the app or by contacting us.

You have the right to object to our use of your personal information at any time. For further information on your rights please see the section above.

Your Data Rights (under UK GDPR, the Data Protection Act 2018 and the Data Use and Access Act 2025)

You have certain rights regarding your personal information. These rights apply in specific circumstances and may be subject to lawful exemptions.

Full details of the information we hold about you and your relationship with 118 118 Money are set out in the Customer Data Protection Statement sections — please select whether you are a 118 118 Money (loan or credit card) customer or a 118M8 mobile app customer.

1. Be informed

This privacy statement explains why, how and where we process your personal data, who we may share it with and how long we keep it.

In line with the Data Use and Access Act 2025 (DUAA), we also explain where your data may be made available through accredited data access arrangements or intermediaries, and how you can exercise control over such sharing.

2. Access your data

You have the right to request a copy of the personal data we hold about you. To access your data, please email your subject access request to dpo@118118money.com.

Under DUAA, you may also ask us to make certain financial data securely available to another provider or accredited third party, where applicable. Please include “DUAA request” in the subject line for these requests.

3. Correct or update your data

If you believe the information we hold about you is inaccurate or incomplete, please contact our Customer Services team.

4. Delete your data (right to erasure)

You may request deletion of your personal data by contacting dpo@118118money.com . Please tell us which data you want deleted and why.

5. Restrict processing

You may ask us to restrict processing of your data (so we store it but do not actively use it). Please contact the Data Protection Officer using the email address above.

6. Data portability and DUAA data access

You have the right to request that we transfer your personal data to another organisation. Under DUAA, this can include certain derived or observed data (for example, credit performance or transaction history) in a secure, structured format.

7. Object to processing

You can object to our processing of your data — for example, for direct marketing or profiling purposes. To object, please contact Customer Services on 02920 548118 or raise your concerns via the ICO at https://ico.org.uk/concerns/handling/.

8. Automated decision-making and profiling

We use automated decision-making when assessing eligibility for our products. You have the right to understand the key factors that led to an automated decision and to request human review.

9. Contacting the Data Protection Officer (DPO)

Email: dpo@118118money.com
Post: The Data Protection Officer, 118 118 Money, 5th Floor, 1 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ.

We aim to respond to all rights requests within one month. If you’re dissatisfied with our response, you may contact the Information Commissioner’s Office (ICO).