Abound Privacy Notice

We will only collect information which is needed in order to provide you with our service about Abound products. This will include information that is used to assess whether our products are affordable for you, to assess our risk in lending to you and to manage your account during the life of your loan. By submitting your personal information to us, you are confirming that the information you are giving is correct and relates to you.

When we seek information from you, it is your choice whether to give it to us. If you choose not to provide some or all of it, your choice may affect our ability to provide you with our products or services.

The personal data we collect will include some or all of the following categories but will extend to any data relating to you that we process as a result of your interactions with Abound:

1. Personal Information - your name, date of birth, current and previous addresses, phone numbers, and email address
2. Application information - information about your requested loan (e.g. amount requested, monthly repayments, loan purpose) employment, income, residential status, housing costs
3. Fraud prevention information - see section 14 below on fraud prevention and detection.
4. Bank account information - as part of the process for applying for a loan, and subject to your consent, your bank(s) will provide us with information about your bank account(s) via a process called Open Banking. Open Banking is described in more detail below. This information will include the name of the bank, the name of the bank account holder, your bank account number, sort code, incomings and outgoings across your bank account(s). We will set up an arrangement to allow us to collect recurring repayments via a continuous payment authority or via Open Banking payments arrangement;  where we have set up continuous payment authority, we will hold partial details of the debit card used for this purpose:  we will hold first six and last four digits of the sixteen-digit card number and the expiry date of the card;  we do not see your full card number or the security number.
5. Credit risk data - information about you provided by credit reference agencies. See section on “Sharing your information” below.
6. Communication Information - your contact details and preferred method of contact (whether via letter, email, SMS or telephone),records of emails, telephone calls, letters, texts and webchat between you and Abound.
7. Transactional Information - a record of payments made to or received from Abound, details of loan management actions requested.
8. Website usage data - our website may use cookies to gather and store information about how you use our website including your internet protocol (IP) address, preferred settings, browser type, operating systems, time of when you visit our website, which page you visits and the actions you take on each page. Please refer to our Cookie notice for further details on what cookies are and how we use them.
9. User profile - This includes the profile you create to identify yourself when you connect to the Abound platform. It also includes other data about how you use those services. We gather this data from devices you use to connect to those services.
10. Contractual Information - details about the services and products we may arrange or set up for you
11. Documentary Data - details held in documents that are provided to us as part of any application or throughout your relationship with Abound.
12. Sensitive or special information - This includes data such as health data, biometric data and criminal records data. See the sections on "Special category data" and "Criminal Offences data" below
13. Identification documents - national identifier, a unique number provided by a government body (e.g. a passport number or driving licence number); images of identification documents requested to verify your identity as required by law (e.g. images of driving licence, passport, Biometric Residence Permit)
14. Social Media Information - comments made on Facebook, Twitter and discussion forums in connection with our products and services. We may wish to use this information, for example to share a Facebook comment, but we will only do so with your permission
15. Operational information - details about the complaints you made to us, your log ins, subject access requests and any correction requests
16. Consents - details of any permissions about data usage that you provide us with, this may relate passing details onto third parties or special data due to medical concerns.

The General Data Protection Regulation states that we are only allowed to process your personal information if we have a genuine reason to do so and have a lawful basis for the processing. This includes providing it to third parties outside of Abound.

Abound may use your personal data for one or more reasons including, but not limited to, as set out in the following table.

5.1 Special Category Data

Special category data is personal data that needs more protection because it is sensitive. There are several sorts of special category defined by the GDPR: the types most likely to be used by Abound are: data concerning health and biometric data used for identification purposes such as images of your face.

We may use special category data for these purposes:

• Identity verification through the use of biometric data
• Ensuring that our services are accessible to you (e.g. if you need extra help because of a disability)

We will process special category data only where you have provided us with your explicit consent to do so or if one of the limited reasons for processing applies.

5.2 Criminal Offence Data

Criminal offence data includes information about criminal convictions and offences.

We will use criminal offence data for these purposes:

• Preventing or detecting unlawful acts

We will normally seek your consent to process criminal offence data.

6.1  Who do we share your information with?

We will keep your information confidential, but we may share it in certain circumstances, where we have a lawful basis to do so, for the purposes set out in this notice with one or more entities or individuals in the following groups:

1. Credit reference agencies
2. Account Information Service Providers·
3. Identity and ID verification services
4. Electronic signature service providers
5. Communication service providers (for mail, email, telephony, live chat)
6. Banks, payment service providers and electronic money institutions (to initiate payments using the payment details you have provided)
7. Partner firms who have introduced you to Abound with a view to providing finance for a specific purpose.  The information we share is to enable you to benefit from the credit provided and to manage your account.
8. Fraud prevention agencies, including CIFAS
9. Services to identify PEP and sanctions matches and adverse media information
10. IT infrastructure and service providers
11. Customer reconnection service providers
12. Firms to whom we may sell your debts
13. Debt collection agencies (to service or recover debts)
14. Law firms (to enforce debts where appropriate and to advise on specific cases)
15. IVA and DMP companies and other firms that manage IVA and DMP administration
16. Anyone we may transfer our rights to
17. Regulatory and law enforcement bodies
18. Audit and assurance firms (for the purposes of external compliance and audit)
19. Our lenders who provide funding for Abound

6.2 Credit Reference Agencies

We'll supply your personal data to credit reference agencies (CRAs) so that they can provide us with supplementary information for the following purposes:

• Verify the accuracy of the information you have provided us
• For use in our affordability and credit risk assessments
• Prevent criminal activity, fraud and money laundering
• Trace and recover debts
• Manage your accounts
• Ensure any offers provided to you are appropriate to your circumstances

CRAs will supply to us both public (including electoral register) and credit, financial situation and financial history information and fraud prevention information about you and also any person that you share financial ties with (a joint current account or a joint mortgage, for example): this person is known as a 'financial associate'.

We use the data to carry out fraud prevention checks and a preliminary credit check which is also known as 'soft credit search' to establish whether you are, or have recently been declared bankrupt, and whether you are currently in a debt management plan or individual voluntary arrangement. The CRAs will record our search but other lenders won't be able to see it and it won't affect your credit score.

However if you decide to formally apply for an Abound loan after carefully reviewing all of our loan documents, including the Pre-Contract Credit Information, Pre-Contractual Adequate Explanations and our Fixed Sum Loan Agreement and Terms and Conditions, we will at time of application, carry out a "Hard Credit Search", which means that when CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

We'll go on sharing your personal data with CRAs for as long as you are a customer. We will also inform CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. They may also provide this information to other organisations including financial institutions who offer similar products to Abound.

We do not provide joint loans, but if you tell us you have a financial associate (see above), we'll link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging your application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files a request with the CRAs to break that link.

As a general rule, we'll give you at least 28 days' notice if we decide to file a default on your credit reference file. However, we may not always give you notice beforehand, for example, if we plan to take court action.

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found in Section 14 of this Privacy Notice or by emailing contact@getabound.com and putting "Request for further details about Fraud Prevention Agencies" in the subject.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal data, data retention periods and your data protection rights with the CRAs are explained in the Credit Reference Agency Information Notice (CRAIN), which is available from each of the three CRAs-clicking on any of these three links will take you to the CRAIN document:

Equifax

Experian

Transunion

6.3 Identity and ID verification services

We may share your information with third parties for the purposes of verifying your identity or authenticating ID documents.  The third party may request additional information from you.  Where the information being provided to the third party includes special category data, such as biometric data, we will seek your consent before proceeding.

This Website may place and access certain Cookies on your computer. Abound uses Cookies to improve your experience of using the Website and to improve our range of products and services. We have carefully chosen these Cookies and taken steps to ensure that your privacy is protected and respected at all times.

All Cookies used by the Abound website are used in accordance with current UK and EU Cookie Law.

Before the Website places Cookies on your computer, you will be presented with a message bar requesting your consent to set those Cookies. By giving your consent to the placing of Cookies, you are enabling Abound to provide a better experience and service to you. You may, if you wish, deny consent to the placing of Cookies; however certain features of the Website may not function fully or as intended.

This Website may place the following Cookies:

Type of cookies

Purpose

Description of cookie

We use this cookie to enable us to show you adverts while you are browsing our website and other websites on the internet.

Analytical / Performance cookies

They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

We use this cookie to help us analyse how users use the website.

Functionality cookies

These are used to recognize you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

We use this cookie to identify your computer and analyse traffic patterns on our website.

These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

Strictly necessary cookies

These are cookies that are required for the operation of our website.

Targeting cookies

We use this session cookie to remember you and maintain your session whilst you are using our website.

‍

Our websites may contain links to websites which are owned or controlled by parties other than Abound. These links are provided for your convenience and do not imply that we have reviewed or condone the third-party sites, their content or their privacy policies.

When using other websites, you must be aware that any personal information you supply will be dealt with in line with their privacy policies. This Privacy Notice only applies to our website so when you click through to other websites you should read their own privacy policies and terms and conditions before giving them any of your personal information.

Our website and the Abound platform may also automatically transfer you to a third-party site in order to fulfil the services we provide to you. In such cases, we will carry out due diligence to ensure third parties have the appropriate data protection requirements in place.

When you access linked third-party websites, you do so at your own risk. These sites may place their own cookies or other files on your computer, collect data or solicit personal information from you. We will not be held liable for any misuse of your information or other misconduct by the third party.

Abound is based in the UK, and this is where we operate our software platform. Your information will only be used in the UK and EEA.  Data may be stored in the UK by Abound, or in the UK or EEA by our third parties.

Open Banking is a secure way to give us access to your financial information. Implementation of Open Banking in the United Kingdom is overseen by the Open Banking Implementation Entity, set up by the Competition & Markets Authority to bring more competition and innovation to financial services which, in turn, will lead to improved products and customer journeys to help manage your finances.

When you apply for an Abound loan, we will use Open Banking technology for our creditworthiness assessments which will determine the amount of credit you can borrow and the terms of your loan. We ensure any offers provided to you are appropriate to your circumstances.

We use a tool provided by an authorised Account Information Service Provider (“AISP”) that allows you to share information on your bank accounts with us. In order to use our services, you will be asked to agree to the AISP’s Terms of Service for Open Banking connections, and you will be redirected to your bank by the AISP in order to authenticate yourself. The AISP’s Terms of Service set out the terms on which you agree to the AISP accessing information on your bank accounts for the purposes of transmitting that information to us. The AISP is subject to UK and EU data protection laws and is required to treat your data in accordance with those laws, as well as the AISP’s Terms of Service and Privacy Policy. All the AISPs that we partner with are authorised and regulated by the Financial Conduct Authority.

We will not retain your Internet Banking Credentials. We will only pass your Internet Banking Credentials onto your Bank using an encrypted and secure method of transmission.

In some instances, our use of your personal information may result in automated decisions being taken. By "automated decisions" we mean decisions made solely by automated means (for example, software algorithms) without any human review.

We use automated decisions to assess your suitability for our products(including their affordability), so that we can determine efficiently and accurately whether to offer you the products you apply for (and therefore whether we can enter into a contract with you) and so that we can perform our obligations under our contract as a responsible lender.

The personal information that we may use as part of any automated decisions includes the information that you (or third parties) provide to us, as described above.

When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision. You can exercise your right by emailing us at contact@getabound.com.

Under the Data Protection legislation, you have the following rights with regards to your personal information:

1. The right to access personal data and supplementary information
2. The right to have inaccurate personal data rectified, or completed if it is incomplete
3. The right to erasure (to be forgotten) in certain circumstances
4. The right to restrict processing in certain circumstances
5. The right to data portability, which allows you to obtain and reuse your personal data for your own purposes across different services
6. The right to object to processing in certain circumstances
7. Rights in relation to automated decision making and profiling
8. The right to withdraw consent at any time (where relevant)
9. The right to complain to the Information Commissioner

Please see the following website for more detail:

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

Unless a longer retention period is required or permitted by law, we will only hold your personal information on our systems for the period necessary to fulfil the purposes outlined in this privacy notice or until you request that the data be deleted.

As a regulated business we are often required to hold personal data for set periods of time. The criteria that we use to determine the period for which we retain personal information include:

• Legal and regulatory requirements and guidance
• Limitation periods that apply in respect of taking legal action
• Our ability to defend ourselves against legal claims and complaints
• Good practice
• The operational requirements of our business

These reasons vary from one piece of information to the next depending on the products and/or services you have signed up for, so the amount of time we keep your personal information for may vary.

• Most customer data will be held for up to 6 years after the end of the relationship
• Contact centre sales call recordings will be held for up to 6 years from the date of the recording
• All other contact centre call recordings will be held for up to 6 years from the date of the recording
• Marketing permissions will be kept and used for up to 6 years after the loan has been paid up or you last access your 'Login' account.

In all cases, our need to use your personal information will be reassessed on a regular basis, and information which is no longer required for any purposes will be disposed of or anonymised.

If you give us false or inaccurate information or if we suspect or identify fraud, we may record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention including law enforcement agencies.

We and other organisations may access and use this information to prevent fraud, money laundering or other criminal activity.

Fraud prevention agencies may hold your information for different periods of time, and if you are considered to be a fraud or money laundering risk, your information may be held for up to six years. It may also result in us and others refusing to provide services, financing or employment to you.

GENERAL

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

AUTOMATED DECISIONS OF FRAUD CHECKS

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact us using the details above.

CONSEQUENCES OF PROCESSING

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details above.

DATA TRANSFERS

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to 'international frameworks' intended to enable secure data sharing.

YOUR RIGHTS

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data; request that your personal data is erased or corrected; request access to your personal data.

For more information or to exercise your data protection rights, please contact us using the contact details above.

You also have a right to complain to the Information Commissioner's Office which regulates the processing of personal data.

We can update this Privacy Notice at any time and will keep it under regular review. This privacy notice was updated on 26 March 2025.