Wollit Privacy Policy

1. Overview

1.1 Wollit is the trading name of Wollit Ltd (Wollit/us/we). This Policy describes how Wollit and its affiliates acquire, use and manage your personal information in accordance with the Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR) with respect to information relating to you that you or third parties provide to Wollit, including information collected or provided via the Wollit App and the Wollit website http://wollit.com (the App and the Website).

1.2 Wollit is a data controller and is registered in the UK with the Information Commissioner’s Office under registration number ZA554988. By visiting and using our App and Website, you acknowledge and agree to the practices described in this Policy.

2. Personal information we may collect about you

2.1 We may collect personal information about you when you submit it via the App or the Website and throughout the course of our relationship with you. This information may be given via the App or Website or when you contact us directly, for example through our customer service department, either online, by SMS or by telephone (as our calls may be recorded for training and monitoring purposes).

2.2 Bank transaction data

2.2.1 In order to be eligible for a Wollit account, you must agree to give us access to see your current bank account (your Account) transactions in real time via an open banking facility operated by our partner, TrueLayer Limited (TrueLayer). Open Banking is the secure way to give us access to your Account transaction data; subject to your granting of permission to your bank it is obliged to enable you to share your Account transaction data with us.

You will be required to use TrueLayer and agree to their Terms of Service. The TrueLayer Terms of Service https://truelayer.com/tos/ set out the terms on which you agree to TrueLayer accessing information about your Account for the purposes of transmitting that information to us. TrueLayer operates in accordance with UK data protection laws and is required to treat your data in accordance with those laws, as well as the Terms of Service and TrueLayer’s privacy policy - https://truelayer.com/privacy/. TrueLayer is authorised by the UK Financial Conduct Authority under the Payment Services Regulations 2017 to provide account information services and payment initiation services (Firm Reference Number: 793171).

2.2.2 We will view (but do not have the ability to transact) your Account history in order to:

(a) confirm your income and outgoings;
(b) assess your creditworthiness;
(c) assess your ability to afford the repayments at the point of application and on an on going basis for the duration of the loan facility;
(d) make collection decisions;
(e) monitor your risk of financial hardship/vulnerability; and
(f) assess your ability to enter repayment plans.

2.2.2.1 By subscribing to the Wollit Credit Builder Service you acknowledge that information regarding your rental payments and track record as a tenant, will be shared with Experian Ltd. Experian will add this information to the credit reference data it holds about you and use it as a controller, in accordance with its fair processing notice (a copy of which can be found by following the link below), including so that it can be used to assist other landlords and organisations to:

assess and manage any new tenancy agreements you may enter into;
assess your financial standing to provide you with suitable products and services;
manage any accounts that you may already hold, for example reviewing suitable products or adjusting your product in light of your current circumstances;
contact you in relation to any accounts you may have and recovering debts that you may owe;
verifying your identity, age and address, to help other organisations make decisions about the services they offer;
help to prevent crime, fraud and money laundering;
screen marketing offers to make sure they are appropriate to your circumstances;
for Experian to undertake statistical analysis, analytics and profiling,
and for Experian to conduct system and product testing and database processing activities, such as data loading, data matching and data linkage.

If you would like to see more information on these, and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.experian.co.uk/crain.

2.2.3 Your Account transaction data is strictly confidential and will not be passed by us or TrueLayer to any third parties. In this Policy, where we refer to sharing your information with third parties, this does not include your Account details or Account transaction data.

2.3 Other personal data

2.3.1 In addition to your Account and transaction data identified above, we may collect and process your name, email address, home address, date of birth, employment information and other information such as demographic information when you complete forms, loan applications and/or surveys.

2.3.2 Each time you use the App or visit the Website we may automatically collect information such as:

(a) details of your usage, including what pages of the Website or App you have visited and whether you have clicked on images or links on those pages (this may be user specific or aggregate); and
(b) technical information (including the type of device you are using, your IP address, and type of web browser) and cookie information, unless you disable cookies on your device (see under 'Cookies' at section 9 below).

2.4 Information we receive from other sources

2.4.1 We may receive information about you from third parties, for example, your credit history from Credit Reference Agencies (CRAs) (see under section 4 below for more information).

2.4.2 We may also view any records about you which are in the public domain (for example electoral roll or social media accounts). We do not seek or knowingly collect any personal data about children under 18 years of age.

3. How we use your personal information

3.1 We use your information in various ways, such as:

verifying your identity to comply with anti-money laundering legislation;
for administrative purposes, for example to process payments via direct debit, otherwise make collections, trace you where necessary, update/maintain our records, prevent fraud and money laundering and enforce our loan terms and conditions;
to communicate with you by telephone, email, SMS, social media or post using the details you have provided in relation to your application/agreement with us or we have obtained from publicly-available sources;
to process your loan application and assess your creditworthiness;
checking your credit record to enable us to consider and underwrite your application to borrow;
to enhance your experience of our App and Website and of our services, for example by conducting statistical analysis or for editorial or feedback purposes for our introducer affiliates; and
to provide you with marketing communications from us (subject to the consents you provide to us which you can withdraw by opting out at any time).

4. Disclosure of your information

4.1 We may share your information with selected third parties including:

Service Providers: we contract with service providers to perform certain functions on our behalf. Examples include database providers who assist in identity verification and site analysis providers. Their access is limited only to the personal data needed to perform the functions carried out on our behalf as our agent, and only for the purpose of performing those functions; and
Credit Reference Agencies: if you make a loan application, we will perform credit and identity checks on you with one or more CRAs. Where you take out a credit agreement with banking services from us we may also make periodic searches at CRAs to manage your account with us. To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

4.2 We will use this information to:

assess your creditworthiness and whether you can afford to take the product;
verify the accuracy of the data you have provided to us;
prevent criminal activity, fraud and money laundering;
manage your credit account;
trace and recover debts; and
ensure any offers provided to you are appropriate to your circumstances.

4.3 We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs. When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link. More information about CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the CRA information notice (CRAIN) available at:

TransUnion: https://www.transunion.co.uk/legal/privacy-centre

Equifax: https://www.equifax.co.uk/crain/

Experian:https://www.experian.co.uk/legal/crain/

4.4 We may also disclose your personal information to third parties:

in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets;
to our professional advisers where required to advise us from time to time and always subject to a duty of confidentiality;
to other members of our group where required for management information and forecasting purposes; and
if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request, this includes exchanging information with other companies and organisations for the purposes of fraud prevention.

5. Processing your data

5.1 We process your data using automated and manual decision-making software. This software is used to underwrite your loan. Our automated decision-making systems include, but is not limited to, the following inputs:

5.1.1 Credit model algorithms

5.1.2 Affordability algorithms

5.1.3 Enrolment and employment verification

5.1.4 Anti-fraud and anti-money laundering databases

5.1.5 Other data sources that provide inputs that show your creditworthiness, affordability or fitness to receive credit

5.2 The use of automated decision-making software is a requirement to enter into a loan agreement with us. You have the right to request that we do a manual review of the results of any automated decision rendered.

5.3 We use your personal information for a variety of reasons, upon different legal bases including:

for the performance of our agreement with you or to take steps at your request prior to entering into an agreement with you. This is necessary for us to lend to you. If you do not provide such information we will be unable to provide you with a loan;
where necessary for our legitimate interests, for example in managing and monitoring our App and Website operation, preventing fraud and for our business compliance purposes; and
where necessary in order to comply with a legal obligation, for example making reports to our regulatory authority or to law enforcement agencies.

5.4 Where our use of your data is not necessary for one of the purposes outlined above we may seek your consent to use it in a particular way, for example if we ask you to complete a customer survey. Where we ask for your consent you are free to refuse our use of the data for those purposes and you may withdraw your consent at any time by contacting us using the details set out below.

5.4.1 Direct Marketing - when you provide your information to us for the purposes of obtaining a quote or making an application for credit we will advise you that we may contact you by telephone, SMS, email or by post to provide you with information about similar products and services that we may provide. We give you the opportunity to change your consent preferences for receiving such marketing communications when you provide your information to us and at any time afterwards in the following ways:

Via email: Click the “Unsubscribe” link in any email communication and submit your email address on the next screen or email us at

If you opt-out of our use of your information for marketing purposes, we will process your request as soon as possible. We may take steps to verify your identity with respect to any such request.

5.4.2 Cookies - we use cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you use our Website and also allows us to improve it. For detailed information on the cookies we use and the purposes for which we use them, see section 9 below 'Cookies'.

6. Keeping your information secure

6.1 We have measures in place to protect the security and confidentiality of your information and we strive to keep it accurate. We only keep your information for as long as is necessary. We generally keep records of any transactions that you enter into for a minimum of six years. Some of the security measures include:

we work to protect the security of your personal data during transmission by using Secure Sockets Layer (SSL) software, which encrypts personal data you input;
we store personal data securely; and
we transmit personal data in an encrypted format.

7. Data retention

7.1 We only keep your personal information for as long as is necessary to fulfil the purposes for which we use it. We will normally retain your personal data for 6 years after our last business interaction with you to comply with our regulatory requirements. We will delete all data after 6 years from our last business interaction with you unless we are subject to a legal requirement to retain it for longer.

8. Your rights

8.1 Your personal information is protected under data protection law and you have a number of rights (explained below) which you can seek to exercise. Please contact us using the details shown below if you wish to do so, or if you have any queries in relation to your rights. If you seek to exercise your rights, we will explain to you whether or not the right applies to you; these rights do not apply in all circumstances.

8.1.1 Right of access - subject to certain exceptions, you have the right of access to information that we hold about you upon request. You can exercise this right by making a request in writing, by email or telephone using the contact details in the contact section below.

8.1.2 Right to rectify your personal information - if you discover that the information we hold about you is inaccurate or incomplete, you have the right to have this information rectified (i.e. corrected).

8.1.3 Right to be forgotten - you may ask us to delete information we hold about you in certain circumstances, this is often referred to as the ‘right to be forgotten’. This right is not absolute and only applies in particular circumstances. It may not therefore be possible for us to delete the information we hold about you, for example, if we have an ongoing contractual relationship or are required to retain information to comply with our legal obligations or to exercise or defend legal claims.

8.1.4 Right to restriction of processing - in some cases you may have the right to have the processing of your personal information restricted. For example, where you contest the accuracy of your personal information, its use may be restricted until the accuracy is verified. You have the right to ask us not to use your information for marketing purposes. We will ask for your consent to use your information for these purposes when we collect it and you can exercise your right to prevent such processing by refusing this at the point of collection or subsequently changing your preferences. You can also exercise the right at any time by contacting us by post or email using the details in section 10 'Contact' below.

8.1.5 Right to object to processing - you may object to the processing of your personal information (including profiling) when it is based upon our legitimate interests. You may also object to the processing of your personal information for the purposes of direct marketing (including profiling to the extent it relates to direct marketing) and for the purposes of statistical analysis.

8.1.6 Right to data portability - you have the right to receive, move, copy or transfer your personal information to a controller which is also known as ‘data portability’. You have the right to this when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means. You should note that this right is different from the right of access (see above) and the types of information you can obtain under the two separate rights may be different.

9. Cookies

9.1 Cookies are small text files that are created and stored on your browser or the hard drive of your computer by websites that you visit. Cookies are often placed on your computer to enable websites to operate properly, to ‘remember’ who you are, and to monitor website traffic and usage. Cookies are generally only visible to the website that serves them and not to other websites.

9.2 Most internet browsers accept cookies automatically. However, you can accept, delete or disable cookies through your browser if you wish. To learn more about controlling the placement of cookies through your browser settings, please review the options available in your internet browser’s ‘Help’ menu.

9.3 To ensure that you have maximum control over how cookies are placed on your computer, we also operate a cookie banner which appears when you first visit our Website, but can also always be accessed through the dedicated link at the bottom of the homepage. This enables you to set your preferences with respect to certain cookies used in connection with the operation of the Website. For more detailed information about the specific types of cookies used, please read the section below.

9.4 Cookies are used on our Website for different reasons. Sometimes cookies are necessary for the operation of the site, for example to ensure its security, or to ‘remember’ your cookie preference information so that we can make sure those preferences apply to your next visit. Other cookies may serve a different purpose, for example to provide analysis of how the site is used and to improve functionality for users. Unless strictly necessary for the functioning of the site or for the transmission of communications, we will only place cookies where you have previously provided your consent. If you do not provide your consent then you can still access and use our Website, however certain functions or features may be disabled which could negatively affect your user experience.

9.5 Our Website uses the following types of cookie:

9.5.1 Policy read cookie: Cookie_policy_read: this cookie is used to track whether the user has visited the site before so the cookie notification panel does not appear automatically during future sessions.

9.5.2 Google analytics: _utma; _utmb;_utmc; _utmt; _utmz: these cookies are used to collect anonymous information about how visitors use our Website, including the number of visitors, where they came from and the pages they visited. We use this information to compile reports and to help us improve our Website. Click here for an overview of privacy at Google. Google Analytics’ terms require us to disclose that we use Google Analytics and how it collects and processes data. Please see the site “How Google uses data when you use our partners’ sites or apps” at www.google.com/policies/privacy/partners for more information.

9.5.3 SendGrid/Twilio: SendGrid/Twillo uses both session and persistent cookies to identify your device both during your session and after you have turned your computer off. Please see their cookie policy for more information: https://www.twilio.com/legal/privacy/cookies

10. Contact

10.1 If you have any questions about how we treat your personal data and protect your privacy or if you have any comments or wish to seek to exercise any of your rights as

10.2 outlined above, please contact the data protection officer:

by email to [email protected]
by post to Wollit Ltd, 8 Denmark Street, London, WC1H 8LS

11. Complaints

11.1 If you have a complaint, please contact us and we will investigate it and give reasonable redress if we consider it appropriate to do so. You also have the right to complain to your local data protection supervisory authority. If you are in the UK, this is the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113. www.ico.org.uk/ .

12. Conditions of use and changes to this policy

12.1 If you choose to use our App or visit our Website, your usage/visit and any dispute over privacy, is subject to this Policy. We may make changes to the Policy from time to time to reflect changes to our operations or legal or regulatory requirements; if we do so we will make a revised copy available via the App and the Website and notify you of this.