Privacy Policy

Who we are and our role in relation to your data

Liberty Global Financial Solutions Limited (registered in the UK with Companies House under registered number 14555573) is a controller of your personal data in accordance with UK data protection law (including the retained EU Regulation 2016/679 as incorporated into UK domestic law and as amended from time to time (the “UK GDPR”) and the Data Protection Act 2018 (together “Data Protection Law”).

Liberty Global Financial Solutions Limited trades as blumepay. When we say “we”, “us”, “our” in this Privacy Notice, we are referring to blumepay.

You can find our contact details in Section 10 below.

This Privacy Notice applies to you if you are ("You"):

one of our customers or in a contractual relationship with us

applying for one of our products or services and have either been declined or not taken up the offer

a family member of our customer. Our customers may occasionally share with us information about their family when it is necessary to provide them with a product or service or to get to know them better

When you provide us with personal data related to other people, please make sure you inform them about their personal data that you have shared and invite them to read this Privacy Notice. We’ll ensure we will do the same whenever possible (e.g. when we have the person's contact details).

Who we are and our role in relation to your data

Liberty Global Financial Solutions Limited trades as blumepay. When we say “we”, “us”, “our” in this Privacy Notice, we are referring to blumepay.

You can find our contact details in Section 10 below.

This Privacy Notice applies to you if you are ("You"):

one of our customers or in a contractual relationship with us

applying for one of our products or services and have either been declined or not taken up the offer

a family member of our customer. Our customers may occasionally share with us information about their family when it is necessary to provide them with a product or service or to get to know them better

Who we are and our role in relation to your data

Liberty Global Financial Solutions Limited trades as blumepay. When we say “we”, “us”, “our” in this Privacy Notice, we are referring to blumepay.

You can find our contact details in Section 10 below.

This Privacy Notice applies to you if you are ("You"):

one of our customers or in a contractual relationship with us

applying for one of our products or services and have either been declined or not taken up the offer

a family member of our customer. Our customers may occasionally share with us information about their family when it is necessary to provide them with a product or service or to get to know them better

The types of personal data we use

In this section 2, we describe the types of personal data that we collect, create or use. In section 3, we describe the purposes and legal bases which apply to our use of these data.

Contact and identification data – Name, title, date of birth, place of birth, ID card number, title, occupation, gender, billing and delivery address, e-mail address, mobile phone number, nationality, language, age, employment and employment history, photos of your ID card, electronic ID, electronic signatures, blumepay account authentication details (user names and passwords), fraud screen response/fraud risk flags.

Information about your order for goods/services - Order-related details submitted by you to the retailer, including transaction details and contact information.

Information about your financial & affordability status - Information about, for example, your employment history, income, expenditure, any credits, negative payment history and previous credit approvals, insolvency status, data from official records such as the electoral roll, and personal circumstances such as your marital status, household profile, and whether you have dependents.

Payment information – Bank account number and sort code, bank name, bank account holder name, payment card data.

Information about your account and use of blumepay’s services – Which product(s) or service(s) you have used, transaction details (including our decisions in relation to your applications) and how you have used our product(s) and service(s). This includes information about outstanding and historical debt, your payment and repayment history, your personal preferences, and vulnerability status (where relevant).

Technical information generated through your use of blumepay’s services – Technical data such as response time for web pages, logs of the way you navigate through our services, download or transaction errors and date and time when you used the service.

Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.

Device information - IP address, Mobile ID (MAID), language settings, browser settings, time zone, operating system, platform, screen resolution and similar information about your device and device settings/usage.

Information from external sanction lists and PEP lists - Sanction lists and lists of persons constituting politically exposed persons (“PEP”) include information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the list in question.

There is no statutory or contractual obligation to provide the personal data set out above. However, without this personal data, blumepay will be unable to assess or make a decision on your application, or be able to manage a contract with you, in accordance with our legal and regulatory obligations as well as our commercial interests.

The types of personal data we use

In this section 2, we describe the types of personal data that we collect, create or use. In section 3, we describe the purposes and legal bases which apply to our use of these data.

Information about your order for goods/services - Order-related details submitted by you to the retailer, including transaction details and contact information.

Payment information – Bank account number and sort code, bank name, bank account holder name, payment card data.

Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.

The types of personal data we use

In this section 2, we describe the types of personal data that we collect, create or use. In section 3, we describe the purposes and legal bases which apply to our use of these data.

Information about your order for goods/services - Order-related details submitted by you to the retailer, including transaction details and contact information.

Payment information – Bank account number and sort code, bank name, bank account holder name, payment card data.

Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.

The purposes and legal bases for our use of your personal data

In the tables below we explain:

What we will use your personal data for (the purpose).

Which types of personal data we use for that purpose, and if the personal data comes directly from you or from another source. In the cases where we have received personal data about you from another source, we provide the source.

The legal basis under UK GDPR for our use of your personal data. Wherever we mention legitimate interests as the applicable legal basis, you may contact us for more information about how the determination was made or if you wish to object to this processing. Please see the contact information in Section 10.

When blumepay no longer requires use of the data – in Section 7 we explain when we delete your data. .

The purposes and legal bases for our use of your personal data

In the tables below we explain:

What we will use your personal data for (the purpose).

Which types of personal data we use for that purpose, and if the personal data comes directly from you or from another source. In the cases where we have received personal data about you from another source, we provide the source.

The legal basis under UK GDPR for our use of your personal data. Wherever we mention legitimate interests as the applicable legal basis, you may contact us for more information about how the determination was made or if you wish to object to this processing. Please see the contact information in Section 10.

When blumepay no longer requires use of the data – in Section 7 we explain when we delete your data. .

The purposes and legal bases for our use of your personal data

In the tables below we explain:

What we will use your personal data for (the purpose).

Which types of personal data we use for that purpose, and if the personal data comes directly from you or from another source. In the cases where we have received personal data about you from another source, we provide the source.

The legal basis under UK GDPR for our use of your personal data. Wherever we mention legitimate interests as the applicable legal basis, you may contact us for more information about how the determination was made or if you wish to object to this processing. Please see the contact information in Section 10.

When blumepay no longer requires use of the data – in Section 7 we explain when we delete your data. .

Purpose – why we process your personal data

Type of personal data processed and where we obtain it from

Legal basis under the
UK GDPR

How long we keep your
personal data for

Manage Customer Relationships:

To manage our customer relationship with you in accordance with our agreements, for each product or service you use, including considering and making decisions relating to your application and handling all matters that come to blumepay’s customer service

Manage Customer Relationships:

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.

Data we collect from other sources:

Information about your order for goods/services (from the retailer)
Information about your financial & affordability status

(from our existing records, where relevant, and credit reference agencies)

Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.
Information about your use of blumepay’s services (from blumepay)
Technical information generated through your use of blumepay’s services (from blumepay)
Device information (from your device)

We process your personal data to enter into

and perform our contract with you (Article 6(1)

(b) UK GDPR

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

On termination of each contract you have with us, we will review the personal data we hold and either delete, anonymise or archive data that is no longe required. See Section 7 for more information about why we retain your personal data following the termination of your contract with us.

Where your application has been declined, we will retain your personal data, including the application decision for a period of 6 years following the transaction date.

Ensure Network & Information Security:

To ensure network and information security in blumepay’s services

Ensure Network & Information Security:

To ensure network and information security in blumepay’s services

Data we collect directly from you:

Contact and identification data

Data we collect from other sources:

Information about your use of blumepay’s

services (from blumepay)

Technical information generated through

your use of blumepay’s services

(from blumepay)

Device Information (from your device)

Data we collect directly from you:

Contact and identification data

Data we collect from other sources:

Information about your use of blumepay’s

services (from blumepay)

Technical information generated through

your use of blumepay’s services

(from blumepay)

Device Information (from your device)

We process your personal data based on

legitimate interests (Article 6(1)(f) UK GDPR).

blumepay has determined that we have a

legitimate interest in being able to ensure

network and information security, that the

processing is necessary to achieve that

purpose, and not outweighed by your rights.

Network and information security controls

also benefit customers and wider society.

We process your personal data based on

legitimate interests (Article 6(1)(f) UK GDPR).

blumepay has determined that we have a

legitimate interest in being able to ensure

network and information security, that the

processing is necessary to achieve that

purpose, and not outweighed by your rights.

Network and information security controls

also benefit customers and wider society.

This processing lasts for as long as you are using a blumepay service. We retain personal data processed for network and information security purposes for up to 24 months after collection.Security incident records may be retained for up to six years after the incident to comply with legal and regulatory obligations and to establish, exercise, or defend legal claims. After these periods, data is securely deleted or anonymised.

Support Vulnerable Customers:

To be able to help you as a vulnerable customer (i.e. if you need extra support when contacting us due to particular circumstances)

Support Vulnerable Customers:

To be able to help you as a vulnerable customer (i.e. if you need extra support when contacting us due to particular circumstances)

Data we collect directly from you:

In addition to the data we collect from you for the purposes of managing our relationship with you (explained above), we also collect personal data relating to any particular vulnerability, which may include sensitive data for example information on your health where relevant .

Data we collect directly from you:

Non-sensitive personal data:

We process your personal data based on legitimate interests (Article 6(1)(f) UK GDPR).

blumepay has determined that we have a legitimate interest in ensuring vulnerable customers are supported to ensure fairness and to comply with our obligations under applicable laws and regulations. We also consider this use of personal data to be in the interests of vulnerable or potentially vulnerable customers as it allows them to be receive appropriate support.

Sensitive personal data: Based on your consent (Article 6(1)(a) and Article 9(2)(a) UK GDPR).

Non-sensitive personal data:

We process your personal data based on legitimate interests (Article 6(1)(f) UK GDPR).

Sensitive personal data: Based on your consent (Article 6(1)(a) and Article 9(2)(a) UK GDPR).

When you notify us that you are no longer a vulnerable customer or withdraw your consent. We also cease this processing on termination of your relationship with us. We keep your personal data for 6 years following termination of your contract with us.

Prevent Fraud: To be able to perform identity verification and fraud risk analysis to enter into and perform our contract with you.

This processing constitutes profiling and automated decision-making. We use automated decision-making for this purpose, to be able to determine if you constitute a risk of fraud. See section 6 for more information about profiling and automated decisions.

Blumepay also conducts ongoing risk assessments to detect and safeguard against fraud.

Prevent Fraud: To be able to perform identity verification and fraud risk analysis to enter into and perform our contract with you.

Blumepay also conducts ongoing risk assessments to detect and safeguard against fraud.

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your order for goods/services (from the retailer)

Information about your financial & affordability status (from our existing records and credit reference agencies)

Information about your use of blumepay’s services (from blumepay)

Technical information generated through your use of blumepay’s services (from blumepay)

Device information (from your device)

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your order for goods/services (from the retailer)

Information about your financial & affordability status (from our existing records and credit reference agencies)

Information about your use of blumepay’s services (from blumepay)

Technical information generated through your use of blumepay’s services (from blumepay)

Device information (from your device)

The processing we carry out to verify your identify and confirm the application is not fraudulent is necessary to enter into and perform our contract with you. (Article 6(1)(b) UK GDPR)

The processing we carry out to monitor fraud risk across our customer-base and organisation based on legitimate interests (Article 6(1)(f) UK GDPR).

blumepay has determined that we have a legitimate interest in preventing fraud and to comply with our obligations under applicable laws and regulations. We also consider this use of personal data to be in the interests of customers as it protects them from fraud.

The processing we carry out to verify your identify and confirm the application is not fraudulent is necessary to enter into and perform our contract with you. (Article 6(1)(b) UK GDPR)

The processing we carry out to monitor fraud risk across our customer-base and organisation based on legitimate interests (Article 6(1)(f) UK GDPR).

This processing will take place while you use any blumepay service.

However, if blumepay has identified a potential risk in how you use blumepay, we will continue to use your information for this purpose and continuously update our risk assessment if there is a risk of fraud. We will retain your information for 6 years following termination of your last contract with us.

On termination of each contract you have with us, we will review the personal data we hold and either delete, anonymise or archive data that is no longe required. See section 7 for more information on our obligations and right to retain information according to law.

This processing will take place while you use any blumepay service.

Prevent Money Laundering:

To prevent blumepay’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions.

Blumepay also conducts ongoing risk assessments and implements risk models to counter money laundering and terrorist financing.

This processing constitutes profiling and automated decision making. See section 6 for more information about profiling and automated decisions.

Prevent Money Laundering:

To prevent blumepay’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions.

Blumepay also conducts ongoing risk assessments and implements risk models to counter money laundering and terrorist financing.

This processing constitutes profiling and automated decision making. See section 6 for more information about profiling and automated decisions.

Prevent Money Laundering:

To prevent blumepay’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions.

Blumepay also conducts ongoing risk assessments and implements risk models to counter money laundering and terrorist financing.

This processing constitutes profiling and automated decision making. See section 6 for more information about profiling and automated decisions.

Prevent Money Laundering:

To prevent blumepay’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions.

Blumepay also conducts ongoing risk assessments and implements risk models to counter money laundering and terrorist financing.

This processing constitutes profiling and automated decision making. See section 6 for more information about profiling and automated decisions.

Information about goods/services (retailers)

Information about your financial & affordability status (blumepay and credit reference agencies)

Information about your use of blumepay’s services. (blumepay)

Technical information generated through your use of blumepay’s services. (blumepay)

Device information (Your device)

Information from external sanction lists and PEP lists (Sanction lists and PEP lists)

Sensitive personal data (information about political opinion, religious beliefs and/or health information contained in the PEP lists)

Information about goods/services (retailers)

Information about your financial & affordability status (blumepay and credit reference agencies)

Information about your use of blumepay’s services. (blumepay)

Technical information generated through your use of blumepay’s services. (blumepay)

Device information (Your device)

Information from external sanction lists and PEP lists (Sanction lists and PEP lists)

Sensitive personal data (information about political opinion, religious beliefs and/or health information contained in the PEP lists)

Information about goods/services (retailers)

Information about your financial & affordability status (blumepay and credit reference agencies)

Information about your use of blumepay’s services. (blumepay)

Technical information generated through your use of blumepay’s services. (blumepay)

Device information (Your device)

Information from external sanction lists and PEP lists (Sanction lists and PEP lists)

Sensitive personal data (information about political opinion, religious beliefs and/or health information contained in the PEP lists)

Information about goods/services (retailers)

Information about your financial & affordability status (blumepay and credit reference agencies)

Information about your use of blumepay’s services. (blumepay)

Technical information generated through your use of blumepay’s services. (blumepay)

Device information (Your device)

Information from external sanction lists and PEP lists (Sanction lists and PEP lists)

Sensitive personal data (information about political opinion, religious beliefs and/or health information contained in the PEP lists)

Assess Credit Worthiness & Affordability:

To perform a credit & affordability assessment before credit is granted.

This constitutes profiling and the decision to approve or reject the credit constitutes an “automated decision”. See section 6 for more information about profiling and automated decisions.

Also see section 4 on our use of credit reference agencies to which your information may be shared, and our legal basis for that sharing.

Assess Credit Worthiness & Affordability:

To perform a credit & affordability assessment before credit is granted.

This constitutes profiling and the decision to approve or reject the credit constitutes an “automated decision”. See section 6 for more information about profiling and automated decisions.

Also see section 4 on our use of credit reference agencies to which your information may be shared, and our legal basis for that sharing.

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

We process your personal data to perform credit & affordability assessments to enter into and perform the credit agreement (Article 6(1)(b) UK GDPR).

When the credit assessment is performed.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

When the credit assessment is performed.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

Broker on behalf of Third-party Lenders:

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

We process your personal data with your consent (Article 6(1)(a) UK GDPR)

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

Manage debt & collections: To perform debt collection services, i.e. to collect and sell overdue debts.

Data we collect directly from you:

Contact and identification data

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

Data we collect directly from you:

Contact and identification data

Data we collect from other sources:

Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)

We process your personal data partly to perform our contract with you and also based on legitimate interests (Articles 6(1)(b) and (f) UK GDPR).

Blumepay has determined that we have a legitimate interest in collecting and selling debts. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.

We process your personal data partly to perform our contract with you and also based on legitimate interests (Articles 6(1)(b) and (f) UK GDPR).

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

Manage blumepay’s Credit Risk Appetite & Policies:

monitoring and reviewing our credit risk appetite and performance of our risk policies to ensure we are optimising for responsible lending outcomes, our regulatory obligations, and also our commercial interests

Manage blumepay’s Credit Risk Appetite & Policies:

Data we collect directly from you:

Contact and identification data
Payment information
Information about your financial & affordability status

Data we collect from other sources:

Information about goods/services (retailers)
Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)
Device information (Your device)

Data we collect directly from you:

Contact and identification data
Payment information
Information about your financial & affordability status

Data we collect from other sources:

Information about goods/services (retailers)
Information about your financial & affordability status (blumepay and credit reference agencies)
Information about your use of blumepay’s services. (blumepay)
Technical information generated through your use of blumepay’s services. (blumepay)
Device information (Your device)

We process your personal data based on legitimate interests (Articles 6(1)(f) UK GDPR).

Blumepay has determined that we have a legitimate interest in analysing, monitoring and optimising its credit risk appetite and policies to ensure responsible lending, compliance with regulatory obligations and our commercial interests.

We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.

We process your personal data based on legitimate interests (Articles 6(1)(f) UK GDPR).

We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

Manage & Improve Our Operations & Product Development:

Quality and service improvement (to ensure satisfactory customer service and business operations).

To perform data analysis for product development and testing to improve our risk, fraud and credit models and to design and improve our services (if possible, we first anonymise the data, which means that no personal data processing is performed thereafter).

Manage & Improve Our Operations & Product Development:

Quality and service improvement (to ensure satisfactory customer service and business operations).

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your order for goods/services (from the retailer)
Information about your financial & affordability status
(from our existing records, where relevant, and credit reference agencies)
Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.
Information about your use of blumepay’s services (from blumepay)
Technical information generated through your use of blumepay’s services (from blumepay)
Device information (from your device)

Data we collect directly from you:

Contact and identification data
Information about your financial & affordability status
Payment information

Data we collect from other sources:

Information about your order for goods/services (from the retailer)
Information about your financial & affordability status
(from our existing records, where relevant, and credit reference agencies)
Information about your contact with blumepay’s customer service - Recorded phone calls, chat conversations, email correspondence, feedback and surveys.
Information about your use of blumepay’s services (from blumepay)
Technical information generated through your use of blumepay’s services (from blumepay)
Device information (from your device)

We process your personal data to achieve our legitimate interests of ensuring our customers experience a high standard of service and to optimise our business operations and products to achieve that outcome and support our commercial interests (Article 6(1)(f) GDPR).

When balancing interests, blumepay has determined that we have a legitimate interest in improving our services and products, our internal training and quality control, and our underlying business operations. We ensure that the particular processing this involves is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. As a customer, you also have an interest in the quality of your interactions and experience with blumepay.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

We transcribe all recordings of telephone conversations and delete the recordings within 6 months.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

We transcribe all recordings of telephone conversations and delete the recordings within 6 months.

Market our goods and services:

To perform data analysis to measure and improve our marketing and advertising channels (if possible, we first anonymise the data, which means that no personal data processing is performed thereafter).

To decide what kind of marketing or marketing surveys we will provide to you.

To provide marketing materials, offers and marketing surveys to you about other products and services we offer that are similar to those you have already used and that are part of blumepay’s general consumer offering.

If you do not want us to perform this processing of your data or receive marketing from us, please contact us. We will then cease to use your data for marketing or send you marketing communications. Contact information is available in Section 10.

The processing may constitute profiling. See Section 6 for more information about profiling.

Market our goods and services:

To decide what kind of marketing or marketing surveys we will provide to you.

The processing may constitute profiling. See Section 6 for more information about profiling.

Data we collect directly from you:

Contact and identification data.
Payment information.
Sensitive data that you share with us (for example, data about your health)

Data we collect from other sources:

Information about your order for goods/services (from the retailer)
Information about your financial standing (from our existing records and credit information bureaus)
Information about your use of blumepay’s services. (from blumepay)
Technical information generated through your use of blumepay’s services. (from blumepay)
Device information. (from your device)

Data we collect directly from you:

Contact and identification data.
Payment information.
Sensitive data that you share with us (for example, data about your health)

Data we collect from other sources:

Information about your order for goods/services (from the retailer)
Information about your financial standing (from our existing records and credit information bureaus)
Information about your use of blumepay’s services. (from blumepay)
Technical information generated through your use of blumepay’s services. (from blumepay)
Device information. (from your device)

The processing is based on our legitimate interests of promoting relevant products and services to our customers (Article 6(1)(f) UK GDPR).

When balancing interests, blumepay has determined that we have a legitimate interest in (i) identifying which type of marketing we should provide to you; and (ii) sending you marketing about our services and offers. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. We have also considered the fact that marketing is listed as an example of legitimate interest in the UK GDPR.

Any sensitive data is processed in order for blumepay to establish, exercise or defend legal claims

(Article 9(2)(f)).

The processing is based on our legitimate interests of promoting relevant products and services to our customers (Article 6(1)(f) UK GDPR).

Any sensitive data is processed in order for blumepay to establish, exercise or defend legal claims

(Article 9(2)(f)).

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

We transcribe all recordings of telephone conversations and delete the recordings within 6 months.

We keep your personal data for the duration of your contract with blumepay and for 6 years after termination of your last contract with us.

We transcribe all recordings of telephone conversations and delete the recordings within 6 months.

Manage Regulatory Investigations and Legal Disputes: To protect blumepay from regulatory proceedings, legal claims and safeguard our legal rights.

All data types mentioned in section 2.

In the event of a dispute, blumepay may also collect other types of personal data concerning you if we need them to exercise our rights.

All data types mentioned in section 2.

In the event of a dispute, blumepay may also collect other types of personal data concerning you if we need them to exercise our rights.

The processing is based on a balancing of interests (Article 6(1)(f) UK GDPR). When balancing interests, blumepay has determined that we have a legitimate interest in being able to protect ourselves from legal claims. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.

Sensitive personal data, if necessary to establish, exercise or defend legal claims, is processed based on Article 9(2)(f) GDPR

This processing takes place for the entire period during which blumepay must retain the information in its systems, for example to perform the contract executed with you or to comply with applicable law. See section 7 for more information on our obligations and right to retain information according to law.

Third parties with whom we share your personal data

Whenever we share your personal data with third parties we do so responsibly, in accordance with this Privacy Notice and our obligations under Data Protection Law.

We do not sell your personal data to any third party. We only share your data with selected entities that we contract with for the provision of services, and who will process your data on our behalf following our instructions. We assess all third party suppliers and subcontractors and enter into binding agreements that include all reasonable contractual, legal, technical and organisational measures to ensure that your information is processed with an adequate level of protection and in accordance with Data Protection Law.

Additionally, we may share your data with third parties who act as independent controllers, such as credit reference agencies like Experian, to perform credit, affordability and identity checks. In those cases, we will ensure the data sharing is responsible, meeting our own obligations under Data Protection Law, and enter into binding agreements that include all reasonable contractual, legal, technical and organisational measures to ensure that your information is processed with an adequate level of protection and in accordance with Data Protection Law. In the case of recipients who are independent controllers, the recipient’s privacy notice will explain their use of your personal data and how you can exercise your data rights. Where this applies, we have provided links to the relevant third parties’ privacy notices in the table below.

Third parties with whom we share your personal data

Whenever we share your personal data with third parties we do so responsibly, in accordance with this Privacy Notice and our obligations under Data Protection Law.

Third parties with whom we share your personal data

Whenever we share your personal data with third parties we do so responsibly, in accordance with this Privacy Notice and our obligations under Data Protection Law.

Description and the recipient’s role

Purpose

Categories of recipients
Retailers

Categories of
recipients
Retailers

By retailers, we mean the retailers you purchase goods or services from using the financing secured via blumepay or a third-party lender.

Retailers are independent controllers in relation to your personal data. You should review the retailer’s privacy notice to understand how they use your data and how to exercise your rights.

For the retailer to be able to perform and manage your purchase and your relationship with them, we share data relating to your application and the status of your account.

Other Lenders

These are third party lenders who are not part of Blumepay or the blumepay Group of companies.

Third party lenders are independent controllers in relation to your personal data. You should review their privacy notice to understand how they use your data and how to exercise your rights.

lumepay will share certain data about you and your application with other third-party lenders so they can consider your application and decide whether to provide you with the financial product or service you are seeking.

We will only ever share your data with other lenders with your prior consent.

Blumepay will share certain data about you and your application with other third-party lenders so they can consider your application and decide whether to provide you with the financial product or service you are seeking.

We will only ever share your data with other lenders with your prior consent.

Suppliers & subcontractors

Suppliers and subcontractors are companies that only have the right to process the personal data they receive from us on behalf of blumepay, i.e. data processors. Examples of such suppliers and subcontractors are software and data storage providers, payment service providers, and blumepay Group companies.

Blumepay needs access to services and functionality from other companies and some of these services require us to share certain personal data. These services include customer support, billings and collections.

Payment service providers, card
networks and financial institutions

Payment service providers to implement, facilitate and administer electronic payments through a variety of payment methods, such as credit cards and bank-based payment methods (e.g. direct debit and bank transfer).

Our payment service provider is Modulr. Modulr is our data processor. You can find their privacy notice.

Payment service providers receive your information from blumepay, or collect and use your information independently, in accordance with their own privacy notices or to prevent fraud.

In addition, blumepay may share your information with your card network and with other financial institutions that blumepay rely on when managing your payment method or conducting transactions with your account to complete the transactions, to prevent fraud or money laundering. Sharing with payment service providers, card networks and financial institutions is performed to enable a payment method or to conduct transactions initiated by you and to prevent fraud or abusive activities.

Fraud prevention agencies, companies providing identity checks, and law enforcement agencies

Your personal data are shared with fraud prevention agencies and companies that provide identity checks.

We work with Sumsub who acts as our data processor processing your personal data on our instructions, but additionally, they further process your data as independent controllers in accordance with their own privacy notice

We also use Experian to share information with us to help us prevent fraud. Experian acts as an independent controller and their use of personal data is set out in their own privacy notice.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details in Section 10 below.

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

Blumepay shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent and abusive activities.

Credit reference agencies & Credit Reference Agency Information Notice (CRAIN) Credit Reference Agency Information Notice (CRAIN) | Experian

To process your application, we will perform credit and identity checks with Experian which is a credit reference agency (CRA) and may request your consent to obtain financial information through Open Banking providers. This means we will share your personal information with CRAs, who will act as independent controllers. They will provide us with information about your credit application, financial situation, and financial history. This includes public information (such as the electoral register) and shared credit data, as well as fraud prevention information.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs. 

When CRAs receive a search from us they will place a footprint on your credit file. If this is a loan application search then it will be seen by other lenders; otherwise, it won’t.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in their own privacy notice.

Your personal information is shared with credit bureaus in order to assess your creditworthiness, affordability status, to confirm your identity and your contact information, and to protect you and other customers from fraud. This data sharing constitutes a credit report.

Debt collection companies (for debts that are overdue).

Blumepay may need to share your information when we sell or outsource collection of unpaid overdue debts through a third party, such as a debt collection company.

Debt collection companies process personal data in accordance with their own privacy notices, or only on behalf of blumepay in their capacity as our processors.

Debt collection companies may report your unpaid debts to credit reference agencies or authorities, which may affect your creditworthiness and your ability to apply for future credit.

This data is shared to collect your overdue debts.

Logistics and transport companies

Logistics and transport companies process your data in accordance with their own privacy notices.

Blumepay will share your personal data with logistics and transport companies that deliver the goods you order.

A person who holds a power of attorney for your financial affairs or other authorised users on your account

Blumepay may share your personal information with a person who has the right to access it under a power of attorney; or in the event that any additional authorised users are added to your account, we may share information about the use of the account by any authorised user with all other authorised users.

This processing is carried out to facilitate your contact with us (through agents).

Other banks & third parties

Other banks and third parties where required by law to help recover funds that have entered your account as a result of a misdirected payment by such a third party; or other banks to help trace funds where you are a victim of suspected financial crime and you have agreed for us to do so, or where we suspect funds have entered your account because of a financial crime; our insurers, and other professional advisers.

To manage incidences of fraud, financial crime or admin errors.

Authorities

Blumepay may provide necessary information to authorities such as the police, the Financial Conduct Authority, Financial Ombudsman Service, Joint Money Laundering Steering Group (JMLSG), tax authorities or other authorities and courts of law.

Personal data is shared with the authority when we are required by law to do so, or in some cases, if you have asked us to do so, or if required to manage tax deductions or counter crime.

Divestment of business or assets

In the event that blumepay sells business or assets, blumepay may hand over your personal information to a potential buyer of such business or assets. If blumepay or a significant part of blumepay’s assets is acquired by a third party, personal information about blumepay’s customers may also be shared

Personal data is shared with the authority when we are required by law to do so, or in some cases, if you have asked us to do so, or if required to manage tax deductions or counter crime.

How do we protect your data when we transfer it outside of the UK and EEA?

Wherever possible, we keep the processing of your personal data to the UK or European Economic Area (“EEA”). However, in certain situations, such as when we share your information with a supplier or subcontractor, your personal data may be transferred outside the UK/EEA. Blumepay always ensures that the same high level of protection applies to your personal data according to the UK GDPR, even when the data is transferred outside of the UK/EEA. Your rights in relation to your personal data (described in Section 2), are not affected when data is transferred outside of the UK/EEA.

Measures which blumepay uses when transferring personal data outside of the UK/EEA

Countries outside of the UK/EEA may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the UK GDPR). Such appropriate safeguards include, but are not limited to, ensuring:

if the European Commission or UK authority has decided that the country outside of the UK/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. This means for example that the personal data is still protected from unauthorised disclosure, and that you may still exercise your rights in relation to your personal data, or

the European Commission’s standard clauses (with required UK addendums) have been entered into between blumepay and the recipient of the personal data outside the UK/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affects the protection of your personal data. Where necessary, we take technical and organisational measures so that your data remain protected during the transfer to the relevant country outside the UK/EEA, or

that the transfer is covered by the EU-US Data Privacy Framework, with the UK extension. This is an opt-in certification scheme for US companies, administered by the US Department of Commerce. This Privacy Framework includes a set of enforceable principles and requirements that must be certified to by the US company, ensuring that your data is still being sufficiently protected.

How we use Profiling and Automated Decision Making

Profiling that does not have a legal or similarly significant effect on you

“Profiling” means any automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences such as buying interests, or analysing your financial information.

The purpose of profiling and the personal data types used are described in detail in section 3 above. The profiling for these purposes does not have a significant impact on you as a customer.

We use profiling for the following purposes:

to assess credit and hire applications for affordability and suitability - this helps us determine whether you can afford the product or service you are applying for

to help manage your account by predicting your needs and preferences, ensuring that we provide you with the most relevant services

to deliver customised marketing to you across both our own and external platforms and services ensuring that you receive relevant offers and promotions

Automated Decision Making with legal or significant effect on you (ADM)

Certain decisions in our services are completely automated, without a human being involved, and the decisions made have a legal or similarly significant effect on you. By making such decisions automatically, blumepay increases its objectivity, consistency and transparency in the decision to offer you these services. At the same time, you have the right to object to these decisions. You can read about how to object to these decisions at the end of this section 6. When doing these assessments we utilise machine learning models and artificial intelligence models in order to ensure as high quality as possible in our decisions.

In the process of these automated decisions that significantly affect you, profiling is performed based on your data. This profiling is made to assess your financial situation (before the decision to offer or grant credit, or initiate a payment), to identify whether your use of our services involves a risk of fraud or money laundering or to decide whether you are liable for a purchase. We profile your user behaviour and financial standing and compare this data with behaviours and conditions that indicate different risk levels for us.

The different user behaviour and conditions are evaluated and weighted into our automated decision-models, so that we end up with a totalling score, which then results in either accepting or rejecting your use of our Services. We can also choose to request further identification from you, if we are not sure who you are.

We make this kind of automated decision when we:

decide to approve your application, or to offer you, to use a credit service.

decide not to approve your application, or not to offer you, to use a credit service.

These automated credit decisions are based on the data you provide to us, data from external sources such as credit reference agencies, and blumepay’s own internal information about you if we have an existing relationship with you. In addition to information about you, blumepay’s credit model includes a large number of other factors, such as blumepay’s internal credit risk levels and our customers’ general repayment rates.

decide whether you pose a risk of fraud, if our processing shows that your behaviour indicates possible fraudulent conduct, that your behaviour is not consistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions whereby we assess whether you constitute a fraud risk are based on information you have provided yourself, data from fraud prevention agencies (see section 4 for details of which ones we use), and blumepay’s own internal information. Blumepay continuously develops our fraud models to keep our services secure, and closely investigate how fraudsters operate on different markets.

decide whether there is a risk of money laundering, if our processing shows that your behaviour indicates money laundering. In relevant cases, blumepay also investigates whether specific customers are listed on sanction lists.

decide whether you are liable for a purchase that you have disputed as “unauthorised” based on whether the information you provide, or we have about the purchase, point towards potential fraudulent behaviour or not. This by comparing what has happened in your case to other transactions indicating fraudulent behaviour.

If you are not approved under the automated decisions described above, you will not have access to, or will not be able to use blumepay’s services. Blumepay has several safety mechanisms to ensure the decisions are appropriate and fair. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can always contact us, and we will determine whether the procedure was performed appropriately. You can also object in accordance with the following instructions.

You always have the right to object to an automated decision with legal consequences or decisions which can otherwise significantly affect you (together with the relevant profiling) by sending an e-mail message to blumepaylegal@libertyglobal.com. A blumepay employee will then review the decision, taking into account any additional information and circumstances that you provide to us.

How long do we keep your personal data?

How long blumepay stores your personal data depends on the purposes for which blumepay uses the personal data. See the table in Section 3 for detailed information about how long we keep your data for in relation to each purpose.

Personal data used for the contractual relationship between you and blumepay is generally stored for the duration of the contractual relationship and thereafter for a maximum of up to 6 years based on statutes of limitations rules. However, on termination of your contract with us, we undertake reviews of the data we hold and, in accordance with our retention policies, delete, mask, anonymise or archive relevant personal data so that you can be assured we only retain data that is justified.

Personal data that blumepay is under a legal obligation to retain, for example under anti-money laundering laws, is generally retained for 6 years.

We process the recordings of telephone conversations for a time period of at least 6 months for quality assurance purposes. All recordings are transcribed and the recordings are then deleted.

Personal data which is not used for the purposes of your contractual relationship with blumepay or where blumepay does not have a legal obligation to retain the data is only retained as long as necessary to fulfil the respective purpose for our data processing.

Your rights in relation to your data and how to exercise them.

You have several rights under the UK GDPR related to you having control of your personal data and to receive information directly from us on how we process personal data about you. In the following you can read about your rights. To exercise any of your rights, you can email us at blumepaylegal@libertyglobal.com. Please include your telephone number and if applicable your Account/Agreement number (on your statement) on any correspondence and we’ll contact you by phone to verify your identify and go through the details of your request.

Your rights

Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you.

Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, and by answering your questions.

Right to receive access to your personal data (“Data Subject access”). You have the right to know if blumepay processes personal data about you, and to receive a copy of such data, known as data subject access. Your right of access may be limited in some cases by laws and regulations. This is the case with regulation relating to anti-money laundering and countering the financing of terrorism, which prohibits us from giving you direct access to your personal data processed for this purpose.

Right to access, and request a transfer, of your personal data to another recipient (“Data portability”). This right means that you can request a copy of the personal data relating to you that blumepay holds for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use this data somewhere else, for example to transfer your personal data to another controller/recipient.

Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.

Right to restrict processing. If you believe that your personal data is inaccurate, that our processing is unlawful or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. You also have the possibility to request that we stop processing your personal data while we assess your request. If you object to our processing per your right described directly below, you may also request us to restrict processing of that personal data while we make our assessment.

Right to object against our processing of your personal data. You have the right to object to processing of your personal data which is based on our legitimate interest (Article 6(1)(f) UK GDPR), by referencing your personal circumstances. You can also always object to our use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will turn off marketing for you, and stop sending it to you.

Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by blumepay if the decision produces legal effects or significantly affects you in a similar way. See Section 6 on how blumepay makes use of automated decisions.

Right to withdraw your consent. Where we process your personal data based on your consent or explicit consent, you have the right to revoke that consent at any time. When you revoke your consent we will stop processing your data for such purposes. To revoke your consent, email us at blumepaylegal@libertyglobal.com

Right to lodge a complaint. If you have complaints about blumepay’s processing of your personal data, you may lodge a complaint with (the Information Commissioner’s office (the UK’s data protection authority), which can be reached using this link: https://ico.org.uk/.

How we use cookies and other types of tracking technology

Please visit our Cookies Notice for information about how we use cookies and other tracking technologies in the provision of our services. [xxx].

Do you want to contact us?

The Company processing your data is Liberty Global Financial Solutions Ltd (trading as ‘blumepay’), with registered company address: 

120 King’s Road, London, SW3 4TR, United Kingdom.

You can contact our Data Protection Officer by writing to the following address:

blumepay Data Protection Officer
120 Kings Road
London
SW3 4TR

If you are unhappy with how we have used your personal information, you can contact us via email.
blumepaylegal@libertyglobal.com

Updates to our Privacy Statement

We may make changes to this Privacy Notice, to adjust it to new services and market updates. In that case, we will publish any new version of this Privacy Notice on our website.

How do we protect your data when we transfer it outside of the UK and EEA?

Wherever possible, we keep the processing of your personal data to the UK or European Economic Area (“EEA”). However, in certain situations, such as when we share your information with a supplier or subcontractor, your personal data may be transferred outside the UK/EEA. Blumepay always ensures that the same high level of protection applies to your personal data according to the UK GDPR, even when the data is transferred outside of the UK/EEA. Your rights in relation to your personal data (described in Section 2), are not affected when data is transferred outside of the UK/EEA.

Measures which blumepay uses when transferring personal data outside of the UK/EEA

Countries outside of the UK/EEA may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the UK GDPR). Such appropriate safeguards include, but are not limited to, ensuring:

if the European Commission or UK authority has decided that the country outside of the UK/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. This means for example that the personal data is still protected from unauthorised disclosure, and that you may still exercise your rights in relation to your personal data, or

the European Commission’s standard clauses (with required UK addendums) have been entered into between blumepay and the recipient of the personal data outside the UK/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affects the protection of your personal data. Where necessary, we take technical and organisational measures so that your data remain protected during the transfer to the relevant country outside the UK/EEA, or

that the transfer is covered by the EU-US Data Privacy Framework, with the UK extension. This is an opt-in certification scheme for US companies, administered by the US Department of Commerce. This Privacy Framework includes a set of enforceable principles and requirements that must be certified to by the US company, ensuring that your data is still being sufficiently protected.

How we use Profiling and Automated Decision Making

Profiling that does not have a legal or similarly significant effect on you

“Profiling” means any automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences such as buying interests, or analysing your financial information.

The purpose of profiling and the personal data types used are described in detail in section 3 above. The profiling for these purposes does not have a significant impact on you as a customer.

We use profiling for the following purposes:

to assess credit and hire applications for affordability and suitability - this helps us determine whether you can afford the product or service you are applying for

to help manage your account by predicting your needs and preferences, ensuring that we provide you with the most relevant services

to deliver customised marketing to you across both our own and external platforms and services ensuring that you receive relevant offers and promotions

Automated Decision Making with legal or significant effect on you (ADM)

Certain decisions in our services are completely automated, without a human being involved, and the decisions made have a legal or similarly significant effect on you. By making such decisions automatically, blumepay increases its objectivity, consistency and transparency in the decision to offer you these services. At the same time, you have the right to object to these decisions. You can read about how to object to these decisions at the end of this section 6. When doing these assessments we utilise machine learning models and artificial intelligence models in order to ensure as high quality as possible in our decisions.

In the process of these automated decisions that significantly affect you, profiling is performed based on your data. This profiling is made to assess your financial situation (before the decision to offer or grant credit, or initiate a payment), to identify whether your use of our services involves a risk of fraud or money laundering or to decide whether you are liable for a purchase. We profile your user behaviour and financial standing and compare this data with behaviours and conditions that indicate different risk levels for us.

The different user behaviour and conditions are evaluated and weighted into our automated decision-models, so that we end up with a totalling score, which then results in either accepting or rejecting your use of our Services. We can also choose to request further identification from you, if we are not sure who you are.

We make this kind of automated decision when we:

decide to approve your application, or to offer you, to use a credit service.

decide not to approve your application, or not to offer you, to use a credit service.

These automated credit decisions are based on the data you provide to us, data from external sources such as credit reference agencies, and blumepay’s own internal information about you if we have an existing relationship with you. In addition to information about you, blumepay’s credit model includes a large number of other factors, such as blumepay’s internal credit risk levels and our customers’ general repayment rates.

decide whether you pose a risk of fraud, if our processing shows that your behaviour indicates possible fraudulent conduct, that your behaviour is not consistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions whereby we assess whether you constitute a fraud risk are based on information you have provided yourself, data from fraud prevention agencies (see section 4 for details of which ones we use), and blumepay’s own internal information. Blumepay continuously develops our fraud models to keep our services secure, and closely investigate how fraudsters operate on different markets.

decide whether there is a risk of money laundering, if our processing shows that your behaviour indicates money laundering. In relevant cases, blumepay also investigates whether specific customers are listed on sanction lists.

decide whether you are liable for a purchase that you have disputed as “unauthorised” based on whether the information you provide, or we have about the purchase, point towards potential fraudulent behaviour or not. This by comparing what has happened in your case to other transactions indicating fraudulent behaviour.

If you are not approved under the automated decisions described above, you will not have access to, or will not be able to use blumepay’s services. Blumepay has several safety mechanisms to ensure the decisions are appropriate and fair. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can always contact us, and we will determine whether the procedure was performed appropriately. You can also object in accordance with the following instructions.

You always have the right to object to an automated decision with legal consequences or decisions which can otherwise significantly affect you (together with the relevant profiling) by sending an e-mail message to blumepaylegal@libertyglobal.com. A blumepay employee will then review the decision, taking into account any additional information and circumstances that you provide to us.

How long do we keep your personal data?

How long blumepay stores your personal data depends on the purposes for which blumepay uses the personal data. See the table in Section 3 for detailed information about how long we keep your data for in relation to each purpose.

Personal data used for the contractual relationship between you and blumepay is generally stored for the duration of the contractual relationship and thereafter for a maximum of up to 6 years based on statutes of limitations rules. However, on termination of your contract with us, we undertake reviews of the data we hold and, in accordance with our retention policies, delete, mask, anonymise or archive relevant personal data so that you can be assured we only retain data that is justified.

Personal data that blumepay is under a legal obligation to retain, for example under anti-money laundering laws, is generally retained for 6 years.

We process the recordings of telephone conversations for a time period of at least 6 months for quality assurance purposes. All recordings are transcribed and the recordings are then deleted.

Personal data which is not used for the purposes of your contractual relationship with blumepay or where blumepay does not have a legal obligation to retain the data is only retained as long as necessary to fulfil the respective purpose for our data processing.

Your rights in relation to your data and how to exercise them.

You have several rights under the UK GDPR related to you having control of your personal data and to receive information directly from us on how we process personal data about you. In the following you can read about your rights. To exercise any of your rights, you can email us at blumepaylegal@libertyglobal.com. Please include your telephone number and if applicable your Account/Agreement number (on your statement) on any correspondence and we’ll contact you by phone to verify your identify and go through the details of your request.

Your rights

Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you.

Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, and by answering your questions.

Right to receive access to your personal data (“Data Subject access”). You have the right to know if blumepay processes personal data about you, and to receive a copy of such data, known as data subject access. Your right of access may be limited in some cases by laws and regulations. This is the case with regulation relating to anti-money laundering and countering the financing of terrorism, which prohibits us from giving you direct access to your personal data processed for this purpose.

Right to access, and request a transfer, of your personal data to another recipient (“Data portability”). This right means that you can request a copy of the personal data relating to you that blumepay holds for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use this data somewhere else, for example to transfer your personal data to another controller/recipient.

Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.

Right to restrict processing. If you believe that your personal data is inaccurate, that our processing is unlawful or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. You also have the possibility to request that we stop processing your personal data while we assess your request. If you object to our processing per your right described directly below, you may also request us to restrict processing of that personal data while we make our assessment.

Right to object against our processing of your personal data. You have the right to object to processing of your personal data which is based on our legitimate interest (Article 6(1)(f) UK GDPR), by referencing your personal circumstances. You can also always object to our use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will turn off marketing for you, and stop sending it to you.

Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by blumepay if the decision produces legal effects or significantly affects you in a similar way. See Section 6 on how blumepay makes use of automated decisions.

Right to withdraw your consent. Where we process your personal data based on your consent or explicit consent, you have the right to revoke that consent at any time. When you revoke your consent we will stop processing your data for such purposes. To revoke your consent, email us at blumepaylegal@libertyglobal.com

Right to lodge a complaint. If you have complaints about blumepay’s processing of your personal data, you may lodge a complaint with (the Information Commissioner’s office (the UK’s data protection authority), which can be reached using this link: https://ico.org.uk/.

How we use cookies and other types of tracking technology

Please visit our Cookies Notice for information about how we use cookies and other tracking technologies in the provision of our services. [xxx].

Do you want to contact us?

The Company processing your data is Liberty Global Financial Solutions Ltd (trading as ‘blumepay’), with registered company address: 

120 King’s Road, London, SW3 4TR, United Kingdom.

You can contact our Data Protection Officer by writing to the following address:

blumepay Data Protection Officer
120 Kings Road
London
SW3 4TR

If you are unhappy with how we have used your personal information, you can contact us via email.
blumepaylegal@libertyglobal.com

Updates to our Privacy Statement

We may make changes to this Privacy Notice, to adjust it to new services and market updates. In that case, we will publish any new version of this Privacy Notice on our website.

How do we protect your data when we transfer it outside of the UK and EEA?

Wherever possible, we keep the processing of your personal data to the UK or European Economic Area (“EEA”). However, in certain situations, such as when we share your information with a supplier or subcontractor, your personal data may be transferred outside the UK/EEA. Blumepay always ensures that the same high level of protection applies to your personal data according to the UK GDPR, even when the data is transferred outside of the UK/EEA. Your rights in relation to your personal data (described in Section 2), are not affected when data is transferred outside of the UK/EEA.

Measures which blumepay uses when transferring personal data outside of the UK/EEA

Countries outside of the UK/EEA may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the UK GDPR). Such appropriate safeguards include, but are not limited to, ensuring:

if the European Commission or UK authority has decided that the country outside of the UK/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. This means for example that the personal data is still protected from unauthorised disclosure, and that you may still exercise your rights in relation to your personal data, or

the European Commission’s standard clauses (with required UK addendums) have been entered into between blumepay and the recipient of the personal data outside the UK/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affects the protection of your personal data. Where necessary, we take technical and organisational measures so that your data remain protected during the transfer to the relevant country outside the UK/EEA, or

that the transfer is covered by the EU-US Data Privacy Framework, with the UK extension. This is an opt-in certification scheme for US companies, administered by the US Department of Commerce. This Privacy Framework includes a set of enforceable principles and requirements that must be certified to by the US company, ensuring that your data is still being sufficiently protected.

How we use Profiling and Automated Decision Making

Profiling that does not have a legal or similarly significant effect on you

“Profiling” means any automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences such as buying interests, or analysing your financial information.

The purpose of profiling and the personal data types used are described in detail in section 3 above. The profiling for these purposes does not have a significant impact on you as a customer.

We use profiling for the following purposes:

to assess credit and hire applications for affordability and suitability - this helps us determine whether you can afford the product or service you are applying for

to help manage your account by predicting your needs and preferences, ensuring that we provide you with the most relevant services

to deliver customised marketing to you across both our own and external platforms and services ensuring that you receive relevant offers and promotions

Automated Decision Making with legal or significant effect on you (ADM)

Certain decisions in our services are completely automated, without a human being involved, and the decisions made have a legal or similarly significant effect on you. By making such decisions automatically, blumepay increases its objectivity, consistency and transparency in the decision to offer you these services. At the same time, you have the right to object to these decisions. You can read about how to object to these decisions at the end of this section 6. When doing these assessments we utilise machine learning models and artificial intelligence models in order to ensure as high quality as possible in our decisions.

In the process of these automated decisions that significantly affect you, profiling is performed based on your data. This profiling is made to assess your financial situation (before the decision to offer or grant credit, or initiate a payment), to identify whether your use of our services involves a risk of fraud or money laundering or to decide whether you are liable for a purchase. We profile your user behaviour and financial standing and compare this data with behaviours and conditions that indicate different risk levels for us.

The different user behaviour and conditions are evaluated and weighted into our automated decision-models, so that we end up with a totalling score, which then results in either accepting or rejecting your use of our Services. We can also choose to request further identification from you, if we are not sure who you are.

We make this kind of automated decision when we:

decide to approve your application, or to offer you, to use a credit service.

decide not to approve your application, or not to offer you, to use a credit service.

These automated credit decisions are based on the data you provide to us, data from external sources such as credit reference agencies, and blumepay’s own internal information about you if we have an existing relationship with you. In addition to information about you, blumepay’s credit model includes a large number of other factors, such as blumepay’s internal credit risk levels and our customers’ general repayment rates.

decide whether you pose a risk of fraud, if our processing shows that your behaviour indicates possible fraudulent conduct, that your behaviour is not consistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions whereby we assess whether you constitute a fraud risk are based on information you have provided yourself, data from fraud prevention agencies (see section 4 for details of which ones we use), and blumepay’s own internal information. Blumepay continuously develops our fraud models to keep our services secure, and closely investigate how fraudsters operate on different markets.

decide whether there is a risk of money laundering, if our processing shows that your behaviour indicates money laundering. In relevant cases, blumepay also investigates whether specific customers are listed on sanction lists.

decide whether you are liable for a purchase that you have disputed as “unauthorised” based on whether the information you provide, or we have about the purchase, point towards potential fraudulent behaviour or not. This by comparing what has happened in your case to other transactions indicating fraudulent behaviour.

If you are not approved under the automated decisions described above, you will not have access to, or will not be able to use blumepay’s services. Blumepay has several safety mechanisms to ensure the decisions are appropriate and fair. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can always contact us, and we will determine whether the procedure was performed appropriately. You can also object in accordance with the following instructions.

You always have the right to object to an automated decision with legal consequences or decisions which can otherwise significantly affect you (together with the relevant profiling) by sending an e-mail message to blumepaylegal@libertyglobal.com. A blumepay employee will then review the decision, taking into account any additional information and circumstances that you provide to us.

How long do we keep your personal data?

How long blumepay stores your personal data depends on the purposes for which blumepay uses the personal data. See the table in Section 3 for detailed information about how long we keep your data for in relation to each purpose.

Personal data used for the contractual relationship between you and blumepay is generally stored for the duration of the contractual relationship and thereafter for a maximum of up to 6 years based on statutes of limitations rules. However, on termination of your contract with us, we undertake reviews of the data we hold and, in accordance with our retention policies, delete, mask, anonymise or archive relevant personal data so that you can be assured we only retain data that is justified.

Personal data that blumepay is under a legal obligation to retain, for example under anti-money laundering laws, is generally retained for 6 years.

We process the recordings of telephone conversations for a time period of at least 6 months for quality assurance purposes. All recordings are transcribed and the recordings are then deleted.

Personal data which is not used for the purposes of your contractual relationship with blumepay or where blumepay does not have a legal obligation to retain the data is only retained as long as necessary to fulfil the respective purpose for our data processing.

Your rights in relation to your data and how to exercise them.

You have several rights under the UK GDPR related to you having control of your personal data and to receive information directly from us on how we process personal data about you. In the following you can read about your rights. To exercise any of your rights, you can email us at blumepaylegal@libertyglobal.com. Please include your telephone number and if applicable your Account/Agreement number (on your statement) on any correspondence and we’ll contact you by phone to verify your identify and go through the details of your request.

Your rights

Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you.

Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, and by answering your questions.

Right to receive access to your personal data (“Data Subject access”). You have the right to know if blumepay processes personal data about you, and to receive a copy of such data, known as data subject access. Your right of access may be limited in some cases by laws and regulations. This is the case with regulation relating to anti-money laundering and countering the financing of terrorism, which prohibits us from giving you direct access to your personal data processed for this purpose.

Right to access, and request a transfer, of your personal data to another recipient (“Data portability”). This right means that you can request a copy of the personal data relating to you that blumepay holds for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use this data somewhere else, for example to transfer your personal data to another controller/recipient.

Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.

Right to restrict processing. If you believe that your personal data is inaccurate, that our processing is unlawful or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. You also have the possibility to request that we stop processing your personal data while we assess your request. If you object to our processing per your right described directly below, you may also request us to restrict processing of that personal data while we make our assessment.

Right to object against our processing of your personal data. You have the right to object to processing of your personal data which is based on our legitimate interest (Article 6(1)(f) UK GDPR), by referencing your personal circumstances. You can also always object to our use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will turn off marketing for you, and stop sending it to you.

Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by blumepay if the decision produces legal effects or significantly affects you in a similar way. See Section 6 on how blumepay makes use of automated decisions.

Right to withdraw your consent. Where we process your personal data based on your consent or explicit consent, you have the right to revoke that consent at any time. When you revoke your consent we will stop processing your data for such purposes. To revoke your consent, email us at blumepaylegal@libertyglobal.com

Right to lodge a complaint. If you have complaints about blumepay’s processing of your personal data, you may lodge a complaint with (the Information Commissioner’s office (the UK’s data protection authority), which can be reached using this link: https://ico.org.uk/.

How we use cookies and other types of tracking technology

Please visit our Cookies Notice for information about how we use cookies and other tracking technologies in the provision of our services. [xxx].

Do you want to contact us?

The Company processing your data is Liberty Global Financial Solutions Ltd (trading as ‘blumepay’), with registered company address: 

120 King’s Road, London, SW3 4TR, United Kingdom.

You can contact our Data Protection Officer by writing to the following address:

blumepay Data Protection Officer
120 Kings Road
London
SW3 4TR

If you are unhappy with how we have used your personal information, you can contact us via email.

blumepaylegal@libertyglobal.com

11. Updates to our Privacy Statement

We may make changes to this Privacy Notice, to adjust it to new services and market updates. In that case, we will publish any new version of this Privacy Notice on our website.

Join blumepay's exclusive partner program and boost conversions, increase deal sizes, and stand out with digital-first solar financing.

Quick Links

120 King's Road, London, SW3 4TR

0100 4793 0741

support@blumepay.com

Cookie Policy

Liberty Blume Financial Solutions Limited, t/a blumepay, is authorised and regulated by the Financial Conduct Authority (FRN 1023392). Loans and Contract Hire products are only available to UK residents aged 18+, subject to status. Terms and conditions apply.

Blumepay acts as a lender and a broker in respect of Consumer Credit and a lessor in respect of Consumer Hire. If you choose a contract hire product, you will never own the equipment and it must be returned to us at the end of your contract. Return conditions and charges may apply. In limited circumstances, we may act as a credit broker, not a lender, and we may introduce you to a limited number of finance providers. We will not charge you a fee for the introduction we make however, we may receive a commission in the form of a payment or other remuneration from the lender we introduce you to. The commission or remuneration we receive will not impact the amount you pay under the finance agreement. If you would like to know more, please ask us or the lender we introduce you to.

Registered address: 120 King's Road, London, SW3 4TR. Company number 14555573. VAT Number 470498467.

For any questions or queries please contact us on: 0100 4793 0741 or email us at: blumepaycare@libertyglobal.com

Join blumepay's exclusive partner program and boost conversions, increase deal sizes, and stand out with digital-first solar financing.

Quick Links

120 King's Road, London, SW3 4TR

0100 4793 0741

support@blumepay.com

Cookie Policy

Registered address: 120 King's Road, London, SW3 4TR. Company number 14555573. VAT Number 470498467.

For any questions or queries please contact us on: 0100 4793 0741 or email us at: blumepaycare@libertyglobal.com

Join blumepay's exclusive partner program and boost conversions, increase deal sizes, and stand out with digital-first solar financing.

Quick Links

120 King's Road, London, SW3 4TR

0100 4793 0741

support@blumepay.com

Cookie Policy

Registered address: 120 King's Road, London, SW3 4TR. Company number 14555573. VAT Number 470498467.

For any questions or queries please contact us on: 0100 4793 0741 or email us at: blumepaycare@libertyglobal.com

Who we are and our role in relation to your data

Who we are and our role in relation to your data

Who we are and our role in relation to your data

The types of personal data we use

The types of personal data we use

The types of personal data we use

The purposes and legal bases for our use of your personal data

The purposes and legal bases for our use of your personal data

The purposes and legal bases for our use of your personal data

Purpose – why we process your personal data

Purpose – why we process your personal data

Type of personal data processed and where we obtain it from

Type of personal data processed and where we obtain it from

Legal basis under the UK GDPR

Legal basis under the UK GDPR

How long we keep your personal data for

How long we keep your personal data for

Third parties with whom we share your personal data

Third parties with whom we share your personal data

Third parties with whom we share your personal data

Description and the recipient’s role

Description and the recipient’s role

Purpose

Purpose

Categories of recipients Retailers

Categories of recipients Retailers

Other Lenders

Other Lenders

Suppliers & subcontractors

Suppliers & subcontractors

Payment service providers, card networks and financial institutions

Payment service providers, card networks and financial institutions

Fraud prevention agencies, companies providing identity checks, and law enforcement agencies

Fraud prevention agencies, companies providing identity checks, and law enforcement agencies

Credit reference agencies & Credit Reference Agency Information Notice (CRAIN) Credit Reference Agency Information Notice (CRAIN) | Experian

Credit reference agencies & Credit Reference Agency Information Notice (CRAIN) Credit Reference Agency Information Notice (CRAIN) | Experian

Debt collection companies (for debts that are overdue).

Debt collection companies (for debts that are overdue).

Logistics and transport companies

Logistics and transport companies

A person who holds a power of attorney for your financial affairs or other authorised users on your account

A person who holds a power of attorney for your financial affairs or other authorised users on your account

Other banks & third parties

Other banks & third parties

Authorities

Authorities

Divestment of business or assets

Divestment of business or assets

How do we protect your data when we transfer it outside of the UK and EEA?

Measures which blumepay uses when transferring personal data outside of the UK/EEA

How we use Profiling and Automated Decision Making

Profiling that does not have a legal or similarly significant effect on you

“Profiling” means any automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences such as buying interests, or analysing your financial information.

The purpose of profiling and the personal data types used are described in detail in section 3 above. The profiling for these purposes does not have a significant impact on you as a customer.

We use profiling for the following purposes:

to assess credit and hire applications for affordability and suitability - this helps us determine whether you can afford the product or service you are applying for

to help manage your account by predicting your needs and preferences, ensuring that we provide you with the most relevant services

to deliver customised marketing to you across both our own and external platforms and services ensuring that you receive relevant offers and promotions

Automated Decision Making with legal or significant effect on you (ADM)

We make this kind of automated decision when we:

decide to approve your application, or to offer you, to use a credit service.

decide not to approve your application, or not to offer you, to use a credit service.

decide whether there is a risk of money laundering, if our processing shows that your behaviour indicates money laundering. In relevant cases, blumepay also investigates whether specific customers are listed on sanction lists.

How long do we keep your personal data?

How long blumepay stores your personal data depends on the purposes for which blumepay uses the personal data. See the table in Section 3 for detailed information about how long we keep your data for in relation to each purpose.

Personal data that blumepay is under a legal obligation to retain, for example under anti-money laundering laws, is generally retained for 6 years.

We process the recordings of telephone conversations for a time period of at least 6 months for quality assurance purposes. All recordings are transcribed and the recordings are then deleted.

Personal data which is not used for the purposes of your contractual relationship with blumepay or where blumepay does not have a legal obligation to retain the data is only retained as long as necessary to fulfil the respective purpose for our data processing.

Your rights in relation to your data and how to exercise them.

Your rights

Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you.

Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, and by answering your questions.

Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.

Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by blumepay if the decision produces legal effects or significantly affects you in a similar way. See Section 6 on how blumepay makes use of automated decisions.

Right to lodge a complaint. If you have complaints about blumepay’s processing of your personal data, you may lodge a complaint with (the Information Commissioner’s office (the UK’s data protection authority), which can be reached using this link: https://ico.org.uk/.

How we use cookies and other types of tracking technology

Please visit our Cookies Notice for information about how we use cookies and other tracking technologies in the provision of our services. [xxx].

Legal basis under the
UK GDPR

Legal basis under the
UK GDPR

How long we keep your
personal data for

How long we keep your
personal data for

Categories of recipients
Retailers

Categories of
recipients
Retailers

Payment service providers, card
networks and financial institutions

Payment service providers, card
networks and financial institutions

Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you.

Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, and by answering your questions.

Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.

Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by blumepay if the decision produces legal effects or significantly affects you in a similar way. See Section 6 on how blumepay makes use of automated decisions.

Right to lodge a complaint. If you have complaints about blumepay’s processing of your personal data, you may lodge a complaint with (the Information Commissioner’s office (the UK’s data protection authority), which can be reached using this link: https://ico.org.uk/.