1
Privacy Notice of Elevate Credit Union Limited
Elevate Credit Union Contact Details
Address Elevate Credit Union Limited
West Douglas, Douglas Cork, T12 W950.
Phone 021 4894555
Email info@elevatecu.ie
Data Protection Officer Contact Details
Name Mr. Sean O’Sullivan
Phone 021 4894555
Email dataprotection@elevatecu.ie
Elevate Credit Union is committed to protecting the privacy and security of your personal data.
This privacy notice describes how we collect and use personal data about you during and after your relationship with us.
This Privacy Notice is to provide you with information regarding the processing of information about you for account related
purposes and other general purposes. If you apply for a loan with us, you will be provided with our Lending Privacy Notice to
take account of further processing that may be necessary.
Purpose of Data Collection, Processing or Use
A credit union is a member-owned financial cooperative, democratically controlled by its members, and operated for the
purpose of promoting thrift, providing credit at competitive rates, and providing other financial services to its members.
Data collection, processing and use are conducted solely for the purpose of carrying out the above-mentioned objectives.
What personal data do we use?
We may collect, store, and use the following categories of personal data about you:
• Your name, address, date of birth, email, telephone financial data, status and history, transaction data; contract data, details of
the credit union products you hold with us, signatures, identification documents, salary, occupation, accommodation status,
mortgage details, previous addresses, spouse, partners, nominations, Tax Identification/PPSN numbers, passport details,
interactions with credit union staff and officers on the premises, by phone, or email, current or past complaints, CCTV footage,
telephone voice recordings, [online identifiers (i.e. cookies)
• In carrying out mortgage lending we may collect further information financial history, credit history, accommodation
statue, mortgage details, previous addresses, previous names, spouse ,partners, relationship with joint borrowers, business
ownerships, directorships held, interactions with credit union staff and officers on the premises, by phone ,email, current or
past complaints, CCTV footage, telephone voice recordings, retirement age, first time buyer, pension details residency,
nationality, criminal sanctions.
•We need all the categories of information in the list above to allow us to identify you, contact you, and comply with our legal
obligations and in order that we perform our contract with you.
2
The purposes for which we use your personal data:
The credit union will use your personal data to assist it in carrying out the following:
•To open and maintain an account for you.
•To meet our obligations under the Credit Union’s Standard Rules.
•To contact you in respect of your account and any product or service you avail of.
•To comply with our legal obligation for example anti-money laundering obligations.
• In assessing your loan application and determining your creditworthiness for a loan.
• Verifying the information provided by you in the application.
•To purchase loan protection and life savings protection from ECCU.
•Conducting credit searches and making submissions to the Central Credit Register.
• Administering the loan, including where necessary, to take steps to recover the loan or enforce any security in the form of
collateral taken as part of the loan.
•We may use credit scoring techniques [and other automated decision-making systems] to either partially or fully assess your
application.
•To comply with Central Bank Regulations to determine whether you are a connected borrower or related party borrower.
• Providing updates on our loan products and services by way of directly marketing to you.
•When acting as an insurance intermediary, to meet our obligations.
We may also collect, retain, and use the following “special categories” of more sensitive personal data:
Information about your health, including any medical condition, health, and sickness, whether you have been referred to a
specialist or consultant, nature of illness and treatment, name, and address of present GP for the purpose of Insurance cover.
We need all the categories of information in the list above to allow us to; identify you and contact you and in order that we
perform our contract with you. We also need your personal identification data to enable us to comply with legal obligations.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your
personal data.
How we use particularly sensitive personal data
” Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further
justification for collecting, storing, and using this type of personal data. We may process special categories of personal data in
the following circumstances:
• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations and in line with our data protection policy.
• Where it is needed in the public interest, and in line with our data protection policy.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to
protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already
made the information public.
How secure is my information with third-party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal data in line
with our policies. We do not allow our third-party service providers to use your personal data for their own purposes unless
they are deemed to be controllers, we only permit them to process your personal data for specified purposes and in accordance
with our instructions. Usually, information will be anonymised, but this may not always be possible.
The recipient of the information will also be bound by confidentiality obligations.
3
If you fail to provide personal data
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered with
you, or we may be prevented from complying with our legal obligations.
Change of purpose
You can be assured that we will only use your data for the purpose it was provided and in ways compatible with that stated
purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis
which allows us to do so.
Profiling
We sometimes use systems to make decisions based on personal data we have (or are allowed to collect from others) about
you. This information is used for loan -assessment, profiling anti-money laundering purposes and compliance with our legal
duties in that regard.
Data Retention Periods
We will only retain your personal data for as long as necessary to fulfil the purpose(s) for which it was obtained, considering
any legal/contractual obligation to keep it. Where possible we record how long we will keep your data, where that is not
possible, we will explain the criteria for the retention period. This information is documented in our Retention Policy. Once
the retention period has expired, the respective data will be permanently deleted. Please see our retention periods below.
• Accounting records required to be kept further to the Credit Union Act, 1997 (as amended) must be retained for not less than
six years from the date to which it relates.
•The money laundering provisions of anti-money laundering legislation require that certain documents must be retained for a
period of five years after the relationship with the member has ended.
•We keep income tax records for a period of six years after completion of the transactions to which they relate.
•Loan application information is retained for a period of six years from the date of discharge, final repayment, transfer of the
loan.
• CCTV footage which is used in the normal course of business (i.e., for security purposes) for one month.
•Telephone recordings is retained for one month.
•Credit agreements are contracts and as such the credit union retains them for six years from date of expiration or breach, and
twelve years where the document is under seal.
•Loan applications form part of your credit agreement and as such we retain them for six years.
Planned data transmission to third countries
There are no plans for a data transmission to third countries
Updates to this notice
We will make changes to this notice from time to time, particularly when we change how we use your information, and change
our technology and products. You can always find an up-to-date version of this notice on our website at www.douglascu.ie or
you can ask us for a copy.
Our use and sharing of your information
We will collect and use relevant information about you, your transactions, your use of our products and services, and your
relationships with us. We will typically collect and use this information for the following purposes:
4
Fulfilling Contract This basis is appropriate where the processing is necessary for us to
manage your accounts and credit union services to you
Administrative Purposes: We will use the information provided by you, either contained in this form or any other form or
application, for the purpose of assessing this application, processing applications you make and to maintain and administer any accounts
you have with the credit union.
Third parties: We may appoint external third parties to undertake operational functions on our behalf. We will ensure that any
information passed to third parties conducting operational functions on our behalf will be done with respect for the security of your
data and will be protected in line with data protection law.
Guarantors: As part of your loan conditions, we may make the requirement for the appointment of a guarantor a condition of your
loan agreement in order that credit union ensures the repayment of your loan. Should your account go into arrears, we may need to call
upon the guarantor to repay the debt in which case we will give them details of the outstanding indebtedness. If your circumstances
change it may be necessary to contact the guarantor.
Irish League of Credit Unions (ILCU) Affiliation: The ILCU (a trade and representative body for credit unions in Ireland
and Northern Ireland) provides professional and business support services such as marketing and public affairs representation,
monitoring, financial, compliance, risk, learning and development, and insurance services to affiliated credit unions. As this credit
union is affiliated to the ILCU, the credit union must also operate in line with the ILCU Standard Rules (which members of the credit
union are bound to the credit union by) and the League Rules (which the credit union is bound to the ILCU by). We may disclose
information in your application or in respect of any account or transaction of yours from the date of your original membership to
authorised officers or employees of the ILCU for the purpose of the ILCU providing these services to us.
The ILCU Savings Protection Scheme (SPS): We may disclose information in any application from you or in respect of
any account or transaction of yours from the date of your original membership to authorised officers or employees of the ILCU for the
purpose of the ILCU providing these services and fulfilling requirements under our affiliation to the ILCU, and the SPS.
The Privacy Notice of ILCU can be found at www.creditunion.ie
[For the processing of electronic payments services on your account (such as credit transfers, standing orders and direct debits), the
Credit Union is a participant of CUSOP (Payments) DAC (“CUSOP”). CUSOP is a credit union owned, independent, not-for-profit
company that provides an electronic payments service platform for the credit union movement in Ireland. CUSOP is an outsourced
model engaging third party companies, such as a Partner Bank, to assist with the processing of payment data.]
Electronic Payments not through CUSOP: If you use our electronic payment services to transfer money into or out of your
credit union account or make payments though your debit card into your credit union account, we are required to share your data with
our electronic payment service provider.
Insurance: As part of our affiliation with the ILCU, we purchase insurance from ECCU Assurance DAC (ECCU), a life insurance
company, wholly owned by the ILCU. This includes Life Savings (LS), Loan Protection (LP), and optional related riders
(Where applicable).
If you choose to take out a loan with us, it is a term of your membership, by virtue of our affiliation with the ILCU that the credit union
will apply to ECCU for Loan Protection (LP). In order that we apply for LP it may be necessary to process ‘special category’ data,
which includes information about your health. This information will be shared with ECCU to allow it deal with insurance underwriting,
administration and claims on our behalf.
Credit Assessment: When assessing your application for a loan, the credit union will take several factors into account
and will utilise personal data provided from:
your application form or as part of your loan supporting documentation, your existing credit union file, credit referencing agencies such
as the Central Credit Registrar
The credit union then utilises this information to assess your loan application in line with the applicable legislation and the credit unions
lending policy.
5
Member Service: We may use information about your account to help us improve our services to you.
Debit Card: If we issue you a debit card, Transact Payments Limited (which is an authorised e-money institution) will also be a
controller of your personal data. For you to understand what they do with your personal data, and how to exercise your
rights in respect of their processing of your personal data, you should review their privacy policy which is available at
https://www.currentaccount.ie/TPLprivacypolicy
Legal Duty This basis is appropriate when we are processing personal data to comply with an
Irish or EU Law.
Tax liability: We may share information and documentation with domestic and foreign tax authorities to establish your liability to tax
in any jurisdiction. Where a member is tax resident in another jurisdiction the credit union has certain reporting obligations to Revenue
under the Common Reporting Standard. Revenue will then exchange this information with the jurisdiction of tax residence of the
member. We shall not be responsible to you or any third party for any loss incurred because of us taking such actions.
Under the “Return of Payments (Banks, Building Societies, Credit Unions and Savings Banks) Regulations 2008” credit unions are
obliged to report details to the Revenue in respect of dividend or interest payments to members, which include PPSN where held.
Regulatory and statutory requirements: To meet our duties to the Regulator, the Central Bank of Ireland, we may allow authorised
people to see our records (which may include information about you) for reporting, compliance, and auditing purposes. For the same
reason, we will also hold the information about you when you are no longer a member. We may also share personal data with certain
statutory bodies such as the Department of Finance, the Department of Social Protection and the Financial Services and Pensions
Ombudsman Bureau of Ireland, the appropriate Supervisory Authority if required under law.
Purpose of the loan: We are obliged to ensure that the purpose of the loan falls into one of our categories of lending.
Compliance with our anti-money laundering and combating terrorist financing obligations: The information provided by you will
be used for compliance with our customer due diligence and screening obligations under anti-money laundering and combating
terrorist financing obligations under The Money Laundering provisions of the Criminal Justice (Money Laundering and Terrorist
Financing) Act 2010, as amended by Part 2 of the Criminal Justice Act 2013 (“the Act”) (and any subsequent AML legislation)
Audit: To meet our legislative and regulatory duties to maintain audited financial accounts, we appoint an external and internal auditor.
We will allow the internal and external auditor to see our records (which may include information about you) for these purposes.
Nominations: The Credit Union Act 1997 (as amended) allows members to nominate a person(s) to receive a certain amount from their
account on their death, subject to a statutory maximum. Where a member wishes to make a nomination, the credit union must record
personal data of nominees in this event.
Incapacity to Act on your account: The Credit Union Act 1997 (as amended) provides, in the circumstances where you become
unable to transact on your account, due to a mental incapability and no person has been legally appointed to administer your account,
that the Board may allow payment to another who it deems proper to receive it, where it is just and expedient to do so, in order
that the money be applied in your best interests. To facilitate this, medical evidence of your incapacity will be required which will
include data about your mental health. This information will be treated in the strictest confidentiality.
Credit Reporting: Where a loan is applied for in the sum of €2,000 or more, the credit union is obliged to make an enquiry of the
Central Credit Register (CCR) in respect of the borrower. Where a loan is granted in the sum of €500 or more, the credit union is
obliged to report both personal details and credit details of the borrower and guarantor to the CCR.
House Loan: Where you obtain a house loan from us, it will be necessary for the credit union to obtain a first legal charge on the
Property to be purchased and it will be necessary for us to process your personal data to register the charge or have the
charge registered on our behalf.
Connected/Related Party Borrowers: We are obliged further to Central Bank Regulations to identify where borrowers are connected
to establish whether borrowers pose a single risk. We are also obliged to establish whether a borrower is a related party when lending
to them, i.e., whether they are on the Board/Management Team or a member of the Board/ Management team’s family or a business in
which a member of the Board /Management Team has a significant shareholding.
6
Legitimate interests a legitimate interest is when we have a business or commercial reason to
use your information. But even then, it must not unfairly go against what is right and best for you.
If we rely on our legitimate interest, we will tell you what that is.
Credit Assessment and Credit Reference Agencies:
When assessing your application for a loan, as well as the information referred to above in credit assessment, the credit union also
utilises credit data from credit referencing agencies such as the Central Credit Registrar. Our legitimate interest: The credit union, for its
own benefit and therefore the benefit of its members, must lend responsibly and will use your credit scoring information to determine
your suitability for the loan applied for. When using the service of a credit referencing agency, we will pass them your personal details
and details of your credit performance.
Debt Collection: Where you breach the loan
agreement, we may use the service of a debt
collection agency, solicitors or other third parties to
recover the debt. We will pass them details of the loan
application in order that they contact you and details
of the indebtedness in order that they recover the
outstanding sums.
Our legitimate interest: The credit union, where appropriate
will necessarily take steps to recover a debt to protect the assets and
equity of the credit union.
CCTV: We have CCTV footage installed on the
premises with clearly marked signage. The purpose of
this is for security, public safety and the prevention
and detection of fraud.
Our legitimate interest: About the nature of our business, it is
necessary to secure the premises, property herein and any staff
/volunteers/members or visitors to the credit union and to prevent and
detect fraud.
Voice Recording: We record phone conversations
both incoming and outgoing for the purpose of
verifying information and quality of service.
Our Legitimate interest: To ensure a good quality of service,
to assist in training, to ensure that correct instructions were given or
taken due to the nature of our business and to quickly and accurately
resolves any disputes.
7
Your consent:
We will only carry out the below processing when we have obtained your consent and
will cease processing once you withdraw such consent.
Marketing and Market Research
To help us improve and measure the quality of our products and services we undertake market research from time to time.
This may include using the Irish League of Credit Unions and/ specialist market research companies.
Art Competition
This credit union is involved with the Art competition in liaison with the ILCU. Upon entry you will be given further information and
asked for your consent to the processing of personal data. Your information is processed only where you have given consent. Where
the person providing consent is below 16* then we ask that the parent/legal guardian provide the appropriate consent. A separate
privacy notice is included in all Art Competition entry forms.
Schools Quiz
This credit union is involved in the Schools Quiz in liaison with the ILCU. The School’s Quiz is open to entrants aged 4 to 13. Upon
entry parent/legal guardians will be given further information and asked for their consent to the processing of their child’s personal
data. This information is processed only where consent has been given. Where the person providing consent is below 16* then we
ask that the parent/legal guardian provide the appropriate consent. A separate privacy notice is included in all School Quiz entry
forms.
Cookies when you visit our website, we may collect information from you automatically through cookies.
Our cookie banner clearly shows how our website gives you an option to accept or refuse cookies.
You may also control these cookies from your browser settings using the reject all cookies.
Our privacy policy only applies to our website, so if you click on a link to another website, you should read their privacy policy.
For further information on managing cookies please refer to our Cookie Policy.
Your Marketing Preferences
As part of improving our service to you, from time to time, we would like to inform you of goods, services, competitions and/or
promotional offers available from us. We may wish to use different means when sending such marketing communications.
You have a right to notify us free of charge at any time that you wish to refuse such marketing by writing to us at our address
at the top of this document or by using the "opt-out" options in any marketing message we send you.
Please contact us directly should you wish to change or withdraw your consent.
8
Your Rights in connection with your personal data are to:
To find out whether we hold any of your personal data and if we do to request access to
that data that to be furnished a copy of that data. You are also entitled to request further
information about the processing.
Request correction of the personal data that we hold about you. This enables you to have
any incomplete or inaccurate information we hold about you rectified.
Request erasure of your personal information. This enables you to ask us to delete or
remove personal data where there is no good reason for us continuing to process it. You
also have the right to ask us to delete or remove your personal data where you have
exercised your right to object to processing (see below).
Object to processing of your personal data where we are relying on a legitimate interest
(or those of a third party) and there is something about your situation which makes you
want to object to processing on this ground. You also have the right to object where we are
processing your personal data for direct marketing purposes.
Request the restriction of processing of your personal information. You can ask us to
suspend processing personal data about you, in certain circumstances.
Where we are processing your data based solely on your consent you have a right to
withdraw that consent at any time and free of charge.
Request that we: a) provide you with a copy of any relevant personal data in a reusable
format; or b) request that we transfer your relevant personal data to another
controller where it’s technically feasible to do so. ‘Relevant personal data is personal data
that: You have provided to us, or which is generated by your use of our service. Which is
processed by automated means and where the basis that we process it is on your consent or
on a contract that you have entered with us.
You have a right to complain to the Data Protection Commissioner (DPC) in respect of any processing of your data by:
Telephone +353 57 8684800 +353 (0)761 104 800
Lo Call Number 1890 252 231
E-mail info@dataprotection.ie
Postal Address: Data Protection Commissioner
Canal House Station Road
Port Arlington R32 AP23 Co. Laois
Please note that the above rights are not always absolute and there may be some limitations.
If you want access and/ or copies of any of your personal data or if you want to review, verify, correct, or request erasure of your
personal information, object to the processing of your personal data, or request that we send you or a third party a copy your
relevant personal data in a reusable format please contact our Data Protection Officer in writing using their contact details above.
There is no fee in using any of your above rights unless your request for access is clearly unfounded or excessive.
We also reserve the right to refuse to comply with the request in such circumstances.
We may need to verify your identity if we have reasonable doubts as to who you are. This is another appropriate security
measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Ensuring our information is up to date and accurateWe want the service provided by us to meet your expectations at
all times. Please help us by telling us straightaway if there are any changes to your personal information.
If you wish to avail of either of these rights, please contact us using our contact details at the top of this document.