Privacy Policy of Fairview Arvest Bank

1. Introduction Fairview Arvest Bank ("Fairview Arvest Bank", "we", "us", or "our") is committed to protecting your privacy and handling your personal data in a fair, lawful, and transparent manner. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you interact with us, visit our websites, use our mobile or online banking services, or otherwise engage with our products and services in England.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are Fairview Arvest Bank is a banking institution operating in England. We provide a range of retail and commercial banking services, including current and savings accounts, payment services, loans, credit facilities, investment and savings products, and related financial services.

For the purposes of applicable data protection laws, we act as a data controller when we determine the purposes and means of processing your personal data.

3. Information We Collect We collect and process different categories of personal data depending on your relationship with us and the services you use. This may include:

3.1 Identification and Contact Details

• Full name, title, date of birth, and gender
• Residential and correspondence addresses
• Email address and telephone numbers
• National identifiers (such as National Insurance number, tax identification number, passport or ID card details, driving licence details)

3.2 Financial and Account Information

• Bank account numbers and sort codes
• Account balances and transaction history
• Payment card details (card number, expiry date, security code where applicable and permitted)
• Direct debit details and standing orders
• Loan and credit account details, including outstanding balances, repayment history, and collateral

3.3 Know Your Customer (KYC), Anti-Money Laundering (AML) and Compliance Data

• Information obtained from identity verification checks
• Information from sanctions lists, politically exposed persons (PEP) lists, and adverse media checks
• Records relating to suspected fraud, money laundering, or other financial crime

3.4 Technical and Usage Data

• IP address, browser type, operating system, and device information
• Login credentials and security credentials (such as usernames, partially stored credentials, and security tokens)
• Information on how you use our websites, mobile apps, online banking, and other digital channels
• Cookies and similar technologies data (as set out in our separate Cookies Policy, where applicable)

3.5 Communication and Interaction Data

• Records of communications with us (including phone calls, emails, online chats, and in-branch discussions where recorded in our systems)
• Feedback, complaints, and survey responses

3.6 Special Categories of Data (Sensitive Data) We generally do not seek to collect sensitive personal data (such as health information or data about racial or ethnic origin, political opinions, or religious beliefs) unless it is strictly necessary, and we have a lawful basis to do so. For example, we may process health information if you share it to request tailored customer support or vulnerable customer assistance.

4. How We Collect Your Information We may collect personal data from:

   • You directly, when you apply for a product or service, complete forms, communicate with us, or use our online services
   • Your use of our products and services, such as transactions and account activity
   • Publicly available sources (e.g. electoral registers, corporate registries, public websites, and public records)
   • Credit reference agencies, fraud-prevention agencies, AML/CTF databases, and other background-check providers
   • Other banks, payment service providers, and financial institutions during the processing of payments and transfers
   • Third-party service providers and business partners (for example, card scheme operators, payment processors, and advisors)

5. Legal Bases for Processing We process your personal data only where we have a lawful basis under applicable data protection law. These bases may include:

5.1 Performance of a Contract To provide banking and related services you request, including opening and maintaining accounts, processing payments, and providing credit and other products.

5.2 Legal and Regulatory Obligations To comply with laws and regulations applicable to banks in England and the UK, including anti-money laundering, counter-terrorist financing, sanctions, tax reporting, consumer protection, and prudential regulations.

5.3 Legitimate Interests To pursue our legitimate interests, provided your interests and fundamental rights do not override those interests. These may include:

• Managing and improving our products, services, operations, and security
• Preventing and detecting fraud and financial crime
• Handling enquiries, complaints, and disputes
• Undertaking risk management, audits, and internal governance
• Conducting limited direct marketing and service-related communications (in line with applicable law)

5.4 Consent Where required by law, we will obtain your consent before processing your personal data for specific purposes (for example, certain types of electronic marketing). You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

6. How We Use Your Information We may use your personal data for the following purposes:

   • To assess and process applications for accounts, loans, credit, and other banking products
   • To open, administer, and service your accounts
   • To process transactions, including deposits, withdrawals, transfers, and payments
   • To provide online and mobile banking, authentication, and account management services
   • To conduct identity verification, credit and affordability checks, and risk assessments
   • To detect and prevent fraud, money laundering, terrorist financing, and other unlawful activities
   • To comply with legal and regulatory requirements, including reporting to authorities where required
   • To manage our relationship with you, including customer support, communications, and complaint handling
   • To improve our products, services, processes, and security arrangements
   • To carry out analytics and reporting to understand how our customers use our services, enhance customer experience, and support prudent management of our banking activities
   • To send you information about our products, services, and offers, subject to applicable consent or opt-out rights

7. Automated Decision-Making and Profiling We may use automated systems, including profiling, in:

   • Credit and affordability assessments
   • Fraud detection and transaction monitoring
   • Sanctions and compliance screenings

Where automated decisions produce legal effects or similarly significantly affect you, we will ensure such processing is permitted by law and provide you with information about the logic involved, as well as the significance and potential consequences. Where required, you may have the right to request human intervention, to express your point of view, and to contest the decision.

8. Sharing Your Information We may share your personal data with:
   • Other entities within our banking group (if applicable) for internal administrative, risk management, and compliance purposes
   • Payment systems, card schemes, correspondent banks, and other financial institutions involved in processing your transactions
   • Credit reference agencies and fraud-prevention agencies
   • Service providers and professional advisers, including IT providers, cloud hosting providers, analytics providers, consultants, auditors, and legal advisers, who act on our instructions and are subject to appropriate confidentiality and security obligations
   • Regulators, supervisory authorities, tax authorities, law enforcement agencies, courts, and other public authorities where required by law or to protect our rights, customers, or third parties
   • Third parties in connection with a corporate transaction involving Fairview Arvest Bank, such as a merger, acquisition, restructuring, or transfer of business, subject to appropriate safeguards

We do not sell your personal information.

9. International Transfers Your personal data may be transferred to and processed in countries outside England and the United Kingdom, including countries that may not provide the same level of data protection as the UK.

Where we transfer personal data outside the UK or the European Economic Area, we will do so only where permitted by law and will take appropriate safeguards to ensure your personal data remains protected. These safeguards may include:

• Using countries that have been deemed to provide an adequate level of data protection
• Implementing standard contractual clauses or equivalent contractual safeguards
• Applying additional technical and organisational measures where appropriate

10. Data Retention We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:
    • The duration of your relationship with us and the operation of your accounts or services
    • Any retention period required by law or regulation applicable to banks and financial institutions
    • The time needed to establish, exercise, or defend legal claims

When personal data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with our retention policies.

11. Security of Your Information We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures may include:
    • Encryption, pseudonymisation, and access controls
    • Physical and logical security safeguards for our systems and premises
    • Regular monitoring, testing, and evaluation of the effectiveness of our security measures

Despite our efforts, no system can be completely secure. You are responsible for maintaining the confidentiality of any credentials used to access our services and for following our security guidance.

12. Your Rights Subject to applicable law and certain conditions, you may have the following rights in relation to your personal data:
    • Right of access: to obtain confirmation whether we process your personal data and to receive a copy of that data
    • Right to rectification: to have inaccurate or incomplete personal data corrected or updated
    • Right to erasure: to request deletion of your personal data where there is no longer a lawful basis for us to retain it
    • Right to restriction: to request restriction of processing in certain circumstances
    • Right to data portability: to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller where technically feasible
    • Right to object: to object to processing based on our legitimate interests or for direct marketing purposes
    • Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time

To exercise any of these rights, please contact us using the contact details provided in the "Contact Us" section below. We may need to verify your identity before responding to your request.

13. Direct Marketing We may use your contact details to send you information about our products, services, and offers that may be of interest to you, including tailored offers based on your relationship with us. This may include products that help you manage, grow, or preserve your financial resources, including savings products that allow you to harvest the benefits of careful financial planning.

We will only send electronic marketing communications where permitted by law and, where required, with your consent. You may opt out of marketing communications at any time by following the unsubscribe instructions in our messages or by contacting us directly. Even if you opt out of marketing, we may still send you non-marketing communications related to your accounts and services.

14. Cookies and Online Tracking When you visit our websites or use our online services, we may use cookies and similar technologies to collect certain information automatically. This may include information about your device, browser, and how you interact with our services.

We use this information to:

• Ensure the proper functioning and security of our digital services
• Remember your preferences
• Improve user experience and manage performance
• Conduct aggregated analytics

Where required by law, we will request your consent before placing non-essential cookies on your device. For further details, please refer to our separate Cookies Policy, where available.

15. Children’s Privacy Our services are not primarily directed at children. We do not knowingly collect personal data from children without appropriate parental or guardian consent where required by law. If you become aware that a child has provided us with personal data without proper consent, please contact us so that we can take appropriate action.

16. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the "last updated" date and, where appropriate, notify you through our usual communication channels or by publishing a notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.

17. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, or if you wish to exercise your data protection rights, please contact us using the contact details made available on our official Fairview Arvest Bank website or via your local branch in England.

We will handle your query fairly, transparently, and in accordance with applicable data protection laws.