Privacy Notice

1. Introduction

We value your privacy. We want to be accountable and fair to you and transparent about how we collect and use your personal data.

This privacy notice tells you what to expect when we collect and use personal data about you. It applies to:

  • all users of our website www.TotallyMoney.com and the TotallyMoney app; and
  • to customers of Confused.com or Know Your Money, if they compare cards on the Confused.com or Know Your Money websites (see sections 5.5 and 5.6 for more details).

You should also read our Terms and Conditions and Cookie Policy carefully before you decide to use our services.

Any changes we make to this privacy notice will be posted on this page, so please check back frequently.

If you are a Credit Karma customer, please read our Credit Karma specific Terms and Conditions and Privacy Notice.

This privacy notice applies only to the personal data that we collect in relation to our services. Our website may contain links to and from third party websites. For example, we may link to and from the websites of lenders, credit reference agencies, our partner networks, advertisers or affiliates. We can’t be responsible for personal data that these third parties collect, store and use through their website without our involvement. You should always read the privacy notice of each website you visit carefully and before you submit any personal data to them.

2. Who we are

We are TotallyMoney Limited. We own and operate the website www.totallymoney.com and the TotallyMoney app. We provide a range of free services to help you better understand and improve your credit situation. We act as an independent credit broker, not a lender. Further information about our services can be found in our Terms and Conditions.

We also provide product comparison services to customers of Credit Karma, Confused.com and Know Your Money (see sections 5.5 and 5.6 for more details).

TotallyMoney Limited is a company registered in England (No. 06205695). Our registered office is at Chapter House, 16 Brunswick Place, London N1 6DZ We are an appointed representative of our sister company, MI Money Limited, which is authorised and regulated by the Financial Conduct Authority in respect of consumer credit related activities including credit broking and the provision of credit information services (FCA FRN 511936).

Data protection law applies to our collection and use of personal data and TotallyMoney Limited is the controller of that personal data (ICO Registration Number Z1096594).

If you have any questions about this privacy notice, please contact us or email us at help@totallymoney.com. If you wish to contact our Data Protection Officer you can email them at dpo@totallymoney.com, or you can write to them at Chapter House, 16 Brunswick Place, London N1 6DZ

3. What data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you. In this privacy notice we’ve used the following definitions to refer to some of this data:

Sign-up data includes the information you provide when you sign up to use our services (e.g. first name, last name, date of birth, postcode, address details, residential status, employment status, annual income, phone number, email address and password).

If you don’t provide sign-up data, you won’t be able to open a TotallyMoney account. It’s vital that you keep your account information accurate and up to date, because inaccurate personal data will produce inaccurate results. You can update your information in the "My Details" section of your account, and we sometimes will give you a nudge to do so when you log in. If you’re not sure how to update your information, please contact us – help@totallymoney.com.

Eligibility data means information about your eligibility for the products featured on our website, such as your likelihood of being accepted for a particular product and the actual or indicative rates of interest and term of borrowing that will apply. This information is given to us by Experian and the lenders with whom we perform direct-to-lender eligibility checks (see section 7.2 for more details).

Credit report data means information about your credit file given to us by TransUnion (see section 7.1 for more details).

Credit score data means information about your credit score given to us by TransUnion (see section 7.1 for more details).

Marketing data means your marketing preferences (i.e. whether you have opted in or out of receiving marketing messages from us).

Product application data means data about the outcome of product applications you make as a result of using our services, which is given to us by some lenders, lender’s agents and third party brokers so that we can calculate the commission that is due to us from those lenders.

Technical and behavioural data means details of your visits to the website including the actual pages you visit, IP address (from which we may derive your location) and details of the resources that you access. We also capture information about your computer or device including, where available, your operating system and browser type.

We also collect, use and share aggregated data such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Third party comparison services data includes personal data relating to customers of Credit Karma and Confused.com, where we use that data to helps customers of Credit Karma and Confused.com check their eligibility for and compare credit products.

4. How we collect your data

We use different methods to collect data from and about you, including:

Direct interactions. You may give us your personal data by filling in forms or by corresponding with us. This includes personal data you provide when you:

  • sign up for our products or services;
  • enter a competition, promotion or survey;
  • give us feedback; or
  • contact us (for example by post, phone, email or via our website or app).

Credit reference agencies. The credit reference agencies that we work with will give us eligibility data, credit score data and credit report data.

Lenders. The lenders, lenders’ agents and third party credit brokers that we work with give us eligibility data and, in some cases, product application data.

Automated technologies or interactions. We’ll automatically collect technical and behavioural data as you interact with our website or app.

MI Money Limited. Our sister company, MI Money Limited, will give us marketing data if you agree to receive marketing from us when you apply for a product that MI Money Limited promotes.

Karma and Confused.com give us third party comparison service data so that we can help their customers check their eligibility for and compare credit products.

5. How we use your data

5.1. Your Borrowing Power

When you sign up for a TotallyMoney account, we’ll ask Experian to compare your sign-up data with the acceptance criteria for products and to “soft search” your credit file. This allows us to calculate your Borrowing Power, a score out of ten, which gives you an idea of the credit you may be able to access.

We’ll repeat the Borrowing Power soft search every month for as long as you have a live TotallyMoney account. We reserve the right to suspend these monthly searches if your account is inactive for 12 months or more. We will also refresh your Borrowing Power when you sign in to your account.

Some of the Borrowing Power soft searches that we do will leave a ‘footprint’ on your credit file. For more information about soft searches and footprints, see section 5.4.

5.2. Understanding your credit file (credit report and credit score service)

If you apply for a free credit report through our service, we will use your sign-up data to check whether TransUnion is able to provide you with a report.

If you have received a free credit report through our service, we’ll ask TransUnion for your updated credit report data and credit score data every month for as long as you have a live TotallyMoney account. We reserve the right to suspend these monthly searches if your account is inactive for 12 months or more.

We’ll also ask for your credit score data from TransUnion each time that you log into your account, so that we can provide you with an updated credit score.

We will use your credit report data and credit score data to provide you with your free credit report and your credit score and also to personalise the service.

Some of the credit report and credit score soft searches that we do will leave ‘footprints’ on your credit file. For more information about soft searches and footprints, see section 5.4.

5.3. Eligibility checking service and personalisation

We’ll analyse and profile your personal data to personalise the services we provide to you. For example, we use your personal data to:

  • tailor the information that we present to you;

  • improve our services; and

  • personalise offers and other content that we show you.

Our eligibility checking service works to find you offers. We then sort your offers based on their features and what's best for your credit profile. Although we may be paid commission, this never influences how your offers are ranked.

To do this, we use automated technology that assesses your personal data to create a profile of you (including your credit eligibility). We then use this information to search for and find suitable products for your credit profile. Your results are based on our unique “Match Factor” algorithm, which considers factors such as:

  • your credit profile;

  • your eligibility score;

  • the features of the products; and

  • lender reliability.

This is a type of automated decision making and, depending on how you use the information provided, may have a significant effect on you as it relates to your access to credit. Whilst we do not make credit decisions about you, we do this automated decision making because it is necessary for us to provide the services to you.

You have the right to object to and not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you. If you wish to object to automated decision making and profiling, we’ll not be able to provide the services to you and will close your account.

Checking or refreshing your offers will prompt Experian and some of the lenders that we work directly with to soft search your credit file. Some of these soft searches will leave ‘footprints’ on your credit file. For more information about soft searches and footprints, see section 5.4.

5.4. Soft searches and ‘footprints’ on your credit report

Some of our services involve soft searching your credit file. A soft search is like a quick peek at your credit file. Soft searches will not harm your credit rating or affect the way lenders see you.

Soft searching your credit file allows us to:

  • assess your eligibility for products; and
  • get or refresh your credit report and credit score.

You may see these soft searches as ‘footprints’ on your credit report in either our name or the name of one of the lenders or credit reference agencies that we work with. Soft searches on your credit file will be given different markings, depending on their purpose, such as:

  • Affordability
  • Anti-Money Laundering
  • Consumer Credit File Request
  • Identity Check
  • Quotation/Preliminary Search

You may see multiple footprints on your credit file because soft searches will be carried out:

  • when you first sign up for our services;
  • when you log in;
  • when you go to the offers section of your account;
  • when you check or refresh your offers (e.g. when you click on ‘view card’ or ‘find loans’);
  • in the background on a monthly basis to refresh your Borrowing Power, credit report and credit score (we reserve the right to suspend these monthly searches if your account is inactive for 12 months or more).

Here are some examples footprints you might see on your credit file as a result of using our services:

  • Avant Credit Of Uk Llc (Ar) or Avant Credit Of Uk Llc (Cval)
  • Bamboo Limited (Cval Tac Cr R)
  • Capital One Bank (Europe) Plc (Ml, Sa, Sr, Cval)
  • Hitachi Capital (Uk) Plc
  • Lendable Limited (Sr, Ar, Cval)
  • Likely Loans
  • Likely Loans (TotallyMoney.com)
  • Madison Cf Uk LTD T/A 118 118 Money (Cval Sr Tac)
  • Marbles.com
  • Marbles (TotallyMoney.com)
  • Shawbrook Bank Limited (Sr, Tac, Cval, Sa, Cosmos)
  • Totallymoney Limited (Cval)
  • Totallymoney.com with Capital One
  • Vanquis Bank Limited (Sa Sr, Ct, Tac, Cval)
  • Zopa Limited (Tac)

If we run a trial with a potential supplier and partner and we need to use real rather than dummy or anonymous data for the test to be effective you may see a footprint relating to that trial on your credit file. See section 7.5 below for more details.

5.5. Credit Karma and Confused.com

TotallyMoney helps customers of Credit Karma and Confused.com check their eligibility for and compare credit products. Our software ‘powers’ these services, to provide people with credit card and/or loan offers.

If you compare credit cards on Confused.com, or credit cards or loans on Credit Karma, we will carry out eligibility checks on you and show you offers. If you choose to apply for a product we will pass you through to the relevant lender. See section 5.3 and section 7 of this privacy notice for more details of our eligibility checking service and how we share your data with third parties for this purpose.

If you have reached TotallyMoney via Credit Karma or Confused.com, TotallyMoney will only use your information to carry out the eligibility checks that you have requested from those services and to present the results to you on the relevant site.

If you use Credit Karma or Confused.com you will not create a TotallyMoney account as part of the comparison process. This means that, if you are a Credit Karma or Confused.com customer and you would also like to receive TotallyMoney’s Borrowing Power services or credit report and credit score services, you will need to separately create your own TotallyMoney account.

5.5.1. The TotallyMoney terms and conditions and privacy notice that apply to Credit Karma customers

If you are a Credit Karma customer, please read our Credit Karma specific Terms and Conditions and Privacy Notice.

5.5.2. The TotallyMoney terms and conditions and privacy notice that apply to Confused.com customers

If you are a Confused.com customer then our standard Terms and Conditions and this privacy notice will apply when you compare cards on the Confused.com site, save that the following sections of this privacy notice will not apply:

  • Section 5.1. (Your Borrowing Power)
  • Section 5.2. (Understanding your credit file (credit report and credit score service))
  • Section 5.6 (Keeping in touch)
  • Section 7.3. (Sharing your personal data with marketing service providers and third-party advertising companies)
  • Section 8.2 (What you can do to keep your personal data safe)

Section 7.1. of this privacy notice (Sharing your personal data with credit reference agencies (Experian and TransUnion)) will only apply to Confused.com customers insofar as it relates to sharing your data with Experian so that Experian can do pre-screening searches and eligibility checking on our behalf.

5.6. Know Your Money

If you use Know Your Money to compare credit cards, you will be asked to create an account with TotallyMoney. At this point, you will become a TotallyMoney customer and our standard Terms and Conditions and this privacy notice will apply to your use of our services.

5.7. Keeping in touch

5.7.1. Service messages

We’ll send you a welcome email when you sign up.

We’ll send you monthly emails to tell you the results of your monthly Borrowing Power search. See section 5.1 for more information about Borrowing Power.

If you have a free credit report with us, we’ll send you monthly emails as a reminder that we’ve retrieved your credit report and credit score data from TransUnion.

We may also send you ad hoc service emails from time to time (for example, to contact you about forgotten passwords or to notify you about changes to our services).

Calculating your Borrowing Power and retrieving your credit report and credit score from TransUnion are core elements of our account service. We want to make sure that you remember that we are getting this data about you each month, even if you don’t need to log into your account very often. Therefore, please be aware that you can’t unsubscribe from service messages. If you do not wish to receive service messages, you will need to close your TotallyMoney account, which you can do by logging into your account and going to “My Details".

We’ll keep refreshing your Borrowing Power, credit report and credit score (and sending you monthly service messages about them) until you close your TotallyMoney account or we terminate or suspend your account (e.g. for misuse). We reserve the right to suspend these monthly searches if your account is inactive for 12 months or more.

5.7.2. Marketing

When you sign up for a TotallyMoney account, you can choose not to receive marketing messages. You can also unsubscribe from receiving marketing communications at any time by:

  • updating your preferences from within your TotallyMoney account; or
  • emailing us at help@totallymoney.com; or
  • clicking the unsubscribe link in any marketing email from us.

If you have not opted out of marketing (or if you have otherwise consented to receiving marketing from us, for example when you apply for a Fluid card) we’ll use your personal data to send you tailored offers or information about our products and services that may be of interest to you.

We may occasionally have arrangements in place with third parties that have a direct relationship with you and they may send information to you about us and our services where they are legally permitted to do so.

5.8. Correspondence, surveys, competitions and prize draws

If you contact us, we’ll keep a record of that correspondence.

From time to time, we may ask you if you would like to take part in a survey, competition or prize draw. We’ll use any personal data you submit for a survey, competition or prize draw in accordance with this privacy notice and any additional terms and conditions associated with the survey, competition or prize draw.

5.9. Website and app analytics

  • for system administration;
  • to measure and analyse traffic to our website or app; and
  • to enable us to analyse behaviour and trends on the website and app. This is statistical data about our users’ browsing actions and patterns and does not identify any individual.

We also use your technical and behavioural data to personalise the services for you.

5.10. To meet legal or regulatory requirements

We and our third-party service providers are required to comply with certain legal and regulatory requirements including:

  • complying with our regulatory obligations to the Financial Conduct Authority and the Information Commissioner; and
  • addressing enquiries or complaints from you or from a regulator.

We may process your personal data to comply with those requirements. Occasionally, we may be asked to provide certain information to regulators or law enforcement agencies. We’ll comply with these requests where legally required or permitted.

5.11. Fraud prevention

TotallyMoney and the credit reference agencies and lenders that we work with will process and share your data for the purposes of fraud prevention.

6. Our legal bases for processing your personal data

We’ve set out below, the legal bases on which we process your personal data. We’ve also identified what our legitimate interests are, where appropriate.

Purpose/Activity

Type of data

Lawful basis for processing including basis of legitimate interest

To provide you with our services, including your Borrowing Power and your free credit report

• Sign-up data

• Eligibility data

• Credit report data

• Credit score data

Performance of a contract with you

Eligibility checking service and personalisation (TotallyMoney customers)

• Sign-up data

• Eligibility data

• Credit report data

• Credit score data

• Technical and behavioural data

Performance of a contract with you

To help customers of Credit Karma and Confused.com check their eligibility for and compare credit products.

• Third party comparison service data

Necessary for our legitimate interests (to allow us to provide eligibility and credit comparison services to customers of Confused.com and Know Your Money)

Marketing - to tell you about your personalised offers or our other products and services that may interest you

• Sign-up data

• Marketing data

Necessary for our legitimate interests (to promote our products and services)
Consent (e.g. where you give opt-in consent to a third party such as our sister company, MI Money Limited, to receive email marketing from us or when you opt in to marketing using the preference centre)

Targeted advertising – to include you in or exclude you from targeted advertising campaigns

• Sign up data

• Marketing data

• Technical and behavioural data

Necessary for our legitimate interests (to help us show adverts to the right people)

Correspondence with you (customer queries)

• Sign up data

• Marketing data

• Technical and behavioural data

• Any additional personal data that you provide as part of your correspondence

Legitimate interest (to ensure customer satisfaction and to answer queries about the service, to monitor trends in queries to improve the services)

To enable you to partake in a prize draw, competition or complete a survey

• Sign up data

• Eligibility data

• Credit score data

• Marketing data

• Technical and behavioural data

Performance of a contract with you (to administer the prize draw, competition or survey)

Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)

To use data analytics to improve our website, app products/services, marketing, customer relationships and experiences and to develop new products

To ensure and monitor the security of our website and app

• Sign up data

• Marketing data

• Technical and behavioural data

Necessary for our legitimate interests (to provide you with customer and technical support, to define types of customers for our products and services, to keep our services updated and relevant, to develop our business and to inform our marketing strategy)

To meet legal or regulatory requirements

• Sign up data

• Technical and behavioural data

Compliance with a legal or regulatory requirement to which we are subject

To assist the wider industry with fraud prevention

• Sign up data

• Technical and behavioural data

Necessary for our legitimate interests (as a company working in this industry)

To calculate any commission payments due to us from lenders as a result of your application

• Product application data

Necessary for our legitimate interests (to calculate commission due to us)

7. How we share your personal data with others

7.1. Sharing your personal data with credit reference agencies (Experian and TransUnion)

A credit reference agency is a company that collects personal information from various sources and provides that personal information for a variety of uses (including to prospective lenders for the purposes of making credit decisions).

We share your personal data with Experian Ltd (“Experian”), who conduct pre-screening searches and eligibility checking on our behalf. Experian uses your personal data:

  • so that they can check your eligibility for the credit products listed on our site; and
  • for fraud prevention purposes.

Please read Experian’s terms by clicking here).

We share your personal data with TransUnion International UK Limited (“TransUnion”) to provide the credit report and credit score services. The way that TransUnion uses your data is set out in the TransUnion privacy notice, which can be found here. TransUnion’s company number is 03961870 and their registered office is One Park Lane, Leeds LS3 1EP. TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority under registration number 737740. Authorisation can be checked on the FCA Register.

If you apply for a free credit report, TransUnion will ask you for personal data to verify your identity and to authenticate you. TransUnion will ask you knowledge-based questions based on your credit history, that only you should know the answers to. We do not see the information you provide, even though it is provided to TransUnion through a TotallyMoney branded interface. We only see the outcome of the authentication process (e.g. authentication pass/failure). If TransUnion can authenticate you for the credit report service, TransUnion will provide us with a unique ID that we use to request your credit report data and credit score data.

The credit reference agencies will use the information you provide when setting up your TotallyMoney account and while using our services for the purposes of operating as a credit reference agency. This will include using such data for statistical purposes, to assist with identity verification, prevention of fraud / money laundering, tracing and collection of debt, service delivery and process implementation.

7.2. Sharing your personal data with lenders

We share your personal data with a range of lenders and other service providers:

  • so that they can check your eligibility for their products (including whether you’re an existing customer);
  • to pre-populate any lender or service provider’s application form you chose to complete; and
  • for fraud prevention purposes.

If you would like any more information about lenders that we currently work with, please email us – help@totallymoney.com.

We may also share limited details about you with lenders or their agents to verify any commission payments due to us as a result of your application.

If you apply for a lender’s product as a result of using our service, they will provide you with the terms and conditions for that product. They will also carry out their own identification and validation checks (including fraud prevention procedures), affordability and credit application checks in accordance with their own criteria. Any full credit check carried out by a lender or service provider will be visible on your credit file to all lenders in the future. The basis on which a lender or other service provider uses your personal data should be set out in their privacy notice.

7.3. Sharing your personal data with marketing service providers and third-party advertising companies

We share your marketing data, technical and behavioural data and/or your email address (in a protected format) with companies that assist us in our marketing, advertising and promotional activities. This includes:

  • service providers who provide platforms and systems that we use to help us serve marketing and advertising (i.e. Facebook, Outbrain and Taboola); and
  • our television advertising agency, All Response Media, who use cookie data to track the effectiveness of our television advertising (e.g. to spot spikes in traffic to our website when one of our television adverts is shown).

Some of this information is gathered through our own cookies and third party cookies on our website. For more information about how we use cookies please see our Cookie Policy.

In some cases, these third parties will also use the data that they collect for their own purposes, for example they may aggregate your data with other data they hold and use this to inform advertising related services provided to other clients.

7.3.1. Sharing your personal data with Facebook (in more detail)

We share customer email addresses (in a protected format) and cookie data about customers and recent visitors to our website with Facebook, so that Facebook can help us show our advertising to the right people. For example, we share this data with Facebook so that we can exclude existing customers and people that have visited our website recently from advertising campaigns that are aimed at finding new customers.

We may share your marketing data, information about your visits to our website (i.e. cookie data) and/or your email address (in a protected format) with Facebook to:

  • prevent you from receiving TotallyMoney targeted advertising content on Facebook if you have opted out of TotallyMoney marketing;
  • create an audience for our advertisements of other Facebook users who have similar characteristics to you based on the information in your Facebook profile (also known as a Lookalike Audience); or
  • include you in a “custom audience” that will receive TotallyMoney advertising content on Facebook (a custom audience is essentially a list of people who we think are most likely to be interested in a particular advertisement).

7.4. Sharing your personal data with group companies

We work with and are an appointed representative of MI Money Limited to provide our services to you. This requires us to share your personal data with MI Money Limited, so that MI Money Limited can meet its regulatory obligations as the regulated principal.

We may also disclose your personal data to any member of the TotallyMoney group, which means our subsidiaries, as well as our ultimate holding company and its subsidiaries. For example, way may share your personal data with group companies:

  • if another group company is helping us deliver the services;
  • where we have regulatory reporting requirements that mean we need to share personal data; or
  • in the event of a corporate restructure.

7.5. Sharing your personal data with other third parties

We may share your personal data with:

  • the Financial Conduct Authority, the Information Commissioner’s Office or any other legal, regulatory or governmental body that we are required to disclose information to;
  • our suppliers of technical and support services, insurers, logistic providers, and cloud service providers;
  • the analytics and search engine providers that assist us in the improvement and optimisation of our website.

We may share your personal data with potential suppliers and partners if want to trial those suppliers and partners to see if they can help us improve our services. For example, we may share your personal data with potential suppliers and partners to test the efficacy of their systems. We will only do this where we need to use real rather than dummy or anonymous data for the test to be effective. Some of these trials will involve soft searching your file and may leave footprints on your credit file. For more information on soft searches and footprints, see section 5.4 above.

We may consider corporate transactions such as a merger, acquisition, reorganisation or asset sale. We may share information with third parties in relation to that transaction. If we are acquired in whole or part, customer personal data may be one of the assets transferred.

We may disclose or share your personal data with third parties (e.g. professional advisors or public bodies) if it is necessary to:

enforce or apply our terms of use and other agreements;

protect the rights, property or safety of our staff, customers or other people.

This includes exchanging information with other companies and organisations for the purposes of identity verification and validation, fraud protection and credit risk reduction.

7.6. Transferring your personal data internationally

The data that we collect from you may be transferred to, and stored at, a destination outside of Europe (for these purposes “Europe” means the European Economic Area ("EEA") and the UK if the UK is no longer part of the EEA) in connection with the above purposes. For example:

  • we use an American email service provider to send our service and marketing emails;
  • we use an American software provider to supply the software platform we use to manage customer queries;
  • the credit reference agencies and lenders that we work with may also transfer your personal data outside of Europe (for more details, please read their privacy notices).

If we transfer any of your personal data outside of Europe, we’ll take steps necessary to ensure that your data is treated securely and in accordance with this privacy notice and all relevant statutory requirements. These measures include:

  • in the case of US based entities, entering into European Commission approved standard contractual arrangements with them, or ensuring they have signed up to the EU-US Privacy Shield (see further https://www.privacyshield.gov/welcome); or
  • in the case of entities based in other countries outside Europe, entering into European Commission approved standard contractual arrangements with them.

Further details on the steps we take to protect your personal data in these cases is available from us on request by contacting us by email at dpo@totallymoney.com at any time.

8. How we store your personal data

8.1. What we do to keep your personal data safe

All the information that you give us is stored on secure servers. The internet is not a secure medium, but we’ve put in place various security procedures to protect your information. We use firewalls to block unauthorised traffic to the servers. The actual servers are located in a secure location which can only be accessed by authorised personnel. We use industry-standard encryption technology to ensure that all your personal and transactional information is encrypted before transmission to certain lenders or third-party service providers. Our security policies are in place to safeguard your privacy from unauthorised access or improper use. We’ll continue to enhance our security as and when new technology becomes available.

8.2. What you can do to keep your personal data safe

You’re responsible for keeping your TotallyMoney account password confidential. We ask you not to share a password with anyone. From time to time, we or our service providers may communicate with you by email. You should keep your email account secure. Where possible, you should not provide us with any personal data that we’ve not asked for. If you’re unsure whether we need a certain piece of information, please ask us first before sending it to us.

8.3. How long we keep your personal data for

We keep your personal data for no longer than necessary for the purposes for which the personal data is processed. We may retain personal data where we need to for:

  • the purposes of complying with our legal and regulatory responsibilities;
  • responding to legal and regulatory enquiries; and
  • our own required record keeping.

For example, we’ll keep your sign-up data, eligibility data, credit report data, credit score data, marketing data and technical and behavioural data for as long as your account is live. If you close your account, we’ll remove this data from our live systems. We’ll archive a limited amount of personal data (e.g. your address, postcode, date of birth and email address) so that we can:

  • Answer any queries/complaints you may have;
  • Respond to queries or investigations from the Financial Conduct Authority or Financial Ombudsman Service;
  • Respond to legal claims.

We’ll keep the archived data for no longer than six years following your account closure.

9. Your legal rights

You have various rights in respect of our use of your personal data, including:

9.1. Your right to be informed

You have the right to be informed about the collection and use of your personal data. This is a key transparency requirement under the General Data Protection Regulation (“GDPR”). We must provide you with information including:

  • our purposes for processing your personal data;
  • our retention periods for that personal data; and
  • details of who it will be shared with.

This information is set out in the transparency notices on our website and app and in this privacy notice.

9.2. Your right to access

You have the right to access the personal data that we hold that relates to you. This is commonly referred to as a subject access request or “SAR”. You can make a SAR and view the personal data TotallyMoney holds on you. Please note that the personal data won’t include:

  • Information relating to another person (e.g. a fraudster) who has opened an account in your name, where we’ve good reason to believe that the personal data doesn’t relate to you (e.g. that person’s IP address);
  • your credit report and credit score (you will need to contact TransUnion for this information, because we don’t have direct access to it).

9.3. Your right to rectification

This right lets you correct or change any personal data we hold on you that’s wrong or out of date. You can change any of your account information, except your date of birth, by visiting ‘Edit My Details’ in your account. If you would like to change your date of birth, or you’re having problems editing your details, please contact us at help@totallymoney.com. Please note that we can’t correct information on your credit report. You can challenge incorrect information on your credit report using the “raise a dispute” function in your account. This will allow you to raise the dispute directly with TransUnion, who provide the credit report data.

9.4. Your right to erasure

Your right to erasure (or ‘the right to be forgotten’) is a right to ask for your personal data to be erased. We can do this — no problem — but it means we’ll close your account. Without certain personal data we can’t deliver our services. And if we can’t deliver our services, we become pretty useless to you. Once you’ve requested your right to erasure we’ll comply, but we can’t immediately delete everything. Some information associated to your TotallyMoney account must be kept for a limited period, for legal and regulatory purposes (see section 8 for more details).

9.5. Your right to restrict processing

You have the right to request that we restrict or suppress the processing of your personal data. This is not an absolute right and only applies in certain circumstances, including where:

  • you contest the accuracy of your personal data and we are verifying the accuracy of the data;
  • the data has been unlawfully processed and you oppose erasure and request restriction instead;
  • we no longer need the personal data, but you need us to keep it in order to establish, exercise or defend a legal claim; or
  • you have objected to us processing your data under Article 21(1) of GDPR (e.g. an objection to processing on the grounds of legitimate interest), and we are considering whether our legitimate grounds to process your data override your rights and interests.

9.6. Your right to data portability

The right to portability lets customers transfer data easily from one system to another. It’s safe and secure and doesn’t impact the data’s credibility. You can request a copy of the data that you have provided to TotallyMoney in a re-usable format. This right relates to personal data you have provided to us where our legal basis for processing is performance of a contract or consent (e.g. sign-up data).

9.7. Your right to object

You have the right to object to our processing of your personal data. This effectively allows you to ask us to stop processing your personal data. The right to object only applies in certain circumstances. Whether it applies depends on our purpose for processing and our lawful basis for processing.

You have the absolute right to object to the processing of your personal data for direct marketing purposes. If you exercise this right, we’ll stop using your personal data for this purpose.

You can also ask us to consider any valid objections which you have to our use of your personal data where we process your personal data based on our, or another person's, legitimate interest. This is not an absolute right, and we can continue processing your personal data if:

  • we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms; or

  • the processing is for the establishment, exercise or defence of legal claims.

9.8. Your rights related to automated decision making, including profiling

We use automated decision making to personalise our services and to tailor your offers (see section 5 for more details). You have the right to object to and not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you. If you wish to object to automated decision making and profiling, we’ll not be able to provide the services to you and will close your account.

9.9. Your right to withdraw consent

If we rely on consent to use your personal data in a particular way, but you later change your mind, you may withdraw your consent by contacting us at help@totallymoney and we’ll stop doing so. Details of where we rely on consent can be found in the section 6 above.

9.10. How to exercise your rights

To exercise the rights outlined above in respect of the personal data processed by us as a controller contact us or email us at help@totallymoney. We may need further information to verify your identity before we can respond to your request. We’ll consider all requests and provide our response within a reasonable period (and in any event any period required by applicable law). Certain personal data may be exempt from such requests in certain circumstances. If an exception applies, we’ll tell you this when we respond to your request.

9.11. Your right to complain

If you have any complaints about our collection, use or storage of your personal data please contact us at help@totallymoney. We’ll investigate and attempt to resolve your complaint. You may also make a complaint to the UK Information Commissioner (www.ico.org.uk). Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.

10. Contact

If you have any questions about this privacy notice or our use of your personal data, please contact us or email us at help@totallymoney.com.

Details of changes to this Privacy Policy

Version

Date

Details of Changes

1.0

03/07/2017

First published

1.1

18/07/2017

New second sentence added to the first paragraph of section 7 to provide further clarification that third party arrangements may exist.

1.2

15/08/2017

References to Media Ingenuity Limited changed to TotallyMoney Limited to reflect name change of company number 06205695.

1.3

17/08/2017

Minor updates to Paragraphs 5, 6 and 7 including the addition of Experian’s terms and to clarify unsubscribe routes.

1.4

01/05/2018

Amended to reflect the closure of Intelligent Alerts Service to new customers.

2.0

16/05/2018

Updated to reflect requirements of the General Data Protection Regulation.

2.1

25/05/2018

Further amendments to reflect requirements of the General Data Protection Regulation.

2.2

19/11/2018

Updated to reflect the requirement for account creation in order to access most services, and other less significant changes.

2.3

15/01/2019

Amended to reflect the requirement to register for most services.

2.4

23/04/2019

Updated references to Callcredit to become references to TransUnion (Callcredit change of name).

2.5

27/06/2019

Updated to include more information about our services, soft searches and ‘footprints’ on your credit file.

2.6

28/06/2019

Added information to sections 5.4 and 7.5 to explain how we use data in new suppliers partners trials.