Trans Atlantic Lifetime Mortgages Privacy Notice
1. Our Commitment to You
1.1 This privacy notice is provided by Trans Atlantic Lifetime Mortgages Limited (referred to throughout this policy as “TAMI”). TAMI is a wholly owned subsidiary of SuttonPark Capital LLC (“SuttonPark”). SuttonPark manages TAMI’s infrastructure, operations and service functions. It is expected that all or most of processing activities referred to in this notice will be undertaken by SuttonPark.
1.2 Where we use the terms “we”, “us” or “our” in this privacy notice we mean TAMI and/or SuttonPark as the relevant person who is processing your personal information. TAMI can confirm which processing activities are undertaken by which entity on request.
1.3 This privacy notice is addressed to certain customers of OneFamily Lifetime Mortgages Limited (referred to throughout this policy as “OneFamily”), where your mortgage forms part of a portfolio in relation to which TAMI provides funding to facilitate OneFamily’s offering of lifetime mortgage loans, the interest in which is subsequently sold to TAMI. OneFamily will continue to own the customer relationship with you. A copy of OneFamily’s privacy notice can be found at onefamily.com/privacy.
1.4 We are committed to safeguarding the privacy and confidentiality of the Personal Data you have entrusted to us. The purpose of this privacy notice is to allow you to understand what Personal Data that we will collect, how we will use it, and who may access it. It relates to our processing of (1) personal data within the European Economic Area (“EEA”) and (2) personal data relating to individuals located in the EEA.
1.5 By providing your information to us, you acknowledge the processing set out in this privacy notice. Further supplementary notices may also be provided to you from time to time, when we collect any additional Personal Data from you.
2. Personal Data that we collect
2.1 Where your OneFamily Lifetime Mortgage forms part of the portfolio funded by TAMI, we will collect the following personal data relating to you
(a) Information relating to your mortgage ► OneFamily will provide the following information relating to your mortgage within its portfolio reporting:
(i) loan identifiers including a primary account number allocated to you that allows us to identify your loan;
(ii) a description of your mortgage including the loan amount, the interest rate, the application date, the offer date, the proposed or actual completion date, any repayments of principal and interest, shortfalls, recoveries, outstanding principal amounts, interest and fees under your loan, any further advances, retentions or refunds you are entitled to under your loan, the final repayment date, the redemption date and the redemption reason; and
(iii) the region in which your property is located, the type and style of your property, and, if relevant, the address of your property and the purchase price of your property against which your loan is secured.
(b) Information about you ► OneFamily will provide the following information relating to you as a customer within its portfolio reporting:
(i) a borrower number which is a unique number that identifies you as OneFamily’s customer;
(ii) your age, date of birth and gender;
(iii) whether you hold your mortgage jointly and if so, whether that joint account holder is deceased;
(iv) any CCJs and IVAs that have been made known to OneFamily; and
(v) your reason for redeeming your mortgage.
(c) Information you provide to TAMI ► any Personal Data that you may provide to TAMI, including your name, email address, and other contact details. If you contact us, we will typically keep a record of that correspondence; and
(d) Website and communication usage ► in the event that you visit the website of SuttonPark, we will collect information using cookies and other tracking technologies including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data the resources that you access, information about your operating system, browser, software applications, IP address, geolocation, security status and other device information in order to improve your experience and manage risk.
3. Purposes for which we may use your Personal Data
3.1 When we collect your Personal Data, we may use or disclose it for the following purposes. Below each purpose we note the “lawful bases” that allows that use of your Personal Data. A description of each lawful bases is included below:
Consent: where you have consented to our use of your information. More information is set out at Section 4. You may withdraw your consent by contacting us (see the Contacting Us section below) or clicking through unsubscribe wording in the relevant correspondence.
Contract performance: where your information is necessary to enter into or perform TAMI’s contract with you.
Legal obligation: where we need to use your information to comply with our legal obligations.
Legitimate interests: where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.
Legal claims: where your information is necessary for us to defend, prosecute or make a claim against you, OneFamily or a third party.
(a) To identify individual loans and customers ► in order to make decisions about which loans to purchase from OneFamily and which loans to on-sell to TAMI’s funders subsequently, to validate purchase or sales (or otherwise demonstrate our interest in) specific loans and to understand the nature of our portfolio of loans that TAMI has purchased from OneFamily;
Lawful bases: legitimate interests (to effect purchase and sales of loans, to demonstrate our interest in loans, and to manage TAMI’s portfolio effectively)
(b) To raise finance ► TAMI will from time to time sell individual loans to warehousing entities, securitisation entities, debt collecting agencies, whole loan purchasers, other financers or external creditors. TAMI will also, as part of such raising of finance, use information about the portfolio (potentially including your personal data) to allow those external creditors to undertake their own due diligence in assessing the credit quality of the portfolio. We will use information about the loans (potentially including your personal data) to allow those external financers or rating agencies to undertake their own due diligence in assessing the credit quality of the portfolio. This will not affect your relationship with OneFamily, unless otherwise notified to you;
Lawful bases: legitimate interests (to raise finance and manage TAMI’s portfolio effectively)
(c) To manage non-payment ► TAMI will from time to time sell individual loans to debt collection specialists in the event that there has been a default in repayment;
Lawful bases: legitimate interests (to obtain payment of monies due to TAMI)
(d) To monitor investment performance ► we will monitor the performance of the portfolio to assist us in making decisions about how to raise finance and manage risk now and in the future;
Lawful bases: legitimate interests (to obtain payment of monies due to TAMI)
(e) Securitisation reporting ► where TAMI has entered into financing transactions involving your loan, such as securitisation transactions, we will be required to process your personal data for the purpose of complying with our regulatory obligation to report on such transactions to the UK Financial Conduct Authority and/or the European Securities and Markets Authority;
Lawful bases: legal obligations, legitimate interests (to comply with any requirements relating to securitisation reporting)
(f) To appoint a servicer ► in the event that we terminate our relationship with OneFamily, we will share personal data with a new entity to service the loans that are owned by TAMI appropriately;
Lawful bases: legal obligations, legitimate interests (to comply with any requirements relating to securitisation reporting and to obtain payment of monies due to TAMI)
(g) To comply with legal or regulatory requirements, or as otherwise permitted by law ► to comply with regulatory requirements or dialogue with regulators or to defend or prosecute claims as applicable which may include disclosing your Personal Data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world. For example, the transaction and trade reporting we need to undertake in order to comply with TAMI’s obligations under MiFID II, as applicable;
Lawful bases: legal obligations; legal claims; legitimate interests (to cooperate with law enforcement and regulatory authorities)
(h) To inform you of changes ► to notify you about changes to TAMI’s services and the management of your loan; and
Lawful bases: legitimate interests (to notify you about changes to TAMI’s services)
(i) To reorganize or make changes to TAMI’s business ► in the event that TAMI (i) is subject to negotiations for the sale of TAMI’s business or part thereof to a third party, (ii) are sold to a third party or (iii) undergo a reorganization, TAMI may need to transfer some or all of your Personal Data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analyzing any proposed sale or reorganization. TAMI may also need to transfer your Personal Data to that reorganised entity or third party after the sale or reorganisation for them to use for the same purposes as set out in this privacy notice.
Lawful bases: legitimate interests (in order to allow TAMI to change its business)
4. Sharing your Personal Data (and transfers outside of the EEA)
4.1 We may sometimes share Personal Data with third parties as described at section 3 above. From time to time we may use affiliates or other companies to provide services on our behalf. Such companies will be given only the Personal Data needed to perform those services and neither TAMI nor SuttonPark will authorize them to use or disclose Personal Data for their own marketing or for purposes other than those described at section 3 Purposes. In every instance, contracts are in place holding these companies to the same standards of confidentiality by which TAMI is governed.
4.2 Transfers outside of the EEA: As SuttonPark and potentially other third parties with which we share your Personal Data are located outside of the EEA, your Personal Data may be accessed by staff, suppliers or other persons in, transferred to, and/or stored at, a destination outside the EEA in which data protection laws may be of a lower standard than in the EEA. We will, in all circumstances, safeguard Personal Data as set out in this privacy notice.
4.3 In particular, where we transfer Personal Data from inside the EEA to countries outside the EEA that have not been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws (see the full list of approved countries here http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm), we will establish lawful grounds justifying such transfer. Most typically, this will include EU Commission-approved model contractual clauses or Privacy Shield, but may also include other lawful grounds permitted by applicable legal requirements.
4.4 Please contact us if you would like to see a copy of the specific safeguards applied to the export of your Personal Data.
5. Retention of your Personal Data
5.1 Our retention periods for personal data are based on business needs and legal requirements. We will retain your Personal Data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purposes. For example, we may retain certain transaction details and correspondence until the time limit for claims arising from the loan transaction has expired (in the UK this may be up to 12 years in relation to contractual claims entered into by way of deed), or to comply with regulatory requirements regarding the retention of such data particularly in relation to securitisation reporting, or in connection with actual or contemplated litigation. When Personal Data is no longer needed, we will either irreversibly anonymise the data (and we may further retain and use the anonymised information) or securely destroy the data.
6. Maintaining the accuracy of your Personal Data
6.1 We are committed to maintaining the accuracy of your Personal Data and ensuring that it is complete and up-to-date. If your Personal Data changes, please notify OneFamily immediately so that the relevant changes are reflected in the reporting provided to us. Failure to notify OneFamily of changes to your Personal Data may negatively impact the way TAMI communicates or provides services to you. Where appropriate, TAMI will advise others of any material amendments to your Personal Data that TAMI or SuttonPark may have released to them.
7. Safeguarding your Personal Data
7.1 We use physical, electronic and procedural safeguards to protect against unauthorized use, access, modification, destruction, disclosure, loss or theft of your Personal Data in our custody or control.
7.2 We have agreements and controls in place with third party service providers requiring that any information we provide to them must be safeguarded and used only for the purpose of providing the service we have requested the company to perform.
Security over the internet
7.3 No data transmission over the Internet or websites can be guaranteed to be secure from intrusion. However, we have appropriate and sufficient technical and organisational security measures to protect personal data in accordance with applicable data protection legislation.
7.4 All information we hold in relation to you is stored on secure servers controlled by SuttonPark or its subcontractors and accessed and used subject to our security policies and standards.
8. Changes to this Privacy Notice
8.1 From time to time, TAMI may make changes to this privacy notice. We will make reasonable attempts to notify you if any significant changes are made.
8.2 The most recent copy of our privacy notice will be published at onefamily.com/tami-privacy/
8.3 Please see the Contact Us section below to answer any questions you may have about this privacy notice.
9. Your Rights
9.1 If you have any questions in relation to our use of your Personal Data, you should first contact us as per the Contact Us section below. Under certain conditions you may have the right to require us to:
(a) provide you with further details on the use we make of your information;
(b) provide you with a copy of information that you have provided to us;
(c) update any inaccuracies in the Personal Data we hold (see Maintaining the accuracy of your personal data (see paragraph 6 above));
(d) delete any Personal Data that we no longer has a lawful ground to use;
(e) where processing is based on consent, withdraw your consent so that we stop that particular processing;
(f) object to (1) direct marketing or (2) any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights;
(g) restrict how we use your information while a complaint is being investigated; and
(h) review any automated decision made about you.
9.2 Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). If you exercise any of these rights, we will check your entitlement and respond in most cases within a month.
9.3 If you are not satisfied with our use of your Personal Data or our response to any exercise of these rights you have the right to complain to the relevant data protection authority. See “Contact Us” for details.
10. Contact Us
10.1 If you have any questions or concerns about our privacy practices, the privacy of your Personal Data or you want to change your privacy preferences, please let us know. The relevant contacts are listed below.
10.2 If after contacting us you do not feel that we have adequately addressed your concerns, you may contact the data protection regulator. In the UK, this is the Information Commissioner’s Office https://ico.org.uk/ 0303 123 1113.
| Entity name | Data Protection Contact General Enquiries and Enquiries from individuals within the EEA |
|---|---|
| Trans Atlantic Lifetime Mortgages Limited | Jhoan Vargas 3 More London Riverside London, SE1 2AQ UNITED KINGDOM |
| SuttonPark Capital LLC | Frederick Love 600 Brickell Ave, 19th Floor Miami, Fl 33131 UNITED STATES OF AMERICA |