Data Privacy Notice
-Effective from 30.07.25

The new Data Privacy Notice (below) will replace the current version on 30th July 2025. If you would like to view the current Data Privacy Notice, effective until 29th July 2025, please access this by clicking on the link in the right hand sidebar of this page.

Data Privacy Notice effective from 30 July 2025 

At Unity Trust Bank, we are committed to protecting and respecting your privacy, and we take the protection of your personal data seriously.

Our Data Privacy Notice explains our approach to collecting, storing, and processing your personal information, along with your rights, and how to get in touch with us if you have any further questions.

Data Controller

We, Unity Trust Bank, registered office: Unity Trust Bank, Four Brindley Place, Birmingham, B1 2JB, are the Data Controller.

1. What information do we collect about you?

We collect and process:

• information you give us when you open an account with us or apply for one of our products or services (our “Services”). This will be the name, marital status, address, telephone numbers, date of birth, gender, personal address and email address, country of residence, information to identify you (passport information/photo identification) and position/title within the organisation for all people who are named on the account (“Account Details“);
• information you provide when you voluntarily complete customer surveys, provide feedback and participate in customer focus groups (“Feedback“);
• correspondence you may have with us (including recordings of your calls with us) and any complaints you have raised to our attention (“Correspondence“);
• information from credit reference agencies who gather information for us from public authorities, (for example the Driver Vehicle Licensing Agency (DVLA) and local authorities who run the UK electoral rolls) to verify your identity (“Compliance Information“);
• your name, business name, business address, business email address and business telephone number where these have been obtained from third parties for the purposes of marketing (“Lead Generation Data“); and internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access our website (“Technical Data”).

2. How is your personal data collected?

We use different methods to collect data from and about you including through:

• Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
  • apply for or use our services;
  • subscribe to our service or publications;
  • request marketing to be sent to you;
  • give us feedback or contact us.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies. You can read more about these here.
• Third parties or publicly available sources. We will receive Compliance Information about you from various third parties and public sources as set out above.

3. How will we use the information about you?

The law requires us to have a legal basis for processing your personal information. We rely on one or more of the following lawful basis:

• because it is necessary to fulfil a contract that we have in place with you;
• where the processing is necessary for compliance with our legal obligations; or
• for our legitimate business interests.
• if you have given us your consent.

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

4. Marketing preferences

You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving the marketing. We use the following channels to provide you with information which may be of interest to you:

• Email
• Phone
• Post
• Text

We will analyse your information to identify opportunities to promote products and services to existing or prospective customers and to understand how our products and services are used. For example, this may include:

– Reviewing historical customer transactional behaviour
– Comparison of customer activity
– Analysis of your transactional information.
– What you have directly communicated to us during our interactions with you
– The balance of your accounts and regular or atypical movements
– The use of your card abroad as well as the automatic categorisation of your transaction data

We may ask you to confirm or update your marketing preferences if you take out any new products or services with us in future. You may also be asked for further consent to process your personal data where necessary.

You have the right to amend your marketing preferences, including the communication channels and opt out at any time. You can do this by updating your user preferences here or by emailing us@unity.co.uk. Please note, if you opt out or amend your preferences, we will still contact you about Service-related issues, such as where we make changes to our Services, our terms and conditions or this Data Privacy Notice.

We will never sell or disclose your personal information to third parties for marketing activities, although we do use customer management and fulfilment agencies to help us with our own marketing activities.

5. International Transfers

We may transfer your personal information out of the UK to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:

• ensuring that the country the personal data is transferred to have been deemed by the UK to provide an adequate level of protection for personal data; or by
• using standard contractual statements approved for use in the UK which give the transferred personal data the same protection as it has in the UK.

6. How we store your personal information and how long we store it for

We will only keep your information for as long as we need to and where we have a legitimate reason to do so.

• Your Account Details, Correspondence and Compliance Information is retained for 7 years after you have closed your account with us;
• Lead Generation Data is retained for 7 years after this data was initially captured
• Feedback Data is retained for 7 years after this data was initially captured

There may be instances where we’re asked to retain information for longer due to legal or regulatory reporting requirements.

Where we have collected the personal information based on your consent and we have no other lawful basis to continue with that processing, if you subsequently withdraw your consent then we will stop processing that personal information and delete it. This will not affect the lawfulness of processing based on consent before its withdrawal.

If we have anonymised your personal information or aggregated your personal information in a way that you can no longer be identified from it, then we will continue to keep and use this anonymised information.

7. Who we share your personal information with

We cannot run our business or provide many of our services and benefits without involving other people and businesses, and sometimes we pass your information to these other people and businesses as set out below. We only share your information where we can do so in accordance with our legal data protection and privacy obligations. We will share your personal information with:

• credit reference service providers who provide anti-fraud and credit score information to us (you can find out more about the credit reference service providers on their websites, in the  Credit Reference Agency Information Notice (CRAIN) | Experian).

Here are links to the information notice for each of the three main Credit Reference Agencies:

• • TransUnion
  • Equifax
  • Experian

• central and local government departments, for example the Driver Vehicle Licensing Agency (DVLA) and local authorities who run the UK electoral rolls, banks and finance companies who also provide anti-fraud services, in each case as necessary in order to benefit from their services;
• Where your personal information has been shared with us by third parties, we will share this information with customer management and fulfilment agencies who help us to generate leads and book appointments for our Relationship Managers;
• fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights can be found by following this link.
• customer management and fulfilment service providers so we can manage your transactions and deal with your account applications and amendments;
• payment service providers who provide services for sending and receiving payments;
• data security providers who provide us with our safeguards for your personal data;
• professional advisors who need it to provide advice to us;
• compliance and regulatory bodies: police, local authorities, HM Revenue & Customs (HMRC), the Financial Conduct Authority, the Prudential Regulation Authority, the courts and any other central or local government bodies where they request it and we may lawfully disclose it, for example for the prevention and detection of crime;
• other people who make a right to access request to us, where we are allowed to do so by law (see ‘Your rights’ below for what we mean by a right to access request).

We also share the information we process where we are legally obliged to do so, for example, to comply with a court order.

We require all third parties who process personal data on our behalf to respect the security of your personal data and to treat it in accordance with the law. We do not allow such third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

8. Security

Your personal data is held in secure databases to protect it from theft or being altered. All access to these databases are controlled and monitored to ensure only authorised personnel have access to your data. When your data is sent to a third party that you have agreed to, the data is also sent in an encrypted format and the third party will use the same levels of encryption and security that we use. Our data processing estate is continually monitored and updated to ensure the level of security meets best industry practice and is in accordance with all the laws, regulations and standards required to protect your personal data.

9. Your rights

You have certain rights in relation to your personal information. These include:

• where we rely on your consent to process your personal information, the right to withdraw consent to the processing of your personal information,
• the right to request access to your personal information (a “subject access request”);
• to correct any mistakes on our records;
• to erase or restrict your personal information where it is no longer needed for the purpose for which they were obtained or used;
• the right to object to our use of your personal information based on legitimate business interests, including for profiling and marketing; and
• the right, in certain circumstances, to request the transfer of your personal information to you or a third party in a machine-readable copy;

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We will handle any request to exercise your rights in accordance with applicable law.

If you wish to exercise any of these rights, please write to us using the contact details set out in the “Contacting Us” section below with the subject line ‘Personal information request’. In your request, please supply the following details:

• First name(s) & surname
• Address & postcode
• Details of the type of information you are seeking
• Proof of Identity – this could be a copy of a document such as a passport.

In your request, please make clear what right you would like to exercise. Providing us with this information will help us to quickly identify and deal with your request.

10. Links

For your convenience, this site contains links to other sites. This Data Privacy Notice only covers Unity Trust Bank. Links within this site to external websites are not covered by this Notice. Unity Trust Bank does not accept any responsibility for the content, accuracy, privacy practices and performance of such sites. Any comments or queries in relation to such linked sites should be directed to the owner of those sites. We recommend that you read the Data Privacy Notice for every website that you visit.

11. Changes to our Data Privacy Notice

We regularly review our Data Privacy Notice and will publish any updates on this webpage. This Data Privacy Notice was last updated on 30 July 2025.

12. Contacting us

If you have any questions, or feedback about this Data Privacy Notice, or would like to exercise your rights concerning your personal data please get in touch with our Data Protection Manager.

Email: dp@unity.co.uk

Call: 0345 140 1000

Write to us at: Unity Trust Bank, PO Box 7193, Planetary Road, Willenhall, WV1 9DG

We will do our very best to answer any questions and resolve any complaint to your satisfaction. If, for whatever reason, you feel we do not meet the high standards we expect of ourselves, you have the right to complain to the UK Data Protection Supervisory Authority, the Information Commissioner’s Office (ICO).