Here at Aire Labs Ltd, your privacy is important to us. When handling and using your personal information we are subject to the General Data Protection Regulation (“GDPR”). The GDPR regulates the processing of personal data relating to you and grants you various rights in respect of your personal data. This policy applies to personal information collected by Aire.
This Privacy Notice explains how Aire uses your information when you use our web application product (“Web Application”) for the purposes of providing a credit reference (“Credit Reference”) referred to us by a lending partner (“Partner”), and how you can limit our use of that personal data. If you do not provide your personal information to us, we will be unable to provide services to you.
What information do we collect about you?
We have set out in the table below the categories of personal data we collect from you and for which we are the data controller:
|Categories of personal data||Description of category|
|Contact details||This is the personal data that is provided by you or collected by us to enable you to use our service. This includes your email address, contact number and best times to contact you.|
|Financial information||This includes details like your income, types of financial products you hold including any financial products in arrears and outstanding terms (contract)|
|Employment||This includes your job title, employer, employment history and length of time at your employer.|
|Education||This includes details of your qualifications and highest level of education attained.|
|Personal circumstances||This includes personal information relating to your financial dependents, household bills and future plans.|
|Financial behavior||This is the personal data that is provided by you describing your attitude to financial situations and how you would handle them.|
|Details of your use of our Web Application||This is information collected by us about your use of our service. This could include information about your computer, device, and browser, potentially including your IP address.
Cookies and other tracking technologies may be used.
|Technical data||This is information that is provided to us by our third party data providers.
This may include your IP address, the type of browser you use and operating system you use.
|Publicly available records||This is information that is available from public data sources or from other sources where you have agreed for your information to be shared with third parties e.g. electoral register.|
|Any special category data that you share||On occasions we may ask you to provide special category data. We will only do this with your explicit consent. We will only process this type of information if it is relevant to the understanding of your circumstances.
This type of information is more sensitive and may include details about your health, criminal records and offences. Full details on Special Category Data can be found on the ICO website.
We might also share it with our Partner to ensure you are being treated fairly and according to your needs. Please note that this special category data is not used in generating your Credit Reference.
We have set out in the table below the categories of personal data that Aire receives and for which we are the data processor:
|Categories of personal data||Description of category|
|Contact details||Information provided to us by the Partner for the purpose of providing a Credit Reference. This may include your name, address, contact number.|
|Account data||Information that includes details about the product, payments and outstanding balance including account status that we get from our Partners.|
How we use your personal information
The table below describes the purpose of collecting your data and the categories of data collected.
|Purpose / activity||Categories of personal data|
|Helping us better understand your financial circumstances and behaviour so we can create a Credit Reference which will be shared with your financial services provider to review and support your application.||
|Helping our partner’s to better understand your personal circumstances.||
|Using your data in order to improve the provision of our service.||
|To help improve our products and services.||
|To detect and prevent financial crime, including fraud.||
|Staff training purposes.||
|To manage complaints and support in dispute resolution.||
Automated decision is a decision made by automated means without any human involvement. Aire does not make automated decisions in relation to the processing of your data. Some of the information that we provide to Partners may be used by them in automated decision making processes.
Lawful basis for processing your information
We will only use your personal data when the law allows us to. We must have a legal basis for processing your information. We will use your personal data in the following circumstances as listed in the table below.
|Lawful basis for processing||Purpose|
|Legal and regulatory obligations||
Sharing your personal information
We will only share your personal data where necessary and with those persons who need to handle it for the purposes described above. These may include technology partners, regulatory authorities (inc fraud prevention authorities) and you and your financial service provider.
Where is your information stored and security
Your information is stored in the European Economic Area (EEA), but may be transferred outside of the EEA, and processed by staff and organisations outside of the EEA in order to provide our services. Countries outside of the EEA may not provide the same level of legal protection when it comes to your personal information.
Any transfers outside of the EEA will be conducted in accordance with GDPR, including the use of processors based in the United States who are participant in the EU-US Privacy Shield programme: https://www.privacyshield.gov/welcome. By submitting your data to us, you agree to this handling. We will base any sharing of data outside of the EEA on the following:
- the transfer is necessary for our performance of a contract
- the transfer will be based on the standard data protection clauses for transfer of personal data to countries outside of the EU/EEA adopted by the European Commission Note some non EEA countries are recognised by the European Commission as providing an adequate level of data protection to EEA standards. The full list of these countries is available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en
- the EU-U.S. Privacy Shield, where the transfer is made to the United States and the recipient is duly certified
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.
They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We will store all the personal information you provide on securely protected servers.
How long will data be retained for
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Data will be retained for no longer than six years following the end of our relationship with you. However, there may be instances where we are asked to retain information for longer due to legal or regulatory reporting requirements.
In some circumstances you can ask us to stop processing your data. See below for more information.
Your rights and access to your information
Under GDPR you have certain rights over the personal information that we hold about you. Where we are processing personal information with your consent, you can withdraw this consent at any time by contacting our data protection officer at [email protected].
The rights available to you depend on our lawful basis for processing your information. Your rights include the right to access information we hold about you, the right to correct your information (if it is inaccurate or incomplete) and in some circumstances you have the right to restrict or stop the processing of your personal information. You also have the right to ask us not to process where we are relying on a legitimate interest.
There are some circumstances in which you can request the deletion of your information and these include:
- when the personal data is no longer necessary for the purpose for which it was originally collected or processed
- if we are relying on your consent as a lawful basis for holding the data, and you have withdrawn your consent
- we are relying on legitimate interests as our basis for processing and you object to the processing of your data, and there is no overriding legitimate interest to continue this processing
- we are processing the personal data for direct marketing purposes and you object to that processing
- we have processed the personal data unlawfully i.e. without lawful basis
You have the right to have the data we hold about you transferred to another organisation and reuse your personal data for your own purposes across different services. We will transfer this information in a commonly used format. This right only applies to the following circumstances:
- to personal data you have provided us
- where the processing is based on your consent or for the performance of a contract
- when processing is carried out by automated means
You can find further information on your data protection rights from the Information Commissioner’s Office (ICO) using the following link: Individual Rights.
If you would like to request to exercise any of your rights or if you have any queries related to accessing your personal information, correction, or your rights under GDPR including requiring a copy of the information we hold on you, we will provide this free of charge and within one month. Please contact our Data Protection Officer if you wish to exercise any of your rights by:
Email: [email protected]
Data Protection Officer
Aire Labs Ltd.
First Floor, 11a Curtain Road
If you are not satisfied with our response to your query, you can contact your local data protection authority who will be able to advise you on next steps. For the United Kingdom, this is the Information Commissioner’s Office (ICO), who is also our supervisory authority. Details of their contact information can be found at https://ico.org.uk/global/contact-us/.
The third party applications we use are:
- Google Analytics: How Google uses data when you use the Web Application: https://google.com/policies/privacy/partners/
- Mixpanel: To opt out of Mixpanel cookies across all websites visit: https://mixpanel.com/optout
If you don’t want us to track and monitor your interaction with the Web Application using such Cookies you can switch them off by adjusting your browser settings. Most web browsers allow you to do this via your browser’s settings.
Changes to our policy
Aire is a trading name of Aire Labs Ltd.
Aire Labs Ltd. is a company registered in England and Wales (Company Number 08844341). Registered address: 1st Floor, 11A Curtain Road, London, England EC2A 3LT
ICO registration number: ZA046116
Last updated 2018-08-16