Privacy Policy
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
PRIVACY POLICY
About us & our Privacy Policy
This Privacy Policy applies to personal information collected and processed by 118 118 Money,
which is the trading name of Madison CF UK Limited (Company No: 08393840). Our registered
office is at 71-73 Carter Lane, London, EC4 5EQ and we are authorised and regulated by the
Financial Conduct Authority (FRN741774). We are part of the kgb Group of companies, which
includes 118 118 and Conduit Global.
You can confirm our registration on the Financial Conduct Authority’s website www.fca.org.uk or
by contacting the Financial Conduct Authority on 0800 111 6768.
This Privacy Policy covers the collection and use of personal information through:
• Our websites www.118118money.com and www.118m8.com;
• Our 118 118 Money and 118M8 mobile applications; and
• Any related online services, digital forms, in-app chat or communication tools provided by us.
It explains how we collect, use and share your information when you interact with us through these
digital channels.
For ease, we refer to these collectively as “our services” or “we/us” throughout this Privacy Policy.
Where we process personal data under secure data-sharing frameworks or government-approved
data access arrangements (for example, under the Data Use and Access Act 2025 (DUAA)), those
activities are also covered by this Privacy Policy.
If you wish to contact our Data Protection Officer, please contact them via
dpo@118118money.com.Other ways to get in touch with us are set out in the Contacting us section
below.
Protecting your personal information
Your personal information is protected by law. This includes the UK General Data Protection
Regulation (UK GDPR) and the Data Protection Act 2018, as well as the Privacy and Electronic
Communications Regulations (PECR).
From 2025, the Data Use and Access Act 2025 (DUAA) also applies to certain types of data use and
data sharing, particularly within the UK financial services sector. The DUAA promotes secure, fair,
and transparent data access between regulated firms, data service providers, and government-
approved data intermediaries, while maintaining strong protections for individuals’ privacy and data
rights.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
We will continue to update this Policy to reflect:
• Any changes in how we collect, use, or share your personal data
• New relationships we form with third parties, and
• Updates required by law, regulation, or government guidance (including under the UK
GDPR, DUAA, PECR and the Data Protection Act 2018).
These laws regulate how we may process personal information relating to you and grant you
various rights over your data.
The aim of this Policy is to tell you how we collect, use and retain your personal information you to
provide to us – and how we protect it under these laws.
Your 118M8 and 118 118 Money Accounts
118M8 is part of the 118 118 Money digital service. When you sign up or log in, we use the details you
provide to create or connect your 118 118 Money and 118M8 accounts. This means you’ll have one
secure login to manage your 118 118 Money products and services in one place.
We use your personal data in this way because it’s necessary for us to deliver the services you’ve
requested under your agreement with us (UK GDPR Article 6(1)(b)). Since 118M8 and 118 118 Money
operate as one connected service, the accounts can’t be unlinked. If you no longer wish to use our
services, you can close your account or ask us to delete your information at any time.
How we communicate with you
The 118M8 app is part of the 118118 Money connected proposition. After you have registered for our
services (including a free account but not a guest account), to help us deliver and maintain this
service, 118 118 Money uses your contact details and app activity to send you information, updates,
and insights which will include those about 118118 Money’s own credit cards, loans, and related
financial products.
Certain 118M8 features are designed to work only when you hold a 118118 Money credit card or loan.
If you do not yet have one, you will still be able to access core tools and insights, but some connected
features - such as spending analysis, rewards, and personalised financial insights - are available only
once your 118118 Money credit product is linked to your 118M8 account.
Because these features depend on having a 118118 Money credit product, we’ll contact you with
information about products and features if they become available to you, so you can access and
benefit from the full 118118 Money proposition.
We may tailor messages to reflect your existing products and app usage, ensuring the information you
receive is relevant and supports your financial management.
You can manage how we contact you (for example, email, SMS, or in-app messages) in the app
settings or by contacting us at any time. You will continue to receive essential updates about your
account and the 118 118 Money proposition features as they become available to you.
What the law says
Under data protection law, we can only use your personal information if we have a lawful reason
to do so. We must have one or more of the following lawful reasons:
• We have your consent;
• We are entering into or are performing a contract with you;
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
• It is in our legitimate interests;
• When we are under a legal duty.
When we rely on our legitimate interests we mean our:
• Pursuit of our commercial activities and objectives, or those of a third party;
• Compliance with applicable legal and regulatory obligations or reporting and any codes of
conduct;
• Improvement and development of our business operations and service offering, or those of a
third party; or
• Protection of our business, shareholders, employees and customers, or those of a third party.
From 2025, the Data Use and Access Act 2025 (DUAA) also applies to certain types of data sharing
and access within the financial services sector. This means that in some circumstances we may
receive or share data through secure, government-approved data access frameworks – for example,
when the law allows data to be shared for fraud prevention, credit risk, or regulatory purposes,
including financial reporting to the regulator (FCA).
Where this happens, we will only do so in line with the DUAA’s safeguards and the lawful bases set out
above under the UK GDPR and Data Protection Act 2018.
What is personal information?
Personal information is information about you and other individuals. It is information which identifies
you such as your name, date of birth, address and email address.
Before providing us with personal information about someone else (such as the name and email
address of an additional cardholder), please tell that individual about this Privacy Policy and ask
for their permission to share their personal information with us. We will ask for evidence that the
individual has provided you with authorisation for us to communicate with you about their
account.
Who is responsible for the personal information we collect?
Madison CF UK Limited (which trades as 118 118 Money) is the data controller for the purposes of
the UK GDPR. This is because we dictate the purpose for which your personal information is used
and any personal information you give us about other individuals.
How we collect and use your personal information
You do not have to give us any personal information in order to use most of our websites
(www.118118money.com and www.118m8.com) and limited features of the 118M8 mobile
application. You will need an account to use our 118 118 Money mobile application.
In some circumstances we may need to collect your personal information for example, by law or to
perform a contract with you. If you decide not to give us your personal information, we may not be
able to fulfil our obligations. It may also prevent us from providing you with our products and
services and it may mean that we need to cancel your products and services with us.
If you are 18 or over and you wish to apply for one of our product(s), then we will need to collect
certain information from you. References to You in this Policy mean you as the account holder, plus
any additional cardholder that you request to be added to your account (if you hold a credit card
account with us).
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
If you are a 118 118 Money credit card customer, we will make your transactional history
available for categorisation and analysis in the 118M8 app. We have set out our reasons for
using your personal information in the table below under the heading Legal Basis. Where we
rely on our legitimate interests, we have set out those interests in the table below.
You have the right to object to our use of your personal information at any time. A summary of
your right to object and details of who to contact if you want to exercise this right can be found at
the Contacting us section below.
For further information on your rights please see the Your Rights section below.
Purpose
Legal Basis
To communicate with you and other individuals
• In applications, emails, SMS and letters, meetings and telephone calls (which we
may record and/or monitor for quality checks and staff training);
• Please note that these recordings may also be used to help us combat fraud,
when registering for our products and services, in customer surveys (and
following your response to our surveys), when you participate in competitions
and promotions, through our Group company websites, and during financial
reviews and interviews;
• To tell you about other products or services we can offer you;
• Administer offers, competitions, rewards and promotions.
Consent, performance of a
contract we have with you
and legitimate interests:
we require your personal
information in order for you
to apply for and receive our
products and services.
To make decisions about your application
We will:
•
Verify your identity (and the identity of any additional cardholder you request)
when you apply for or access our products and services. We may ask you to
provide physical forms of identification when you apply for a product or service
with us;
•
Check your eligibility when you apply for our products or services;
•
Check and analyse your income and spending habits – our checks may also
include checking anyone who is financially linked to you;
•
Process your application (or to make counter offers or proposals) and provide
services in relation to this website, including allowing you to monitor your
account and repayments.
We use third parties such as TakTile and Synectics Solutions provide us with
decisioning and fraudulent application, the result of our sharing your data with
these third parties will determine our decision of whether to accept or decline
your application based on our lending categorisation.
Legitimate interests: we
require your personal
information in order to
enable us to assess and
process your application for
our products and services
and to determine the
likelihood that your data is
not being used fraudulently.
To enhance your experience in our 118 118 Money and 118M8 proposition
•
We use data about how you use our apps and services — together with any
connected information or accounts — to understand what features are most
useful, to tailor your in-app experience, and to provide timely and relevant
offers that may benefit you.
•
This may include profiling based on your behaviour in the app (for example,
how often you log in, what tools you use, or how you interact with insights) and
on data connected to your account (for example, transaction insights or
budgeting trends). We do this to help ensure the content you see is
meaningful, useful and aligned to your financial needs.
Where our personalised recommendations amount to direct marketing, we will
only send these in compliance with PECR and your marketing preferences. You
can control these preferences at any time and will be provided an opt-out at
each message.
Legitimate interests: We rely
on our legitimate interest to
improve and personalise
how our services work, and
to offer products or features
that are relevant to your
financial situation. We assess
these interests carefully to
ensure they do not override
your rights and freedoms,
and you can object to this
type of processing at any
time within the app or by
contacting us.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Purpose
Legal Basis
To assist in the ongoing administration of your products and services in
accordance with our terms and conditions which if entered into, will be a contract
between us
• General account handling and service-based communications, such as
statements of account those required by regulatory obligations;
• Tell you about important changes or developments to the features and
operation of your products and services;
• Undertake financial reviews;
• Trace your whereabouts and recover any debt you owe either by 118 118 Money
or its debt collection representatives which may be third parties
Performance of a contract
we have with you.
For audit and statistical purposes
For example, the amount frequency, location, origin, and recipient of your payments
and other transactions, and your use of our products and services.
• Gather management information to form statistical, modelling and trend
analysis with the aim of developing and improving our products and services.
Legitimate interests: we
require your personal
information in order to
enable us to assess and
process your application for
our products and services
and to also help us refine any
products and services that
we may offer in the future.
For assessment of affordability and debt recovery purposes
We will use information we receive from you and our business partners, and from other
organisations such as Credit Reference Agencies (CRAs).Should you inform us of
financial difficulties, we may provide you with a link to our partner, Inicio, whereby you
can enter your income and expenditure details for us to assess how we can help you
further. Once we have received this information, we may contact you for further
discussions.
We may review your debt as part of our overall collections strategy and share your
information with a third party to which we sell or plan to sell your debt.
Legitimate interests: we
require your personal
information to enable us to
process your application,
provide you with our
products and services and
to manage our debt
recovery processes.
To comply with legal and regulatory obligations and/or reporting, as well as legitimate
interests, for example fraud prevention
We will:
• Administer, update, consolidate, improve and manage the accuracy of our
records and our business including but not limited to meeting legal, regulatory
and compliance requirements and operating rules (such as anti-money
laundering, regulatory reporting requirements and record maintenance).
• Monitor and analyse the use of any account to detect, prevent, investigate,
prosecute and/or report fraud, terrorism, misrepresentation, security incidents
or crime.
We will also use information we receive from fraud prevention agencies.
Necessary for compliance
with a legal obligation to
which we are subject.
Any information we can gather on any publicly available social media websites
including Facebook, TikTok, Instagram, X (formerly Twitter) and LinkedIn.
We use this information to help manage your account by reviewing your spending
habits. We also use it to help collect and recover any money that you may owe to us
and to prevent fraud.
Performance of a contract
we have with you and
legitimate interests.
To investigate and respond to any complaints, feedback and queries
Legitimate interests: to
enable us to deal with any
issues you may have in
relation to our products and
services.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Purpose
Legal Basis
If you download our mobile application(s) or use our websites, we may collect
information about your use of them including, where available:
• your IP address, IP address location (city and country) and Internet Service
Provider (ISP);
• operating system and browser type and version;
• the type of device(s) you use
• your email address
We use this information for system administration, fraud prevention and product
development.
In the case of fraud prevention, the above information is shared with TransUnion
and we may receive an assessment determining if the device you have applied
for our services from, or use of your email address, and whether this information
has previously been used for fraudulent activity, the result of this may affect our
decision of whether to accept or decline your application.
Performance of a contract
we have with you and our
legitimate interests: to
enable you to receive our
products and services in
certain formats.
When you login to your online account or access your account via our mobile
application, we will use the mobile phone number, and where requested, the email
address, you have provided to send you a one-time passcode to act as an additional
verification during the login process.
Use for secure authentication
of your login details to
protect you from fraud
If we discover that your personal details are out of date – whether through
communication with you, our own checks, or information received securely from a
trusted third party – we will update our records to make sure they remain accurate and
up to date.
We do this to meet our obligations under the Data Protection Act 2018 and the UK
GDPR, which require personal data to be accurate and, where necessary, kept up to
date.
Where your information is also shared or accessed under secure data-sharing
arrangements approved by the Data Use and Access Act 2025 (DUAA) — for example,
between regulated financial services firms or through accredited data intermediaries
— we will take reasonable steps to ensure those updates are reflected consistently, in
line with the DUAA’s data quality and accountability standards.
To comply with the fourth
Data Protection Principle
under the Data Protection
Act 2018 and UK GDPR
(Article 5(1)(d)) – for personal
data to be accurate and
kept up to date
Your personal information will be held securely so that we and any other companies in our Group
that you have dealings with, either now or in the future, can manage your relationship with us.
This will include information you provide when you apply to us, and any additional information provided
by you or others.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Payment Services Directive 2 (PSD2) and your data (applies to 118 118 Money)
The Payment Services Directive 2 (PSD2) is a regulation which has been introduced to help protect
you from online fraud. You may have had communications already from other suppliers or heard of it
being referred to as Strong Customer Authentication or SCA.
This regulation means we'll take additional steps to verify your identity when you log in to your online
account to manage your loan or credit card, rather than just asking for your password or fingerprint.
Every time you log in to your 118 118 Money online account, we will send you a one-time passcode
and you will need to enter this to complete your log in. If you use our app to manage your account,
you won't have to do this every time you log in but we will be asking you to verify your identity every
so often.
The passcode is sent to the mobile phone number you have registered with us as a text message.
Please ensure that your mobile phone details are up-to-date and should you need to change them,
please contact our Customer Assistance team on 02920 548118 or via the 118 118 Money mobile
app.
What is Eligibility Check? (applies to 118 118 Money)
Eligibility Check is an online service we offer which will tell you if you might be eligible for one of our
products and services (such as a loan or a credit card) without it affecting your credit rating.
If you wish to use Eligibility Check you will be asked to submit certain personal information to us —
please see the Using credit reference agencies (CRAs) section below for further details of the
information you will be asked to provide.
Eligibility Check allows us to check your credit record (you’ll be able to see our search on your
credit file, but other organisations won’t be able to see it which means that it will not impact your
credit rating). We will use our search, together with the information you have provided to tell you if
we’re likely to accept you for our products and services, solely on a credit basis using our own
credit scoring methods.
Following the Eligibility Check, we’ll tell you if you’re likely to be accepted by us for our products and
services, but this is not an offer of credit.
If, following the Eligibility Check, you decide to complete your application for our products and
services we will run further checks (including a credit check which other organisations will be able
to see on your credit file) and, if:
• we find certain information on fraud prevention databases or we can’t verify your identity or
other information you’ve given us; or
• based on the information you’ve given us we don’t believe that the product or service is
affordable or sustainable for you,
we will not be able to offer you the product or service.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
As we are a finance broker (as well as being a lender), if we are not able to offer you one of
our products or services, we may pass your information to our lending partners Aspire Money
Limited (Aspire). Aspire Money is a consumer credit lending platform who may use your
information to assist you in a finding an alternative appropriate product which meets your
needs by sharing your application data with other providers.
To enable us to legitimately pass your application information (including personal data you
have provided) to one of our lending partners, we will request your consent and this consent
will be recorded for audit purposes.
Once your data has been passed to one of our lending partners, you will retain a relationship
with both 118 118 Money and the lending partner in line with the terms as stated in the
respective privacy policies.
For further information on Aspire, please visit www.aspiremoney.co.uk.
Additional credit searches during system testing (118 118 Money)
When you apply for a product with us, we may carry out a credit check using credit
reference agencies. This usually involves a “soft search”, which is visible to you on your
credit file but does not affect your credit score.
As part of improving our systems, we may temporarily run more than one credit
assessment at the same time to ensure our new systems are working correctly. During this
period, you may see more than one soft search from us on your credit file.
These additional searches:
• are only “soft searches”
• do not affect your credit score or lending decisions by other lenders
• are used solely for testing and validation of our systems
Even if multiple searches are recorded, they will not impact your ability to obtain credit.
We will only carry out searches where necessary and in line with our data protection
obligations.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Who do we share your personal information with?
Our Group companies
We may share your personal information with any member of our Group, which means our
subsidiaries, our ultimate holding company and its subsidiaries. This enables us, and other
companies within our Group, to better understand your needs and run your accounts in the efficient
way that you expect. We will always treat your personal information as private and confidential.
Fraud prevention agencies (applies to 118 118 Money)
We will also need to confirm your identify before we can provide you with our products and
services and will need to share your personal information to help detect fraud and money
laundering risks. We use fraud prevention agencies to help us with this.
Should fraud or money laundering be suspected, we will pass your personal information to a law
enforcement agency so that they can investigate, prosecute and prevent financial crime. A fraud
prevention agency may also share your personal information with a law enforcement agency.
Online banking and you providing us with bank statements (applies to 118 118 Money)
As part of our checks in respect of your application for one of our products and services, we may
also ask you to supply your bank statements in order to verify your identity and/or to verify details
of your income and expenditure.
If we ask you for your bank statements, we will tell you how to supply these securely to us directly
or we may offer you the option to supply them to us using MOGObankconnect (which is a free of
charge service offered by TransUnion (a CRA) which enables us to see the transactions on your
bank account securely).
For more information on this service, please see www.TransUnion.co.uk/consumer-solutions/mogo-
bank-connect.
We also partner with Credit Kudos Limited, who provide open banking services. This means that
during the application process we may direct you to Credit Kudos for you to link your online
banking account with your application. This delivers to us the information held within your bank
statements and the ability to use these within our decision process for the application.
You are in complete control of this service and may rescind permission at any time, we will store
the information provided by Credit Kudos as per the retention tables in this Policy. Credit Kudos’s
Privacy Policy can be found at https://www.creditkudos.com/legal/privacy
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
118 118 Money’s Use of Open Banking Services (applies to 118 118 Money & 118M8)
What is Open Banking?
Open Banking is an initiative led by the UK’s Competition and Markets Authority (CMA) to facilitate
innovation, competition and collaboration between banks, financial technology and online service
providers through the creation of new products and services for customers using Application
Programming Interfaces (APIs).
118 118 Money and Open Banking
118 118 Money provides you with a payment facility in the form of a credit card and is
therefore defined as Account Servicing Payment Service Provider within Open Banking. This
means that you may provide your consent to FCA regulated third party providers, so that your
118 118 Money related financial information is shared in a controlled and secure manner.
If you choose to share information, you will be automatically asked to refresh your consent
every 90 days to ensure that you continue to understand and consent to the information being
shared. At any point you can remove your consent instantly through your online account with
118 118 Money, or through the third-party provider's software.
Data that may be shared via Open Banking, with your consent, could include the following: -
• Account name
• Account number
• Balance
• Incoming transactions
• Outgoing transactions
• Detailed statement view
• Product details
• Offers available to you
Please be aware that if we share your data, with your consent, you will also be able to review this
data within your chosen third-party Open Banking provider.
If you are accepted based on your open banking data, and have consented to marketing, we may
use insights derived from that open banking data to offer you new products or services.
This use of open banking data for marketing purposes is separate from, and in addition to, your
consent to share open banking data for application and affordability assessment. You can withdraw
your marketing consent at any time.
118 118 Money and Money Dashboard (D•One) Open Banking (applies to 118 118 Money)
During your application process, we may need further information to help us assess your suitability to
our credit card or loan products, and which one is right for you.
To help us with this, we have partnered with D•One to provide us with information relating to
validating your income and the categorisation of your spending habits. This will only occur if you
provide consent, after reading D One’s privacy information, and connect your bank account.
D•One will manage your personal data and send this back to 118 118 Money to aid our decisioning.
We are permitted to only use the categorised information for the purpose of assessing your eligibility
or processing your application. We may share the categorised information with a third party to help
us perform internal analytics to assess the information provided.
Once the information is received, your application will be reviewed and you or may not be
approved for lending.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
118M8 and Money Dashboard (D•One) Open Banking (applies to 118M8)
From March 2026, it is possible for you to connect your open banking data to your 118M8 account;
to help us with this, we have partnered with D•One to provide us with information relating to the
categorisation of your spending habits. This will only occur if you provide consent, after reading D
One’s privacy information, and connect your bank account. D•One will manage your personal
data and send this back to the 118M8 app for us to present it to you in easy-to-read categories,
along with your daily balances. This connection will remain active until you withdraw consent by
contacting D•One.
The data provided via D•One will enable you to access additional features which will help you
understand your spending and credit trends and your overall financial fitness journey,
If you’d like to read more about Open Banking, please visit What is open banking? - Open Banking.
Using credit reference agencies (CRAs): (applies to 118 118 Money)
CRAs collect and maintain information about consumers’ and businesses’ credit behaviour. This
includes Electoral Register, fraud prevention and credit information. This will include details of
previous applications and the conduct of your accounts—and public information such as County
Court Judgments, decrees, and bankruptcies.
We carry out credit and identity checks when you apply for our products and services. This helps
us to:
check the information you have given us;
check your identity;
assess your financial status;
analyse your spending habits and your management of your accounts with us;
determine your chances of being accepted for our products and services;
help detect and prevent fraud and money laundering;
identify and, where applicable, rank the most appropriate products and services for you, taking
into account your personal circumstances.
We will use CRAs who will make credit searches and will pass your information to CRAs (such as
TransUnion Limited, Equifax Limited and Experian Limited). We will give details of your accounts
and how you manage it/them to CRAs. We will also do this on a periodic basis to manage your
accounts with us.
The CRA will supply us with both public (including the Electoral Register) and shared credit and
fraud prevention information. This information may be supplied to other organisations by CRAs
and fraud prevention agencies to perform similar checks and to trace your whereabouts and
recover debts that you owe. We may also ask CRAs to give us information about you.
The CRAs will keep a record of this search and place a “footprint” on your credit file, whether or
not the application proceeds, this is deemed a soft search during the application process and is
only viewable by you.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
This information may be supplied to other organisations by CRAs and fraud prevention agencies
to perform similar checks and to trace your whereabouts and recover debts that you owe. We
may also ask CRAs to give us information about you.
The information we provide CRAs together with any information you provided us to assess your
application may be shared between us, the CRAs and fraud prevention agencies and used by
them and us to make decisions, for example when:
checking details on applications made by you;
managing your accounts;
recovering debt;
checking details of job applicants and employees;
detect and prevent crime, fraud and money laundering;
check your credit history;
analyse your income;
assess your spending habits;
verify your identity if you apply, or someone financially linked with you applies, for products
or services;
trace your whereabouts;
undertake research, statistical analysis and systems testing;
manage your accounts, for example, in the event that we are considering, or you ask us to
consider, changing your credit limit;
to see if you might be eligible for any of our other products and services.
Where the data we have received, identifies that the data we hold on you is inaccurate, in
accordance with the accuracy principle of UK GDPR, we will ensure that the data is rectified without
delay.
Monitoring for fraudulent applications (applies to 118 118 Money)
118 118 Money utilises services provided by TransUnion which assist us in identifying potentially
fraudulent applications and activity. These services are able to check ID, email addresses and
characteristics about the mobile phone or computing device being used to apply for or use of our
financial services. For this purpose the services may include, but not be exclusive to, CallValidate UK,
EmailRisk, DeviceRisk, MobileRisk, MobileSimSwap and MobileKYC.
For TransUnion to provide these services, 118 118 Money automatically transfers these details to
TransUnion for their analysis and to contribute to central databases. During normal service this
information is stored within the UK and European Economic Area (EEA), however, during times of
recovery or business continuity, this information may be stored by TransUnion outside of the UK and
EEA.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
TransUnion may also use other TransUnion group companies, or approved sub-contractors, to
provide these services to you.
For further information, please review the TransUnion privacy policy, which can be found at:
https://www.transunion.co.uk/legal/privacy-centre
Relating to the DeviceRisk service, please see the privacy policy at the link
https://www.iovation.com/privacy
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Your rights to apply to the CRA
You have the right to apply to the CRAs for a copy of your credit file.
We use different agencies so please be aware that the information they hold may not be the
same. There is a small fee that you may need to pay to each agency that you apply to. The
addresses of the CRAs we currently use are:
Experian Consumer Help Service, PO Box 9000, Nottingham NG80 7WP or call 0844 481 8000 or
log on to http://www.experian.co.uk/crain/index.html
TransUnion Consumer Services Team, PO Box 491, Leeds LS3 1WZ or call 0870 060 1414 or log on to
www.TransUnion.co.uk/crain
Equifax Customer Service Centre, PO BOX 10036, Leicester LE3 4FS or call 0800 014 2955 or log on to
https://www.equifax.co.uk/crain
You can also find out more information about the CRAs we use by reading the Credit Reference
Agency Information Notice each CRA makes available on its website (see
http://www.experian.co.uk/, https://www.equifax.co.uk, and www.TransUnion.co.uk). This notice
will:
tell you about the CRA;
provide further details on the information held by the CRA and how they use it;
let you know who the CRA shares information with and why;
explain how the CRA works with fraud prevention agencies;
give you information on your rights.
Using fraud prevention agencies: (applies to 118 118 Money)
As part of our due diligence when assessing your application, we have systems that protect our
customers and ourselves against fraud and other crime.
Customer information can be used to prevent crime and trace those responsible. We will share
your personal information from your application with fraud prevention agencies.
If false or inaccurate information is provided and fraud is identified, details of this fraud will be
passed to these agencies. We and other organisations may access and use from other countries
the information recorded by fraud prevention agencies. Law enforcement agencies may access
and use this information.
If your details are passed to these agencies because we believe that you have committed fraud,
you may find it more difficult to obtain services, finance or employment with us and other
participating organisations.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
We and other organisations may also access and use this information to prevent fraud and money
laundering, for example, when:
checking details on applications for credit and credit related or other facilities;
managing credit and credit related accounts or facilities;
recovering debt;
checking details on proposals and claims for all types of insurance; and
checking details of job applicants and employees.
We may also make periodic searches at fraud prevention agencies to manage your account
with us.
The Fraud Prevention Agency we use is:
CIFAS, with registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London, WC1H 9LT.
You can contact CIFAS at https://www.cifas.org.uk/contact_us.
Using debt collection agencies (applies to 118 118 Money)
We may have referred the collection of your debt with us to a third party and may have sent
them your personal data (as per previous Privacy Policy versions), along with the financial
standing of your account and advise of any missed payments, and/or balances outstanding.
There may be circumstances where your debt is returned to 118 118 Money and the third-party
debt collection agency may retain your personal data for 180 days from the date the debt is
returned. The purpose for this is to ensure that any queries by you or 118 118 Money can be
adequately responded to. All other data retention is as per this statement.
The partner may need to refer to your personal data when contacting 118 118 Money with
regard to a complaint or enquiry you raise with them.
118 118 Money does not use debt collection agencies at this time.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Using debt sale partners (applies to 118 118 Money)
We may review your debt as part of our overall collections strategy and decide that the debt is
to be sold to a third party. We may negotiate with a number of debt sale organisations as part of
this process.
The information we will need to send to these debt sale organisations will include personal data
(contact details), banking details (your name, account number and sort code) and financial
records denoting the performance of your debt with us.
In preparation for a sale, we may share this personal data with a prospective debt sale
organisation where it is in our or the organisation's legitimate interests to do so, for example, to
enable the organisation to process your personal data for data verification and pricing purposes.
If the sale goes ahead, we may share this personal data with a debt sale organisation where it is
in our or the organisation's legitimate interests to do so, example, to enable the organisation to
manage your debt and to meet its regulatory obligations or reporting requirements. In these
circumstances, the organisation may use or disclose your personal data in the same way as set
out in this Privacy Policy but will also be responsible for providing you with its own privacy
information.
These organisations must keep your information confidential (though they may share it with credit
reference agencies) and take all adequate and appropriate technical and organisational
measures to keep your information confidential.
If your debt is sold by 118 118 Money to one of its debt sale partners, then you will be informed
by letter.
Using debt advice partners
In circumstances where your account may be in arrears or, you may be experiencing financial
difficulty, we may suggest that you engage with a debt advice provider and may provide you
with appropriate options.
Analysis and processing of call recordings (applies to 118 118 Money and 118M8)
All calls to 118 118 Money are recorded for quality monitoring and training purposes.
You are able to request an audio copy or transcript of your call by emailing the Data Protection
Officer at dpo@118118money.com.
Analysis of your journey on our website or mobile app (applies to 118 118 Money)
We use a partner called Glassbox to help us analyse your customer experience and journey
through our website and mobile app. This process enables us to see where you stop on our
web/app pages and how you manoeuvre within our pages, this helps us identify areas where
our customers may experience difficulties or where areas of our customer experience/journey
may need improvement or changes.
All personal data within the journey is masked and not stored or seen by Glassbox.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Communications with you (applies to 118 118 Money and 118M8)
We have partnered with Braze, Inc. to provide a multi-channel communication platform for service
and (where consent is given) marketing messages. Braze processes personal data on our behalf so
we can send you messages by email, SMS, mobile push and in-app notifications, and to help us
measure and improve how these messages perform.
When you interact with messages from us (e.g., opening a message, clicking a link), Braze may
process and track engagement and interaction data to support analytics, reporting and
segmentation. This information helps us understand what communications are most relevant to you
and to tailor future messaging but is only used for purposes that align with the consent you have
provided.
Service messages will be sent via this channel to update you about your financial product,
regulatory notifications and other important information. Where you have consented to receive
marketing messages, we may use Braze to send these and to personalise or improve their relevance.
We may occasionally reach out to you using Survey Monkey for your opinions to help us improve our
services.
We ensure that only authorised employees with a business need can access your data via our
communications systems and that appropriate security controls and contractual safeguards are in
place with all partners processing personal data.
Privacy policies for our communications partners can be found below:
• https://www.surveymonkey.co.uk/mp/legal/privacy/ (customer surveys)
• https://www.braze.com/company/legal/privacy (Braze messaging platform)
• https://hightouch.com/privacy-policy (data sync/processing between 118 118 Money and Braze)
Targeted advertising on social media platforms (applies to 118 118 Money and 118M8)
Where you have consented to receive marketing from us, we may use your contact details (such as
your email address or phone number) to help show you personalised advertisements on third-party
platforms, including social media providers such as Meta (Facebook and Instagram) and TikTok.
This involves securely sharing limited identifiers (for example, email addresses or phone numbers,
typically in a hashed and encrypted format) so that these platforms can match you to their users
and display relevant advertising on our behalf. We do not share credit card details, bank account
information or other sensitive financial data for this purpose.
Meta and TikTok act as independent data controllers for the personal data they receive through this
process and use that data in accordance with their own privacy policies.
You can withdraw your marketing consent at any time, which will stop this use of your personal data
for targeted advertising on social media platforms.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Making payments via our telephone system (applies to 118 118 Money)
118 118 Money provides the option for you to use an electronic service for processing debit or credit
card payments, for this we use the services of keyIVR. Following you choosing to make a payment,
you are transferred automatically to the keyIVR service which will ask you to enter your card details
(card number, expiry date and CVC) using your phone keypad. Once you have completed this,
your details are processed by keyIVR and your card is tokenised, this is a secured method of ensuring
that keyIVR do not store your card details.
keyIVR are a PCI-DSS compliant provider of payment services and has passed 118 118 Money’s
stringent security due diligence procedures. Further information can be found at
https://www.keyivr.com/pci-dss-solutions/payment-ivr/.
Our other service providers and agents
We will share your personal information with:
• third parties involved in managing accounts and services for you or collecting what you owe
to us;
• our suppliers of underwriting and analysis services;
• IT service providers including those which provide our websites and mobile app hosting and
maintenance services;
• sanction screening, identity and fraud prevention check providers;
• our call centre operators;
• business process outsourcing providers;
• your digital wallet provider (Samsung, Apple or Google) for the purpose of setting up your credit
card in their digital wallet service;
• HM Revenue & Customs or other authorities;
• third parties where we are required to do so by law (for example, we are required to screen
applications that are made to us to ensure we are complying with the international fight
against terrorism and other criminal activities) or by our regulatory bodies such as the Financial
Conduct Authority or if we require or are required by others to investigate or prevent crime;
• market research companies to assist in providing better products and services for you;
• third parties who may be connected with your accounts; and
• where we are required as part of our duty to protect your accounts, for example, we are
required to disclose your information to the UK Financial Services Compensation Scheme (FSCS).
We will also share your personal information:
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
• with any person from whom we borrow funds to finance our business or part of it (or with whom
we enter into negotiations to finance our business) and their professional advisers;
• with any person to whom we sell, merge or transfer (or enter into negotiations to sell, merge or
transfer) our business or part or all of our business or assets or enter into a merger with it;
• to a potential buyer, transferee, or merger partner or seller and their advisers so long as they
agree to keep it confidential and to use it only to consider the possible transaction;
• if the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your
personal information in the same way as set out in this Privacy Policy.
We will always ensure your information remains safe and secure.
Why we may process special categories/sensitive personal information about you:
Some personal information under data protection law has special protection. This information is
known as special categories of personal information, but it may also be called sensitive personal
information. This type of personal information includes information which relates to your racial or
ethnic origin, political opinions, religious beliefs or philosophical beliefs, trade union membership,
genetic or biometric data or data concerning your health, sex life or sexual orientation.
When you apply to us for our products and services and, as part of managing any products and
services you have with us, we may ask you for special categories of personal information. We will
only use this information to provide the service you require or help to manage your products and
services and/or your account.
If we need to obtain special categories of personal information, we will ask for your explicit
consent first.
Where will we transfer your personal information?
There will be times when we share your personal information within our Group and with our third-
party providers who are located in countries outside of the European Economic Area (EEA).
Your personal information will be transferred to countries outside the EEA such as the USA and the
Philippines. For example, if you’ve got a loan or credit card with us, we use our call centre in the
Philippines for customer service calls, payment reminder calls, payment collections calls and to
obtain outstanding documentation from our loan customers.
When we transfer your personal information outside the EEA, we will take reasonable steps to
ensure that your personal data is protected. To do this we use a set of standard data protection
clauses which have been approved by the European Commission.
Whenever fraud prevention agencies transfer your personal data outside of the EEA, they impose
contractual obligations on the recipients of that data to protect your personal data to the
standard required in the EEA. They may also require the recipient to subscribe to ‘international
frameworks’ intended to enable secure data sharing.
The above approach is compliant with data protection law (being Article 46.2 of the UK GDPR). For
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
further information about these transfers and the safeguards in place, please get in touch via the
Contacting us section below.
How we use your personal information to make automated decisions (applies to 118
118 Money)
When you apply for our products and services, we use both a manual and an automated system
known as credit scoring to determine your eligibility for them. This is a method of assessing your
likely conduct of an account based on a range of data, including the conduct of previous
similar accounts. Credit scoring is a system widely used by credit providers to help make fair and
informed decisions on lending.
This means we may automatically decide that you pose a fraud or money laundering risk if our
processing reveals your behaviour to be consistent with money laundering or known fraudulent
conduct, or is inconsistent with your previous submissions, or you appear to have deliberately
hidden your true identity. You have rights in relation to automated decision making.
If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk,
we may refuse to provide the services or financing you have requested, or we may stop providing
existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies,
and may result in others refusing to provide services, financing or employment to you.
Some of these decisions do not involve human input and the systems apply pre-defined logic
programming and criteria to make a decision. For example, we use information about your
income, expenditure, other financial commitments and payment history. This information is
analysed by automated means which uses statistical models and rule-based systems to evaluate
your credit worthiness, affordability and overall financial health.
Credit scoring takes into account information usually from three sources:
• the information you provide in connection with your application;
• information provided by searches conducted at CRAs and fraud prevention agencies; and
• information that may already be held about you by us or companies in our Group.
A credit scoring system will consider information from these sources to make an overall assessment
of your application. This assessment will extend to anyone with whom you are linked financially or
other members of your household.
The information we obtain may be used:
• to check the information you have given us;
• debt tracing;
• analysing your income and spending habits;
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
• for the detection and prevention of fraud or money laundering;
• the management of our service to you.
If you provide a credit or debit card as part of your application or as part of a continuous
payment authority (CPA), we may also use a third party to check the validity of the sort code,
account code and card number that you submit in order to prevent fraud. The information you
provide us will be transferred to CRAs and fraud prevention agencies who will record details of
any search whether or not your application succeeds.
We may transfer personal and financial data to partners called DataRobot Inc. and TakTile, they
assist us in refining our lending strategy. The credit scoring methods used are regularly tested to
ensure they remain fair, effective and unbiased. Using a credit scoring system helps us to lend
responsibly.
Your rights to challenge automated decision making
You have the right to challenge any automated decision with us directly. You can ask that we do
not make automated decisions about you and you can object to an automated decision and ask
that a person reviews it.
If you want to know more details about your rights, please get in touch via the Contacting us
section below.
Use of generative artificial intelligence (AI) technology
118 118 Money has published an Acceptable Use of Generative AI Policy and will not include any
personal data of customers or employees into any generative AI tool (such as ChatGPT, CoPilot etc.)
which is used for open learning.
Any tool where 118 118 Money has risk assessed and assured that the personal data is not used for
training the AI is permitted, though use must be stated.
As of the date of this Policy, we use generative AI tools in the following ways:
- Amazon AWS AI – We employ a suite of AWS AI services and tools to screen and analyse all
customer service channels, for the purpose of quality assurance, continuous improvement and all
activities associated with improving customer satisfaction.
- Court Correct – use of Court Correct AI tools to review your complaints case and assist in providing a
final response.
- Budgie – use of Budgie AI for helping you complete income and expenditure forms to help manage
your account and payments with 118 118 Money.
Asking you for reviews of our products and services
After you have applied for one of our products, we may send your email address to TrustPilot who
may ask you to leave a review of the service you have been provided. Should you not wish to leave
a review or wish TrustPilot to stop processing your personal data, please contact TrustPilot as stated in
their Privacy Policy, https://uk.legal.trustpilot.com/for-reviewers/end-user-privacy-terms.
Should you download our 118 118 Money or 118M8 app via the Google Play Store or Apple
AppStore and leave a review, we may reach out to you to thank you for your review or to determine
any issues you may have in accessing your account or with our app. We will only contact you if we
are able to determine unique data to identify you as an individual and we will not divulge any
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
personal data during that conversation (email, chat or telephone) without requiring identification
and verification checks to be passed to ensure that we are speaking to you.
Retention of your personal information
How long we keep your information for depends on the basis on which it was provided.
Generally, however, we will keep the information that is necessary to enable us to provide you
with the products or services you have requested through our websites for as long as it takes us to
provide that product or service.
If you have asked that we do not use your details for marketing purposes, we may still need to
keep them to ensure our systems reflect your preferences.
We will keep records of any transactions you enter into on our websites for a minimum of 6.5
years from the end of our relationship with you. This is so that we can respond to any complaints
or disputes that arise in that period.
Retention of your personal data can be demonstrated by this diagram for 118 118 Money:
Fraud prevention agencies may hold your personal data for different periods of time, and if
you are considered to pose a fraud or money laundering risk, they may hold your data for up to
six years.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Retention for 118M8 data
If you use the 118M8 mobile application and do not register for an account, or you do not sign in
using your 118 118 Money account, then your data is held locally on your mobile device and erasing
the application removes the data.
Where you have registered for an account, or you use your 118 118 Money account to access the
features of 118M8, your data is retained as above.
Links to third party websites
Our websites (www.118118money.com and www.118m8.com) contains links to other websites over
which we have no control.
We are not responsible for privacy policies or practices of other websites to which you choose to
link from our websites. We encourage you to review the privacy policies of those other websites
so you can understand how they collect, use and share your information.
Marketing
If you opted in to receive newsletters, commercial emails or other communications from us or
selected third parties but subsequently change your mind, you may opt-out by Contacting us as
set out at the end of this Privacy Policy.
Cookies (applies to www.118118money.com and www.118m8.com)
We use cookies on our websites (www.118118money.com and www.118m8.com) to distinguish
you from other users of the websites. This helps us to provide you with a good experience when
you browse our websites and also allows us to improve the websites.
You have the option to customise the optional cookies, or reject all optional cookies as required
by the Information Commissioner’s Office (ICO).
For information on the cookies we use, and the purposes for which we use them, please see our
Cookie Policy.
App tracking technologies (applies to 118 118 Money and 118M8 mobile
applications)
Where you have provided your consent, we use optional analytics and marketing SDKs within our
mobile applications to help us measure performance, understand how users engage with our apps,
and improve our services and communications.
These include:
• Google Analytics, which we use to understand how users interact with our mobile applications (for
example, app usage patterns, feature engagement and performance metrics);
• Braze, which we use to deliver service and marketing messages (where consent is given) and to
analyse engagement with those communications, such as message opens, clicks and in-app
interactions;
• Meta (Facebook and Instagram) and TikTok Technology (TikTok), which we use to measure
advertising performance, app installs and in-app activity following marketing campaigns, and to
optimise how our marketing is delivered.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
When enabled, these SDKs may collect information such as device identifiers, app interaction
events, IP address and engagement data. We do not share credit card numbers, account
credentials or sensitive financial information through these SDKs.
Google Analytics and Braze act as data processors on our behalf and process personal data only in
accordance with our instructions. Meta and TikTok act as independent data controllers for the data
they receive through their SDKs and use that data in line with their own privacy policies.
These technologies are used only where you have given your consent, which you can manage or
withdraw at any time through your app privacy settings or device controls.
Contacting us:
If you have any questions about this Policy or your personal information and/or if you wish
to see what information we hold about you, please contact the Data Protection Officer on
dpo@118118money.com.
If you no longer wish to receive any marketing communications or wish us to stop using your
personal information, please contact us:
By accessing your 118 118 Money customer portal or via the 118 118 Money app. Login
to your account, via a browser, and go to the Marketing Preferences section.
By phone: 02920 548 118, this call will be charged by your provider as UK national number.
By mail: Data Protection Officer, 118 118 Money, 5
th
Floor, 1 Capital Quarter,
Tyndall Street, Cardiff, CF10 4BZ
By email: dpo@118118money.com
How to complain
If you think there is a problem with how your personal information is being handled, you have a
right to complain to the Information Commissioner’s Office (ICO).
The ICO can be contacted on 0303 123 1113 or please visit their website at www.ico.org.uk.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
DATA PROTECTION STATEMENT
LOANS CUSTOMERS – 118 118 MONEY
WHEN APPLYING FOR A LOAN ON OUR WEB SITE OR VIA A MOBILE APP
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
with another company?
Retained
for?
Name
(including Title,
First name and
Surname)
Identification during
application process
ID verification if you call
us
Checking for duplicate
applications (potential
fraud)
You
Ireland & UK
Internal
customer
databases
Data-
warehouse
Email system
EU
ZeroBounce
email
verification
Yes
TransUnion
Experian
Equifax
(credit reference and
scoring)
ZeroBounce – email
address verified by
ZeroBounce to ensure that
we have captured live
email account details.
See
application
decision for
retention
periods
ZeroBounce
retain
checked
email
addresses
for a
maximum
of 30 days.
Email address
Contact during
application process
Mobile number
Checking for duplicate
applications (potential
fraud)
Date of birth
Identification during
application process
ID verification if you call
us
Checking for duplicate
applications (potential
fraud)
Net monthly
income
Affordability checks
during application
process
Monthly
outgoings
Affordability checks
during application
process
Address
including
postcode
Identification during
application process
ID verification if you call
us
Time at address
Identification during
application process
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
continued from previous page
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
with another company?
Retained
for?
Residential
Identification during
You
Ireland & UK
Yes
See
application
decision for
retention
periods
Status
application process
Internal
TransUnion
Experian
Equifax
customer
(credit reference and
Databases
Data-
warehouse
scoring)
6 years, 6
months
from the
termination
of your
credit card
agreement
with us, if
application
is successful
Bank Details
(including
account holder,
sort code and
account number)
During application as part
of identification process
You
Ireland & UK
Internal credit
card customer
databases
data-
warehouse
Yes
TransUnion, for their
CallValidate service to
verify identification
To help with checking your affordability of our product(s), we may also ask the number of
dependants you have, your marital status, any additional household income, other credit
commitments and essential expenses.
All of the above personal data types may also be used for ensuring that your application is not
fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited,
via their Compliance Assist software to ensure that we are legally permitted to lend to you.
118 118 MONEY & 118M8 PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
FOR LOANS PRODUCTS – CUSTOMERS OF 118 118 MONEY
IF YOU ARE REFERRED TO OUR UNDERWRITING TEAM (IN ADDITION TO THE APPLICATION
PERSONAL DATA)
Type
of data
Why do we need this
information?
Source
of data
Where
stored?
Shared
externally?
Retained
for?
Name
(including Title,
First name and
Surname)
Identification during
application process
ID verification if you
call us
You
Ireland & UK
Loan
management
system
Data-
warehouse
Email system
EU
ZeroBounce
email
verification
Yes
Passed to credit
reference agencies
(TransUnion and
Experian)
See
application
decision
for retention
periods
ZeroBounce
retain
checked
email
addresses
for a
maximum of
30 days.
Email address
Contact during
application process
Yes - ZeroBounce – email
address verified by
ZeroBounce to ensure that
we have captured live
email account details.
Mobile number
Contact during
application process
No
Date of birth
Identification during
application process
ID verification if you
call us
Yes
Passed to credit
reference agencies
(TransUnion and
Experian)
Employer
Identification during
application process
No
Net monthly
income
Affordability checks
during application
process
No
Monthly
outgoings
Affordability checks
during application
process
No
Address
including
postcode
Identification during
application process
ID verification if you
call us
Yes
Passed to credit
reference agencies
(TransUnion and
Experian)
Time at address
Identification during
application process
continued on next page
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
continued from previous page
Type
of data
Why do we need this
information?
Source
of data
Where
stored?
Shared
externally?
Retained
for?
Name, address,
date of birth
PEPs and Sanctions
checking
You
UK
Yes
Factiva (Compliance
Assist)
See
application
decision for
retention
periods
Marital Status
To review financial
relationships with
others
You
Ireland & UK
Loan
management
system
Data-
warehouse
No
See
application
decision
for retention
periods
Bank details
Identification during
application process
Nationality or
confirmation of
being UK citizen
We can only provide
service to UK citizens
or those with right to
reside in the UK
Debit card
Details
Identification during
application process
All of the above personal data types may also be used for ensuring that your application is not
fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited,
via their Compliance Assist software to ensure that we are legally permitted to lend to you.
CREDIT REPORT CHECKING AND ID VALIDATION
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
TransUnion
(CallValidate)
Check validity of
bank account
TransUnion
Ireland & UK
Loan
management
system
Data-
warehouse
No
See application
decision for
retention periods
TransUnion
(Credit Search)
Assessment of
current and
previous lending
TransUnion
(TAC)
Affordability checks
as required by FCA
Experian
Affordability checks
as required by FCA
Experian
Ireland & UK
Loan
management
system
Data-
warehouse
See application
decision for
retention periods
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
Bank
statements
Affordability checks
as required by FCA
You
Ireland & UK
Loan
management
system
Data-
warehouse
See application
decision for
retention periods
Photo
identification
Identification
verification
Right to reside
We can only
provide service to
UK citizens or those
with right to reside
in the UK
REPORTING OF POTENTIALLY FRAUDULENT LOAN APPLICATIONS
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
Personal
information
provided by
To CIFAS for
reporting potential
fraudulent activity
Loan
management
system
Ireland & UK
Loan
management
Yes
CIFAS
6 years from date
uploaded
you during
System
Data-
warehouse
the loan
application
process
Loan
application
date
APPLICATION DECISION – IF YOU ARE AUTOMATICALLY DECLINED OR WE HAVE ASSESSED
YOUR APPLICATION AS NOT BEING ELIGIBLE/YOU CHOOSE NOT TO PROCEED WITH YOUR LOAN
APPLICATION/YOU WITHDRAW FROM THE AGREEMENT
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
CallValidate
Check validity of
bank account
TransUnion
Ireland & UK
Loan
management
system
Data-
warehouse
No
60 months
Credit Search
Assessment of
current and
previous lending
TAC
Affordability checks
Experian
Affordability checks
Experian
Ireland & UK
Loan
management
system
Data-
warehouse
No
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
All personal
information
provided by
you during
application
To refine our scoring
procedures
You
(with
permission
to re-use)
UK
Loan declines
database
Ireland
Data-
warehouse
Yes,
Passed
to credit
reference
agency
(TransUnion:
https://
www.
TransUnion.
co.uk/crain)
maximum
twice within
24 months
LOAN APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN
Where we have declined your application, we may provide you with alternative options through our
partners; by proceeding you will be asked to accept the partner’s data processing agreement.
Analytics and Scoring Procedures
As mentioned in row 5 above, 118 118 Money may retain your personal data if you are declined as a
loan customer, or decide not to proceed with your loan application, for the purpose of improving
the scorecards for our financial services products.
The legitimate interest requirement is to enable us to further refine our scoring based on the
information submitted as part of the application process. This applies to both declined and
approved customers. This information may be passed to relevant third parties (such as Credit
Reference Agencies) to assist us in building better models for credit scoring in the future.
This information is retained for declined applications for 60 months, after which it will be anonymised.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
APPLICATION DECISION – APPROVED FOR A LOAN
Type of data
Why do we need
this information?
Source
of data
Where
stored?
Shared
Retained for?
Agreement
number
For loan products,
you are assigned a
unique reference
number.
System
generated
Ireland & UK
Loan
management
system
Data-
warehouse
No
End of product term
+ 6 years and 6
months
CallValidate
Check validity of
bank account
TransUnion
Credit Search
Assessment of
current and
previous lending
TAC
Affordability checks
Credit score
Score indicating
credit worthiness
Experian
Affordability checks
Experian
Ireland & UK
Loan
management
system
Data-
warehouse
No
End of product term
+ 6 years and 6 months
Bank details
Debit card details
Processing of
payment of your
loan and providing
a backup payment
method
You
Ireland & UK
Loan
management
system
Yes, debit card
tokenised by
Worldpay or
KeyIVR
End of product term
+ 6 years and 6 months
All of the above personal data types may also be used for ensuring that your application is not
fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited,
via their Compliance Assist software to ensure that we are legally permitted to lend to you.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY
Type of data
Why do we
need this
information?
Source of
data
Where stored?
Shared
externally?
Retained for?
Financial
Statement
Assessment of
ability to repay
your debt
Analysing your
payment
behaviour with
118 118 Money
and other
creditors to assess
whether we are
able to help with
your financial
situation
Debt
Management
Company
Insolvency
Practitioner
Credit
reference
agencies
Ireland & UK
Loan
management
system
Collections task
system
Internal Network
Drive
Data-warehouse
Yes
Financial
Ombudsman
(where
appropriate)
Financial
Conduct
Authority
(where
appropriate)
End of product
term + 6 years
and 6 months
List of other
creditors
including
reference
numbers
Motor Vehicle
details
Personal
information of
Partner/Family
members
Age of
dependent
Total Liabilities
Asset
information
including
values
Estimated
Deficiencies
Credit reference
agency/credit file
payment history
Customer
circumstances
Medical
Professional
Medical
professional
information
including Name
and address.
Medical History
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
MARKETING MESSAGES (WHERE YOU HAVE OPTED IN) (applies to 118 118 Money and 118M8)
Type of data
Why do we
need this
information?
Source of
data
Where stored?
Shared
externally?
Retained for?
Name
For sending
You
Ireland & UK
Yes
personalized
Customer
Until you opt out
of receiving
Address
marketing
Relationship
marketing
including
messages
Management
messages
postcode
based on the
System
preferences
Mobile number
you have
stated and your
Email address
interest in our
products and
services.
EU
ZeroBounce email
verification
Braze – email
system
Email addresses
are verified by
ZeroBounce to
ensure that we are
sending to live
email accounts.
ZeroBounce retain
checked email
addresses for
maximum of 30
days.
You are able to manage your marketing preferences by logging into your online account, via the
118 118 Money mobile app or by calling our Customer Services team.
Marketing consent will demonstrate the ability to customise marketing by feature and channel.
The default setting for marketing is opt-out by all methods.
The above may be shared with selected third parties in circumstances where you have provided
permission for this.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
DATA PROTECTION STATEMENT
CREDIT CARD CUSTOMERS – 118 118 MONEY
WHEN APPLYING FOR A CREDIT CARD ON OUR WEB SITE OR VIA A MOBILE APP
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
with another company?
Retained
for?
Name
(including Title,
First name and
Surname)
Identification during
application process
ID verification if you call
us
Checking for duplicate
applications (potential
fraud)
You
Ireland & UK
Internal
credit card
customer
databases
Data-
warehouse
Email system
EU
ZeroBounce
email
verification
Yes
TransUnion
Experian
Equifax
(credit reference and
scoring)
ZeroBounce – email
address verified by
ZeroBounce to ensure that
we have captured live
email account details.
TSYS – shares with Twilio for
SMS potential fraud
notifications. Twilio are
based in the USA.
See
application
decision for
retention
periods
ZeroBounce
retain
checked
email
addresses
for a
maximum
of 30 days.
Email address
Contact during
application process
Mobile number
Checking for duplicate
applications (potential
fraud)
SMS notifications for
card blocked for
potential fraud
Date of birth
Identification during
application process
ID verification if you call
us
Checking for duplicate
applications (potential
fraud)
Net monthly
income
Affordability checks
during application
process
Monthly
outgoings
Affordability checks
during application
process
Address
including
postcode
Identification during
application process
ID verification if you call
us
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Time at address
Identification during
application process
continued from previous page
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
with another company?
Retained
for?
Residential
Identification during
You
Ireland & UK
Yes
See
application
decision for
retention
periods
Status
application process
Internal
TransUnion
credit card
Experian
Equifax
customer
(credit reference and
Databases
Data-
warehouse
scoring)
6 years, 6
months
from the
termination
of your
credit card
agreement
with us, if
application
is successful
Bank Details
(including
account holder,
sort code and
account number)
During application as part
of identification process
You
Ireland & UK
Internal credit
card customer
databases
data-
warehouse
Yes
TransUnion, for their
CallValidate service to
verify identification
Balance Transfer (BT) product
Primary account
number (PAN)
Expiry date
Ownership check, to
establish that the
originating card belongs to
you.
For making the transfer from
your old card to your new
118 118 Money card.
You
Ireland & UK
Internal credit
card customer
databases
data-
warehouse
(masked to
protect the
card data)
Yes
Transmitted to TransUnion
to verify cardholder
identity matches you.
6 months in all
cases, to
ensure data is
available
within an
appropriate
time for you to
contact us
about your
transfer.
To help with checking your affordability of our product(s), we may also ask the number of
dependants you have, your marital status, any additional household income, other credit
commitments and essential expenses.
All of the above personal data types may also be used for ensuring that your application is not
fraudulent and will also be provided to our third-party PEPs and Sanctions partner, Factiva Limited,
via their Compliance Assist software to ensure that we are legally permitted to lend to you.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
REPORTING OF POTENTIALLY FRAUDULENT CREDIT CARD APPLICATIONS
Type of data
Why do we
need this
information?
Source of data
Where stored?
Shared
externally?
Retained for?
Personal
To CIFAS for
Third Party
Third Party
Yes
6 years from
information
reporting
TSYS (Credit
TSYS (Credit
CIFAS
date uploaded
provided by
potential
card
card
you during the
fraudulent
management)
management)
loan application
activity
process
Credit card
application date
CREDIT CARD APPLICATION IS DECLINED/NOT TAKEN UP/WITHDRAWN
Where we have declined your application, we may provide you with alternative options through our
partners; by proceeding you will be asked to accept the partner’s data processing agreement.
Analytics and Scoring Procedures
118 118 Money may retain your personal data if you are declined as a credit card customer or
decide not to proceed with your credit card application, for the purpose of improving the
scorecards for our financial services products.
The legitimate interest requirement is to enable us to further refine our scoring based on the
information submitted as part of the application process. This applies to both declined and
approved customers. This information may be passed to relevant third parties (such as Credit
Reference Agencies) to assist us in building better models for credit scoring in the future.
This information is retained for declined applications for 60 months, after which it will be anonymised.
CREDIT CARD APPLICATION IS APPROVED
Type of data
Why do we need this
information?
Source of
data
Where
stored?
Shared
with another
company?
Retained for?
Name
(including Title,
First name and
Surname)
ID verification if you
call us
You
Third Party – UK
TSYS
(credit card
management)
Ireland & UK
118 118 Money
database
records
Data-
warehouse
Email system
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
Paragon Group
(management
of outgoing
mail and
statements)
6 years, 6
months from
the termination
of your
credit card
agreement
with us
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Email address
Yes
TSYS (credit
card
management)
Mobile number
Date of birth
Address
including
postcode
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
Paragon Group
(management
of outgoing
mail and
statements)
continued on next page
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
continued from previous page
Type of data
Why do we need this
information?
Source of
data
Where
stored?
Shared
with another
company?
Retained for?
Name (as
shown on credit
card)
To print plastic card
showing your name
To answer your
questions through
customer services,
fraud investigations
or collections team.
To send you regular
service-related
mail and monthly
statements
You
Third Party – UK
TSYS
(credit card
management)
Ireland & UK
118 118 Money
database
records
Data-
warehouse
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
6 years, 6
months from
the termination
of your
credit card
agreement
with us
Primary
Account
Number (PAN
– 16-digit credit
card number)
To refer to your
account along with
your name, address
and other personal
data
Printing on your
credit card
Used as a reference
in reporting within 118
118 Money
Third Party
TSYS (Credit
card
management)
Originating
from
Mastercard
Third Party – UK
TSYS
(credit card
management)
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
Paragon Group
(management
of outgoing
mail and
statements)
6 years, 6
months from
the termination
of your
credit card
agreement
with us
Bank details
(Including Bank
Account Number,
Sort Code
And Account
Holder name for
Direct Debit)
Debit card details
For taking regular
payments via direct
debit or the backup
debit card.
You
Yes
TSYS (credit
card
management)
Credit Card
details
(including card
number, expiry
date and
balance to
transfer)
For the purpose of
transferring a
balance from
another card
provider to your 118
118 Money Credit
Card.
We may also use this
information plus your
name to verify that
the credit card is
yours.
You
Third Party – UK
TSYS
(credit card
management)
6 years, 6
months from
the termination
of your
credit card
agreement with
us
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
IF YOU ARE IN ARREARS, WE MAY RECEIVE THIS INFORMATION FROM A THIRD PARTY
Type of data
Why do we
need this
information?
Source of data
Where stored?
Shared
externally?
Retained for?
Financial
Statement
Assessment of
ability to repay
your debt
Analysing your
payment
behaviour with
118 118 Money
and other
creditors to assess
whether we are
able to help with
your financial
situation
Debt
Management
Company
Insolvency
Practitioner
Credit reference
agencies
Ireland & UK
Loan
management
system
Collections task
system
Internal
Network Drive
Data-
warehouse
Yes
Financial
Ombudsman
(where
appropriate)
Financial
Conduct
Authority
(where
appropriate)
End of product
term + 6 years
and 6 months
List of other
creditors
including
reference
numbers
Motor Vehicle
details
Personal
information of
Partner/Family
members
Age of
dependent
Total Liabilities
Asset
information
including
values
Estimated
Deficiencies
Credit reference
agency/credit file
payment history
Customer
circumstances
Medical
professional
information
including
name and
address
Medical
Professional
Medical History
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
MARKETING MESSAGES (WHERE YOU HAVE OPTED IN)
Type of data
Why do we need this
information?
Source
of data
Where stored?
Shared
externally?
Retained for?
Name
For sending
personalized marketing
messages based on the
preferences you have
stated and your interest
in our products
You
Ireland & UK
Customer
Relationship
Management system
EU
ZeroBounce email
verification
Braze email system
Yes
Email
addresses
are verified
by
ZeroBounce
to ensure
that we are
sending to
live email
accounts.
Until you opt
out of receiving
marketing
messages
ZeroBounce
retain checked
email addresses
for maximum of
30 days.
Address
including
postcode
Mobile number
Email address
You are able to manage your marketing preferences by logging into your user portal, via the
mobile app or by calling our Customer Services team.
The default setting for marketing is opt-out by all methods.
The above may be shared with selected third parties in circumstances where you have provided
permission for this.
The notifications you receive via our 118 118 Money and/or 118M8 mobile applications are
controlled by you in the Notifications setting of your mobile device.
IF YOU CHOOSE TO ADD AN ADDITIONAL CARDHOLDER AT ANY TIME
Type of data
Why do we
need this
information?
Source of data
Where stored?
Shared
with another
company?
Retained for?
Name of
additional
cardholder (as
shown on credit
card)
To print plastic
card showing
their name
Identification
when you
contact us
You
Third Party
TSYS (credit
card
management)
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
Paragon,
name for
statements
6 years, 6
months from
the termination
of the main
account
holder’s
credit card
agreement
with us
Name
(including Title,
First name
and Surname)
of additional
cardholder
To register
details
You
(We assume
that you have
permission from
the additional
cardholder
Yes
TSYS (credit
card
management)
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Date of birth
of additional
cardholder
To ensure that
the additional
cardholder is
over the age
of 18
to use their
personal
information)
continued from previous page
Type of data
Why do we
need this
information?
Source of data
Where stored?
Shared
with another
company?
Retained for?
Address of
additional
cardholder
(including
postcode)
Requirement
is that the
additional
cardholder
lives at the
same address
as the main
cardholder
You
(We assume
that you have
permission from
the additional
cardholder
to use their
personal
information)
Third Party
TSYS (credit
card
management)
Yes
TSYS (credit
card
management)
6 years, 6
months from
the termination
of the main
account
holder’s
credit card
agreement
with us
Mobile number
of additional
cardholder
For providing
service
messages
relating to the
additional
cardholder
Identification
when you
contact us
Relationship
to main
cardholder
Terms and
conditions
require
additional
cardholder
to be a family
member
Primary
Account
Number (PAN
– 16-digit credit
card number)
To refer to
your account
along with your
name, address
and other
personal data
Printing on your
credit card
Used as a
reference in
reporting within
118 118 Money
Third Party
TSYS (Credit
card
management)
Originating
from
Mastercard
Yes
TSYS (credit
card
management)
Idemia
(printing of
plastics, card
mailers, PIN
mailers)
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
DATA PROTECTION STATEMENT
118M8 users
HOW WE COLLECT AND USE YOUR PERSONAL INFORMATION
The 118M8 mobile application will allow you to have an overview of your spending habits and provides
you with support and access to financial fitness products from 118 118 Money or other third parties that
we may introduce you to upon request.
When you use our Financial Fitness App, we may need to collect certain personal information that you
provide to us, either directly or through your 118 118 Money online account where applicable.
From March 2026, you are able to use the 118M8 mobile application as a Guest without providing any
personal data or you can choose to pay for a subscription service which will provide additional budgeting
features.
If you register for an account, or connect your 118 118 Money account with 118M8, then limited personal
data will be collected. This Privacy Policy will be updated regularly as the 118M8 application features
evolve.
This personal information may include:
• Name
• Email address
• Mobile phone number
• Date of birth
• Postal address
• Residential status
• Your 118 118 Money account details
If you are a 118 118 Money credit card customer, we will make your transactional history available for
categorisation and analysis in the 118M8 app.
Transaction categorisation
To help you understand your spending and provide meaningful insights in the 118M8 app, we use a
specialist third-party provider, Snowdrop Solutions, to categorise credit card transactions.
We send Snowdrop limited transaction information, such as the transaction amount, date and merchant
description. We do not share cardholder names, card numbers, account details or contact information.
In some cases, the merchant description may include the name of a sole trader or small business owner,
which may constitute personal data under data protection law. Snowdrop processes this information
solely to return a spending category and does not use it for any other purpose.
We rely on our legitimate interests as the lawful basis for this processing, as it is necessary to provide
customers with clear, useful spending insights and does not override the rights or interests of
individuals. Appropriate contractual, security and data minimisation safeguards are in place.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
We have set out our reasons for using your personal information in the table below under the
heading Legal Basis.
Purpose
Legal Basis
To assist in the ongoing administration of your 118M8 products
and services, in accordance with our terms and conditions which
if entered into, will be a contract between us, we will use
information we receive from you for the following purposes.
• General account handling and service-based
communications, such as those required by regulatory
obligations;
• Analyse your spending activities and provide summaries
of your spending habits and “nudges” for what might
improve your overall financial fitness;
• Tell you about important changes or developments to the
features and operation of your products and services;
Transaction categorisation and enrichment providers
(such as Snowdrop Solutions).
Legitimate interests: we require
your personal information to
enable us to process your
information and provide you with
our financial assessment services.
Performance of a contract: we
have with you for the use of our
118M8 mobile application.
Based on your instructions, we may use your personal
information to tell you about certain products, offers or services
from 118 118 Money or our third-party affiliates.
This may include promotional offers, cash back offers, lending
offers or other financial fitness opportunities which we consider
are relevant to you.
Where you have consented to receive marketing messages,
these marketing messages will be sent to you by SMS, email or
through Braze Inc.'s secure messaging platform, depending on
your chosen preferences.
Consent: we will obtain your
explicit consent to use your
personal information for these
marketing purposes.
If you no longer wish to receive any
marketing communications from
us or selected third parties, you
may opt-out by [Contacting us] as
set out at the end of this Privacy
Policy.
Where you request further information about a financial product
that is offered by a third party or wish to apply for a financial
product that is offered by a third party, via our 118M8 mobile
application, we may need to disclose your personal information
with that third party.
Please note that where you wish to apply for a financial product
offered by a third party through the 118M8 mobile application,
that product offering will be governed by the terms and
conditions of that third party and 118 118 Money will not be
responsible for such third-party product.
Performance of a contract: we
have with you for the use of our
118M8 mobile application.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
To comply with legal and regulatory obligations, as well as
legitimate interests, for example fraud prevention, we will:
• Administer, update, consolidate, improve and manage
the accuracy of our records and our business including
but not limited to meeting legal, regulatory and
compliance requirements and operating rules (such as
anti-money laundering, regulatory reporting requirements
and record maintenance).
• Monitor and analyse the use of any account to detect,
prevent, investigate, prosecute and/or report fraud,
terrorism, misrepresentation, security incidents or crime.
We will also use information we receive from fraud prevention
agencies.
Necessary for compliance with a
legal obligation to which we are
subject.
When you download the 118M8 mobile application, we may
collect information about your use of it including, where
available:
• your IP address, IP address location (city and country)
and Internet Service Provider (ISP);
• operating system and browser type and version;
• the type of device(s) you use
• your email address
• your mobile phone number
We use this information for system administration and product
development.
Performance of a contract we
have with you and our legitimate
interests: to enable you to receive
our products and services in
certain formats.
When you login to your online account or access your account
via our mobile application, we will use the mobile phone number
you have provided to send you a one-time passcode to act as an
additional verification during the login process.
Use for secure authentication of
your login details to protect you
from fraud.
Where you have, or subsequently are approved for, a 118 118
Money Credit Card, the transactions of payments and
expenditure on that card will also be shown in your 118M8
mobile application to help you understand your credit position.
We rely on our legitimate
interests as the lawful basis for
this processing — to help you
manage your credit more
effectively and responsibly.
If you are a 118 118 Money customer, we will recognise you from
the personal data you provide in 118M8 and connect your
accounts, providing you with a single login across 118 118 Money
Performance of a contract and
legitimate interests (to enable
you to access and manage your
118 118 Money services securely
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
services.
If you are not yet a 118 118 Money customer, we will use the
personal data you provide in 118M8 to create and connect
accounts in both 118 118 Money and 118M8, giving you one
secure login for accessing the services we deliver through both
platforms.
Because these form part of the same 118 118 Money service,
accounts cannot be unlinked, but you may close your account or
request deletion.
and efficiently).
To register, create, and maintain
your account and the services we
provide via the 118 118 Money
website, app, and the 118M8 app.
To enhance your experience in our 118M8 and 118 118 Money
proposition
We use data about how you use our apps and services —
together with any connected information or accounts — to
understand what features are most useful, to tailor your in-app
experience, and to provide timely and relevant offers that may
benefit you.
This may include profiling based on your behaviour in the app (for
example, how often you log in, what tools you use, or how you
interact with insights) and on data connected to your account
(for example, transaction insights or budgeting trends). We do
this to help ensure the content you see is meaningful, useful and
aligned to your financial needs.
Where our personalised recommendations amount to direct
marketing, we will only send these in compliance with PECR and
your marketing preferences. You can control these preferences
at any time and will be provided an opt-out at each message.
Legitimate interests: We rely on
our legitimate interest to improve
and personalise how our services
work, and to offer products or
features that are relevant to your
financial situation. We assess
these interests carefully to ensure
they do not override your rights and
freedoms, and you can object to
this type of processing at any time
within the app or by contacting us.
To provide and manage access to optional subscription-
based features within the 118M8 mobile application, we will
process limited personal information to facilitate your
subscription.
If you choose to subscribe to enhanced features, your payment
will be processed by Apple App Store or Google Play Store (as
applicable), and we will use a third-party service provider,
RevenueCat, to manage subscription status and entitlements.
Performance of a contract: this
processing is necessary to provide
you with the subscription services
you have chosen to purchase and
to deliver the associated features
within the 118M8 mobile
application.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
We will only share a unique user identifier with RevenueCat for
the purpose of linking your subscription purchase to your 118M8
account. RevenueCat does not process your payment card
details, and all billing is handled directly by the relevant app
store provider.
This processing enables us to activate, maintain, and manage
your access to subscription features, including verifying your
subscription status, handling renewals, and providing associated
in-app functionality.
Analytics, Modelling and Product Development (118M8)
We may retain and use personal data collected through your use of the 118M8 mobile application for the
purposes of analytics, modelling, and the development and improvement of our financial products and
services.
This includes personal data you provide directly, data generated through your use of the app, and data
obtained from third parties such as Credit Reference Agencies and Open Banking providers (where you
have given your consent).
We use this information to better understand customer behaviour, enhance the functionality of the
118M8 app, improve our financial fitness tools, refine credit risk and affordability models, and support
the development and offering of lending and other financial products that may be relevant to you.
Where you have subscribed to additional 118M8 features, this processing may continue even if you
cancel your subscription or close your account, to the extent permitted by applicable law.
We rely on our legitimate interests to carry out this processing, namely to improve our products and
services, enhance customer outcomes, and support responsible lending. We assess these interests
carefully to ensure they do not override your rights and freedoms.
Your personal data used for these purposes will be retained in identifiable form for no longer than the
maximum term of our loan products, and in any event no more than 60 months, after which it will be
anonymised so that it can no longer be linked back to you. Once anonymised, the data may be retained
for longer periods for statistical analysis, modelling, and product development.
You have the right to object to us using your personal data for these purposes, or to ask us to delete it in
certain situations. If you contact us, we will review your request and stop using or delete your data where
we can. In some cases, we may need to continue using or keep your data if we have a valid reason, such
as a legal requirement.
If you would like to make a request, please contact our Data Protection Officer at
dpo@118118money.com, and we will be happy to help.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Changes to this Privacy Policy
If our Privacy Policy changes in any way, we will place an updated version on this page. Regularly
reviewing this page ensures that you are always aware of what information we collect, how we
use it and under what circumstances, if any, we will share it with other parties.
Where appropriate we will give you reasonable notice of any changes.
This Privacy Policy was last updated in June 2026.
Changes table
Version number
Publication month/year
v43
Jun 2026 (current version)
Changes made
Updates relating to complaints process as required under the Data Use and Access Act (2025).
Version number
Publication month/year
v42
Mar 2026
Changes made
Privacy policy updated to include reporting requirements to FCA. Use of Taktile from March
2026 for assisting 118 118 Money in credit decisions. Processing of personal data for analytical
purposes updated to provide support for the maximum loan term of 60 months. Confirmed
data controller for social media platform, TikTok. Addition of open banking services via D•One
to provide categorisation and spend analysis. Addition of RevenueCat personal data
processing in relation to 118M8 paid-for subscriptions. Notification of decisioning migration
affecting soft credit searches.
v41
Jan 2026
Changes made
Privacy Policy updated to explain new ways we use data, including using recent Open Banking
information to offer additional lending and partnerships with social media platforms for online
marketing, where consent is given. We’ve also added details about new systems and third-
party partners used for fraud prevention, text message alerts, transaction analysis, and
approved software tools.
Version number
Publication month/year
v40
Nov 2025
Changes made
Processing changes in support of launch of 118M8 app and any data tracking we may employ.
Enforcement of the Data Use and Access Act 2025 regulation supporting GDPR/DPA/PECR.
Version number
Publication month/year
V39
May 2025
Changes made
Clause additions, introduced use of Court Correct in the generative AI section.
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
Your Data Rights (under UK GDPR, the Data Protection Act 2018 and the Data Use and
Access Act 2025)
You have certain rights regarding your personal information. These rights apply in specific
circumstances and may be subject to lawful exemptions.
Full details of the information we hold about you and your relationship with 118 118 Money are set out
in the Customer Data Protection Statement sections — please select whether you are a 118 118
Money (loan or credit card) customer or a 118M8 mobile app customer.
1. Be informed
This privacy statement explains why, how and where we process your personal data, who we may
share it with and how long we keep it.
In line with the Data Use and Access Act 2025 (DUAA), we also explain where your data may be
made available through accredited data access arrangements or intermediaries, and how you can
exercise control over such sharing.
2. Access your data
You have the right to request a copy of the personal data we hold about you. To access your data,
please email your subject access request to dpo@118118money.com.
Under DUAA, you may also ask us to make certain financial data securely available to another
provider or accredited third party, where applicable. Please include “DUAA request” in the subject
line for these requests.
3. Correct or update your data
If you believe the information we hold about you is inaccurate or incomplete, please contact our
Customer Services team.
4. Delete your data (right to erasure)
You may request deletion of your personal data by contacting dpo@118118money.com . Please tell
us which data you want deleted and why.
5. Restrict processing
You may ask us to restrict processing of your data (so we store it but do not actively use it). Please
contact the Data Protection Officer using the email address above.
6. Data portability and DUAA data access
You have the right to request that we transfer your personal data to another organisation. Under
DUAA, this can include certain derived or observed data (for example, credit performance or
transaction history) in a secure, structured format.
7. Object to processing
You can object to our processing of your data — for example, for direct marketing or profiling
purposes. To object, please contact Customer Services on 02920 548118 or raise your concerns via the
ICO at https://ico.org.uk/concerns/handling/.
8. Automated decision-making and profiling
We use automated decision-making when assessing eligibility for our products. You have the right to
understand the key factors that led to an automated decision and to request human review.
9. Contacting the Data Protection Officer (DPO)
Email: dpo@118118money.com
Post: The Data Protection Officer, 118 118 Money, 5th Floor, 1 Capital Quarter, Tyndall Street, Cardiff,
CF10 4BZ.
We aim to respond to all rights requests within one month. If you’re dissatisfied with our response, you
may contact the Information Commissioner’s Office (ICO).
118 118 MONEY PRIVACY POLICY AND DATA COLLECTION STATEMENT
v43-Madison-JUN-2026
10. Raising a complaint
If you need to raise a complaint which relates to how we have handled your personal data, you have
the right to raise your concerns with the Information Commissioner’s Office (ICO), who are the UK
regulator for data protection.
They’ll usually ask if you’ve tried to resolve the matter with us first, so please let them know about any
steps you’ve already taken. If you do want to raise a complaint with the ICO, please note they
recommend that you do so within three months of your last meaningful contact or a final response
from us.
You can find out how to do this here: www.ico.org.uk/make-a-complaint or call them on 0303 123
1113 or write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF.