Data Privacy Notice

We are Pepper Finance Corporation (Ireland) DAC trading as Pepper Money and Pepper Asset Servicing  (“Pepper”, “us”, ”we”, “our”). We are a member of the Pepper group of companies.  

Our principal activity, when trading as Pepper Money, is the provision of commercial mortgage loans.  Our principal activity, when trading as Pepper Asset Servicing, is the management of Pepper loans or the provision  of loan portfolio management/credit servicing to various investment companies, along with third party servicing  activities. 

The purpose of this Data Privacy Notice is to explain how we, in our capacity as a data controller, collect and  use your personal information. Personal information means information relating to a living individual who can be  identified (either from that information itself or when combined with other information).  

We are a data controller in respect of the loans we own and a data processor in respect of our credit servicing  activities. In relation to the latter, we may also be a data controller for a period after we stop servicing your loan  where we retain personal information for the purposes of compliance with our regulatory obligations. Whether  as a data controller or a data processor, we are committed to complying with Data Protection Law at all times.  By “Data Protection Law” we mean the EU General Data Protection Regulation, the Data Protection Acts 1988 to  2018 and any other laws which govern the use of your personal data.

We collect and process your personal information for a variety of reasons and we rely on a number of legal  bases for doing so including: 

2.1 To enter into and for the performance of a contract 

We process your personal information where it is necessary to enter into a contract with you for the provision of  a product or service, to assess you for suitability for a product or service or to perform our obligations under a  contract with you. This includes: 

• Applications: We use personal information that you provide to us to process your application for a  product or service from us and to decide on the terms upon which we can enter into a contract with  you, for example, an application for a mortgage loan. 
• Ongoing Product/Service Management: In order to manage any product or service provided, we have  to process your personal information, for example, administration of a mortgage loan by processing  payments, writing to you about the status of your loan, assessing your loan for an alternative repayment  arrangement if you find yourself in financial difficulty and so on. As part of this management, we may be  required to pass some of your personal information to an intermediary or counterparty (e.g. to take a  payment by direct debit from your bank account we have to share your personal information with our  bank). 
• Continuing Performance: Where we may have acquired your loan from another lender, they will pass  relevant information to us to allow for the continued performance of your contract. 

2.2 To comply with legal obligations 

In certain circumstances, we must process your personal information to comply with legal obligations. These  include: 

• Assessing affordability and suitability for the provision of credit and throughout our relationship with  you including analysing your credit data for regulatory reporting. 
• Obtaining personal information from the Central Credit Register when considering credit or loan  applications to assess affordability and suitability for the provision of credit, and providing information  to the Central Credit Register about the performance of your loan agreement with us. 
• Verifying personal information provided to us to prevent money laundering, financing of terrorism, tax  avoidance, and/or fraud. For example, we may ask you for a proof of identity and/or a proof of address  as part of our ongoing verification requirements in respect of Anti-Money Laundering legislation. 
• Responding to queries raised by regulatory authorities, law enforcement and/or other government  agencies such as the Data Protection Commission, the Central Bank of Ireland, An Garda Siochana, and  the Revenue. 
• Providing information requested in the context of a regulatory investigation or inspection.
• Delivering mandatory communications as required by legislation or regulations. 
• Investigating and resolving complaints. 
• Managing contentious regulatory matters, investigation and litigation. 

2.3 Our legitimate business interests 

Your personal information will also be processed on the basis of our legitimate interests. Where it is processed  on this basis, we ensure that there is a fair balance between our legitimate interests and your privacy rights.  The following are some examples of when Pepper processes your personal information for legitimate business  interests. Your personal information may not be processed in all cases and if it is, it will always be subject to  measures to comply with Data Protection Law. 

• To enable us to manage our relationship with you including having readily available access to your  information through use of IT systems and functionality. 
• To monitor, maintain and improve internal business processes, information, technology and  communications that may benefit you or Pepper. 
• To ensure business continuity and disaster recovery and to respond to information technology and  business incidents and emergencies. 
• To ensure adequate network and information security and fraud prevention protections are in place. 
• To undertake system testing, for example, prior to implementing system improvements. 
• For internal analysis and reporting for the management of individual customer accounts and to make  strategic decisions for our business. 
• To establish, exercise and safeguard our rights which may include taking enforcement action against  customers or defending complaints or claims made about us. 
• To assess the quality of our customer services and to provide staff training. This includes monitoring and  testing of how we manage your loan(s) and our interactions with you.  
• To perform analysis on customer complaints for the purposes of preventing errors and process failures.
• To rectify negative impacts on customers as a result of process or regulatory failures (including those  of a previous lender). 
• To comply with regulatory rules, guidance and requests, or assist a previous lender in its compliance  with regulatory rules, guidance and requests. 
• To ensure we act as a prudent servicer of your account.  

2.4 Where you have provided consent 

In some cases we rely on your consent such as:  

• Marketing Consent: At the time of applying for your loan, or at any time thereafter, if you consented  to marketing, we might use your personal information to make you aware of other products or services  which we think could be of interest to you. In addition, depending on the preferences you selected at the  time of your application, we might disclose your personal information to third parties and our partners  whose products or services we consider could be of interest to you. All marketing communications will  include a clear opt-out facility if you wish to change your marketing contact preferences. 
• Sensitive Information Consent: Data Protection Law may require us to obtain consent to the processing  of special categories of personal information such as personal information that reveals racial or ethnic  origin, information about a person’s health, religious beliefs and other categories of ‘sensitive data’.  While we don’t collect sensitive data as a matter of course, you may choose to disclose health and  other sensitive information in limited circumstances, such as if you are experiencing a health issue  which is affecting your ability to repay a loan, which we will record on our systems.  
• Authorised third parties: At your request and with your written consent, we will liaise with a third party  nominated by you to act on your behalf. 
• Telephone Contact at Work: You may have consented to us contacting you at your workplace, where  it is not your residence.  

At any time you can withdraw your consent through the contact channels referenced in Section 12. 

2.5 Where you have provided us with information about another person 

Where you provide us with personal information relating to another person (e.g. a partner, spouse or guarantor)  we rely on you to ensure that you have their consent to providing us with their information for use in accordance  with this Data Privacy Notice.

We collect and process various categories of personal information at the start of and for the duration of your  relationship with us. We limit the collection and processing of personal information to such information as is  necessary for the purposes set out in Section 2 above.  

We collect information about you: 

• When you ask us to provide you with certain products and services including over the course of your  relationship with us.  
• When you use our website and online services provided by us and visit our offices.
• When you or others give us information verbally or in writing. This information may be on application  forms, in records of your transactions with us, within a standard financial statement (“SFS”) or if you  make a complaint.  
• From your online activities with third parties where you have given us your consent (for example, by  consenting to our use of certain cookies or other location tracking technologies). 
• When you act as an authorised third party in respect of a loan which we own or service.
• From clients or other parties who have engaged us to provide credit servicing. 
• From credit reference agencies, credit registration agencies, fraud prevention agencies or public agencies  such as property registration authorities, the Companies Registration Office or judgment registries. 

Personal information requested over the course of your relationship with us may include, but is not limited to,  the following: 

• Identity information: Name, date of birth, proof of identification (such as driving licence or passport).  Examples of how we use this information include: to identify you and to comply with our legal and  regulatory obligations.  
• Contact information: Address, telephone number, email address. Examples of how we use this  information include: to manage and administer your loan(s) with us, to send you information which you  request and to respond to your queries and complaints. 
• Personal circumstances: Employment status and details, financial circumstances including income  and expenditure, assets, borrowings, savings, lifestyle needs. Examples of how we use this information  include providing you with products such as a new loan or restructuring or rescheduling of a loan.  
• Interactions with Pepper staff: Whenever a staff member meets you or contacts you, a note of this  interaction is recorded on our loan management system. In addition, we sometimes record telephone  conversations to improve services, for training purposes, to resolve complaints and as required by  relevant regulations and Central Bank of Ireland Codes of Conduct. However, we will always let you  know when we are recording our calls with you. 
• Health information: With your consent, we sometimes process information on your health when you  are applying for a product or service or over the course of your relationship with us. You may choose  to share health information with us, for example, if you are in financial difficulties as a result of a health  issue you may provide us with this information in writing or by phone in which case it may be included  in a call recording.
• Other: We may also collect and process personal information made available by other parties,  for example credit reference agencies such as Central Credit Register or entities such as An Post.

You have a number of rights in relation to the personal information which Pepper holds about you. If you  choose to exercise any of these rights, we may ask you to verify your identity by providing us with additional  documentation such as an up to date proof of identity.  

• Timelines: We will consider your request and provide a response within 1 month of receipt of your  request and verification of your identity, where required, as set out in Section 3 above. This time period  may be extended in exceptional circumstances. In these cases we will advise you of this along with  confirming the reasons for the extension.  
• How to make a request: You can make your request using any of the channels set out in Section 12. 

4.1 Right of access to your personal information 

You have the right to get confirmation about whether we process any of your personal information and, if so,  how we use it. We use this Data Privacy Notice to meet this obligation. In addition, if we process your personal  information, you have a right to request a copy of the personal information that we process. If we have provided  a copy of this personal information within the previous 12 months, we will not provide the same copy to you  again but will provide any additional personal information we have obtained and processed since the last request.  

• Fees: Typically there is no fee for a copy of your personal information although we have the right  to apply a reasonable fee in exceptional circumstances if your request is manifestly unfounded or  excessive.  
• Format of response: You may request that the information is provided to you orally, in a hard copy  format or in electronic format. If you require the information in electronic format, you will need to  provide us with your email address. We will email the information to you encrypted with a password  and you will need to contact us by telephone to provide you with the password. It is important to be  aware that email is not a fully secure means of communication. 
• Exclusions: Some personal information is exempt from the right of access, such as personal information  that is not available from a reasonable and proportionate search, privileged information, confidential  expressions of opinion or where providing a copy would adversely affect the rights and freedoms of  others.  

4.2 Right to correct your personal information 

We try to ensure that the information we have about you is accurate and up to date. Sometimes we may ask you  to verify that the information we have is still accurate. If you believe certain personal information we hold about  you is incorrect, incomplete or out of date, you can contact us to correct the information.

• Restrict processing: While we are considering your query, you may request that we restrict processing  your personal information. 

4.3 Right to delete your personal information 

You may request deletion or erasure of your personal information in the following circumstances, provided there  are no legal obligations or overriding legitimate grounds that require us to keep it: 

• Where the personal information is no longer necessary for the purpose for which it was collected.
• Where you withdraw your consent (in the case of data held in reliance on your consent such as those  in 2.4 above). 
• Restrict processing: While we are considering your query, you may request that we restrict processing  your personal information. 

4.4 Right to withdraw your consent 

If you have provided us with your consent to process your personal information, for example in the circumstances  set out in 2.4 above, you have the right to withdraw that consent. Provided there is no other legitimate reason for  us to process that personal information we will stop processing that personal information.  

4.5 Right to request your information be transferred  

You can request that certain personal information which you have provided to us be transferred to you or to  another service provider. This applies to information that we are processing for the performance of your contract  or based on your consent. 

4.6 Right to object  

Where your personal information is being processed on the basis of our legitimate interests, we must ensure  that there is a fair balance between our legitimate interests and your rights. If you disagree with your personal  information being processed in this manner, you are entitled to object. 

To help us make decisions quickly and to improve our service to customers, we may use automated decision  making as part of our loan application process. This means that some parts of the decision making process are  fully automated with no human intervention. Currently we use automated decision making for our mortgage  loan ‘Approval-in-Principal’ (“AIP”) process based on information provided by you. In certain cases however,  the decision may be referred to an underwriter to review. This type of processing is necessary to assist us in  making a decision in relation to your application. You have the right to express your point of view and contest an  automated decision by contacting us through the channels in Section 12 below.

Sometimes we may want to make you aware of products and services which we think may be of interest to you  based on the product or service you have already received from us, and the personal information we hold about  you. 

If you have consented to direct marketing we may send you marketing communications. You may also have  consented to us sharing your personal information with carefully selected third parties and partners whose  products or services we think may be of interest to you. 

If you would like to withdraw your consent at any time, please refer to Section 2.4 above. 

We make every attempt to ensure your personal information is protected and secure. We do this by considering  data privacy when developing, designing, selecting and using new systems, products and processes that are used  to hold or process that personal information and by limiting access to your personal information.  We use a variety of technical and organisational security measures to protect your personal information. These include computer safeguards; ensuring files are stored securely and that our offices have adequate security. 

8.1 Staff and onsite suppliers 

Your personal information may be accessed by our staff including staff of other members of the Pepper group of  companies in order to perform their duties and some of our suppliers including contractors and IT support staff,  in connection with any of the purposes set out in Section 2 above. You will find details of our group companies  at www.peppergroup.ie/about-us. 

8.2 Third parties within the European Economic Area (“EEA”) 

In certain circumstances we may share your information with third parties who will act on our instruction in  relation to any processing of your personal information. For example: 

• We may share your information with insurers, solicitors, accountants, valuer, estate agents, advisers and  other consultants who act on our behalf or to obtain advice. 
• We may share your information with the original lender or a beneficial owner of your loan or other  parties with an interest in your loan. 
• We may use third parties such as print providers and document storage providers. 
• We use the services of a number of IT suppliers of systems and technology. 
• We may share your information with third parties to comply with our legal obligations. 

8.3 Third parties outside the EEA 

We may transfer your personal information to organisations (including other Pepper Group companies) in  countries outside of the EEA, but we will only do so where:

• The European Commission has decided that the country or organisation we are sharing your information  with will protect it adequately; 
• We have entered into a contract with the organisation with which we are sharing your information to  ensure it is adequately protected on terms approved by the European Commission; or  
• The transfer has been authorised by a relevant data protection authority. 

8.4 Central Credit Register (CCR), credit reference and fraud prevention agencies 

We may access and use your personal information from the CCR when you apply for a loan with us and  periodically thereafter: 

• To manage and take decisions about your accounts, including assessing your creditworthiness when  you are applying for a new product, and checks to avoid indebtedness.  
• If you apply to have your existing loan restructured. 
• If an amendment is required to the records held on the CCR.  
• For prevention of fraud, money laundering or criminal activity. 
• To trace debtors and recover debt. 

While you have a loan with us, we will continue to share your personal information, including information about  the performance of your loan, with the CCR. This will include the outstanding balance on your loan, the regularity  of repayments, number of overdue repayments, any arrears and the date of the next payment. This information  will be made available to other organisations, including financial services providers, so they can make decisions  about you (such as considering any application for credit and credit related services), to trace debtors, recover  debts, prevent or detect money laundering and fraud, and to manage your account. 

If you want further details of how your information will be used by the CCR, please visit their websites or contact  them directly at: 

CCR  

Website: www.centralcreditregister.ie 

Email: consumerinfo@centralcreditregister.ie 

Phone: +353 (0)1 224 5500

8.5 Loan acquisitions or transfer of rights 

Your personal information may be disclosed to prospective purchasers of loans and anyone else to whom we  may or purport to assign or transfer our rights under the loan in connection with a securitisation or other form  of funding arrangement. Whenever we disclose your personal information to prospective acquirers of your loan,  we will do so under strict conditions of confidentiality.

By providing you with a loan, we create records that contain your personal information. Records can be held on  a variety of media (physical or electronic) and formats.  

Your personal information is retained for different periods of time depending on the purposes for which they are  required to be retained. We hold your personal information while you are a customer and for a period of time  after that. If you have a loan with us, normally we keep customer account records for up to seven years after your  relationship with us ends. Other personal information may be kept for shorter periods. 

Sometimes we may have to keep your information for longer periods, for example where we need to retain  information or documents relating to actual or prospective legal proceedings, a court order or an investigation  by law enforcement agencies or our regulators.  

This Data Privacy Notice may be updated from time to time. You will always find the most up to date version on  our websites at www.peppermoney.ie or www.peppergroup.ie.

If you have any queries about your data protection rights, you can contact us in the following ways: By phone at the following number or in writing at the following address:  

For Pepper Money: 

Write to: Data Protection Officer, Pepper Money, 4th Floor Two Park Place, Upper Hatch Street, Dublin 2 Phone: 0818 866 666 

For Pepper Asset Servicing: 

Write to: Customer Services, Pepper Asset Servicing, PO Box 687, Shannon, Co. Clare Phone: +353 (0)61 705900 

If you wish to raise a query or make a complaint in relation to how we handle(d) your personal information, you  can write to our Data Protection Officer, at the following address.  

Data Protection Officer,  

Pepper Money & Pepper Asset Servicing,  

4th Floor Two Park Place,  

Upper Hatch Street, Dublin 2.  

In the event that you are not satisfied with our response to your query or complaint, you may be entitled to  complain to the Office of the Data Protection Commission: 

Write to: Office of the Data Protection Commission,  

 Canal House, Station Road, Portarlington, Co. Laois. 

Phone: +353 57 868 4800 

or LoCall: 1890 252231 

Email: info@dataprotection.ie 

Website: www.dataprotection.ie