Privacy Notice

1. Introduction

Silverstripe Credit and Technologies Limited (“Silvercat”, “we”, “our, “the Company”) may hold and process personal and sensitive (where applicable) information. This Privacy Notice (PN) explains how the Company collects, uses and shares such data. It is important to read this PN together with any other notice we may provide on specific occasions when we are collecting or processing personal data. This PN supplements other notices and privacy policies and is not intended to override them.

The Company reserves the right to change this notice from time to time to keep it up to date with legal requirements, guidance from the Information Commissioner Office (“ICO”) and the way we operate our business. Any changes will be made available through our website and will be deemed to be accepted by you upon your first visit following the publication of any update.

By "personal information", we mean information that relates to and identifies an individual. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

2. Data Collection

Silvercat collects and processes employment related data, as well as may collect and/or process some personal data directly from the individual or sent by a third party.

It does not include data where the identity has been removed (anonymous data).

The data we may collect, process and/or transfer may include, but it is not limited to the following:

  • Identity data (such as names, title, date of birth, gender, National Insurance number etc.);
  • Contact data (such as postal address, email address, phone numbers);
  • Technical data (such as IP address, login data, browser type, time zone etc.);
  • Usage data (such as information on how an individual uses our website, products or services);
  • Marketing and communication data (such as preferences in receiving marketing from us and our third parties and individual

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.

3. Special categories of personal data

To the extent permitted by applicable laws, Silvercat may also collect and process a limited amount of personal information falling into special categories, sometimes called “sensitive personal data”. This term includes information relating to such matters as racial or ethnic origin, religious beliefs, physical or mental health (including details of accommodations or adjustments), certain maternity/adoption information, trade union membership, sexual orientation, information regarding sexual life, biometric data, genetic data, criminal records and information regarding criminal offences or proceedings.

If Silvercat processes sensitive personal data, this will be to an extent permitted by applicable laws and only if relevant and consented to by the individual.

4. Purpose and lawful basis for data processing

Personal information may be collected and processed for various business purposes, in accordance with applicable laws.

Where applicable data protection laws require us to process personal information on the basis of a specific lawful justification, we generally process personal information under one of the following bases:

  • the processing is necessary for the legitimate interests pursued by Silvercat except where such interests are overridden by an individual’s interests or fundamental rights and freedoms which require protection of personal information;
  • the processing is necessary for compliance with a legal obligation to which Silvercat is subject; or
  • the processing is necessary for the performance of a contract to which an individual is a party or in order to take steps at an individual’s request prior to entering into such a contract.

We may on occasion process personal information for the purpose of the legitimate interests pursued by a third party, except where such interests are overridden by an individual’s interests or fundamental rights and freedoms which require protection of personal information.

5. Special categories of personal information or sensitive data

There are sensitive or special categories of personal information which may be processed where applicable data protection laws require us to do so. Such special categories of personal information on the basis of a specific lawful justification, may include being:

  • necessary for judicial and statutory purposes – for reasons of substantial public interest;
  • necessary for the administration of justice;
  • necessary to protect the vital interests of the data subject or another individual;
  • necessary for the safeguarding of children and of individuals at risk;
  • personal data already in the public domain (manifestly made public);
  • necessary for legal claims;
  • necessary for when a court acts in its judicial capacity;
  • necessary for the purpose of preventing fraud; and
  • necessary for archiving, research or statistical purposes.

If the processing does not satisfy one of the above conditions but it is needed due to business reasons, we will seek a consent to ensure the information is freely given, informed and explicit. Information regarding such processing will be provided to the individual at the time that consent is requested, along with the impact of not providing any such consent.

6. Criminal convictions and offences

Personal information relating to criminal convictions and offences will only be processed where authorised by applicable laws, such as:

  • under the control of official authority; or
  • authorised by domestic law. In the UK, this means you need to meet one of the conditions in Schedule 2, Part 1 of the DPA 2018.

7. Retention of personal data

Silvercat will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements. We endeavour to ensure that any personal information that we need to process in line with the above reasons is kept as current as possible, and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable. However, some personal information may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.

We will generally retain an individual’s personal information only so long as it is required for purposes for which it was collected.

To determine the appropriate retention period for personal data, we consider:

  • The amount, nature and sensitivity of the personal data.
  • The potential risk of harm from unauthorised use or disclosure of your personal data.
  • The purposes for which we process your personal data and whether we can achieve those purposes through other means.
  • The applicable legal requirements.

8. Data Sharing

We may have to share your data with third parties, including third-party service providers and other entities in the group. We require third parties to respect the security of your data and to treat it in accordance with the law.

9. Rights

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Right to access, correct and delete your personal information

An individual has the right to request access to any of personal information that Silvercat may hold where you believe there is no good reason for us continuing to process it, and to request correction of any inaccurate data relating to them. Furthermore, they have the right to request deletion of any irrelevant data we may hold about them.

Data portability

Where we are relying upon the consent or the fact that the processing is necessary for the performance of a contract, an individual has the right to receive all such personal information in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing

You have the right to restrict our processing of personal information where:

  • you contest the accuracy of the personal information until we have taken sufficient steps to correct or verify its accuracy;
  • you believe the processing is unlawful but you do not want us to erase the data;
  • you believe we no longer need the personal information for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
  • you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether Silvercat has compelling legitimate grounds to continue processing.

Where personal information is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims.

Right to withdraw consent

In the limited circumstances where you may have provided us with your consent to the collection, processing and transfer of data, you have the right to withdraw such consent for that specific processing at any time. You can do this by (i) in some cases deleting the relevant data from the relevant People & Culture system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our data retention policy) and by (ii) contacting People & Culture. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Right to object to processing justified on legitimate interest grounds

Where we are relying upon a legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

You also have the right to lodge a complaint with a supervisory authority, ICO, if you consider that the processing of your personal information infringes applicable law.

For further information regarding your rights, or to exercise any of your rights, please contact Legal and Compliance.

10. Governing Law and Jurisdiction

These terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governing by and construed in accordance with the laws of England and Wales. Each party irrevocably agrees that the courts of England and Wales shall have non-exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with these terms or its subject matter or formation.

11. Other information

You should note that if our business (or any part of it) is sold or transferred at any time, the information we hold may form part of the assets transferred although will still only be used in accordance with this notice unless and until you are notified otherwise.