To be our customer, you share information with us. At Pepper, your privacy is very important to us. Below is a guide to how personal data is managed by Pepper. If you prefer, you can open the Data Privacy Notice in a print ready format by clicking here.
If you have a loan that is serviced by Pepper on behalf of third party, you may find a link to your loan owners Data Privacy Notice at the bottom of this page.
We are Pepper Finance Corporation (Ireland) DAC trading as Pepper Money and Pepper Asset Servicing (“Pepper”, ”we”, “our”). We are a member of the Pepper group of companies. Our principal activity, when trading as Pepper Money, is the provision of residential and commercial mortgage loans. Our principal activity, when trading as Pepper Asset Servicing, is the management of Pepper loans or the provision of loan portfolio management/credit servicing to various investment companies, along with third party servicing activities. The purpose of this Data Privacy Notice is to explain how we, in our capacity as a data controller, collect and use your personal information. Personal information means information relating to a living individual who can be identified (either from that information itself or when combined with other information). We are a data controller in respect of the loans we own and a data processor in respect of our credit servicing activities. In relation to the latter, we may also be a data controller for a period after we stop servicing your loan where we retain personal information for the purposes of compliance with our regulatory obligations. Whether as a data controller or a data processor, we are committed to complying with Data Protection Law at all times. By “Data Protection Law” we mean the EU General Data Protection Regulation, the Data Protection Acts 1988 to 2018 and any other laws which govern the use of your personal data.
2. Why Pepper collects and uses your personal information
We collect and process your personal information for a variety of reasons and we rely on a number of legal bases for doing so including:
2.1 To enter into and for the performance of a contract
Applications:We use personal information that you provide to us to process your application for a product or service from us and to decide on the terms upon which we can enter into a contract with you, for example, an application for a mortgage loan.
Ongoing Product/Service Management:In order to manage any product or service provided, we have to process your personal information, for example, administration of a mortgage loan by processing payments, writing to you about the status of your loan, assessing your loan for an alternative repayment arrangement if you find yourself in financial difficulty and so on. As part of this management, we may be required to pass some of your personal information to an intermediary or counterparty (e.g. to take a payment by direct debit from your bank account we have to share your personal information with our bank).
Continuing Performance:Where we may have acquired your loan from another lender, they will pass relevant information to us to allow for the continued performance of your contract.
2.2 To comply with legal obligations
- Assessing affordability and suitability for the provision of credit and throughout our relationship with you including analysing your credit data for regulatory reporting.
- Obtaining personal information from the Central Credit Register and Irish Credit Bureau when considering credit or loan applications to assess affordability and suitability for the provision of credit, and providing information to the Central Credit Register about the performance of your loan agreement with us.
- Verifying personal information provided to us to prevent money laundering, financing of terrorism, tax avoidance, and/or fraud. For example, we may ask you for a proof of identity and/or a proof of address as part of our ongoing verification requirements in respect of Anti-Money Laundering legislation.
- Responding to queries raised by regulatory authorities, law enforcement and/or other government agencies such as the Data Protection Commission, the Central Bank of Ireland, An Garda Siochana, and the Revenue.
- Providing information requested in the context of a regulatory investigation or inspection.
- Delivering mandatory communications as required by legislation or regulations.
- Investigating and resolving complaints.
- Managing contentious regulatory matters, investigation and litigation.
2.3 Our legitimate business interests
- Timelines: We will consider your request and provide a response within 1 month of receipt of your request and verification of your identity, where required, as set out in Section 3 above. This time period may be extended in exceptional circumstances. In these cases we will advise you of this along with confirming the reasons for the extension.
- How to make a request: You can make your request using any of the channels set out in Section 12.
- To enable us to manage our relationship with you including having readily available access to your information through use of IT systems and functionality.
- To monitor, maintain and improve internal business processes, information, technology and communications that may benefit you or Pepper.
- To ensure business continuity and disaster recovery and to respond to information technology and business incidents and emergencies.
- To ensure adequate network and information security and fraud prevention protections are in place.
- To undertake system testing, for example, prior to implementing system improvements.
- For internal analysis and reporting for the management of individual customer accounts and to make strategic decisions for our business.
- To establish, exercise and safeguard our rights which may include taking enforcement action against customers or defending complaints or claims made about us.
- To assess the quality of our customer services and to provide staff training. This includes monitoring and testing of how we manage your loan(s) and our interactions with you.
- To perform analysis on customer complaints for the purposes of preventing errors and process failures.
- To rectify negative impacts on customers as a result of process or regulatory failures.
2.4 Where you have provided consent
Marketing Consent:At the time of applying for your loan, or at any time thereafter, if you consented to marketing, we might use your personal information to make you aware of other products or services which we think could be of interest to you. In addition, depending on the preferences you selected at the time of your application, we might disclose your personal information to third parties and our partners whose products or services we consider could be of interest to you. All marketing communications will include a clear opt-out facility if you wish to change your marketing contact preferences.
Sensitive Information Consent:Data Protection Law may require us to obtain consent to the processing of special categories of personal information such as personal information that reveals racial or ethnic origin, information about a person’s health, religious beliefs and other categories of ‘sensitive data’. While we don’t collect sensitive data as a matter of course, you may choose to disclose health and other sensitive information in limited circumstances, such as if you are experiencing a health issue which is affecting your ability to repay a loan, which we will record on our systems.
Authorised third parties:At your request and with your written consent, we will liaise with a third party nominated by you to act on your behalf.
Telephone Contact at Work:You may have consented to us contacting you at your workplace, where it is not your residence.
At any time you can withdraw your consent through the contact channels referenced in Section 12.
2.5 Where you have provided us with information about another personWhere you provide us with personal information relating to another person (e.g. a partner, spouse or guarantor) we rely on you to ensure that you have their consent to providing us with their information for use in accordance with this Data Privacy Notice.
3. Types of personal information we collect and how it is usedWe collect and process various categories of personal information at the start of and for the duration of your relationship with us. We limit the collection and processing of personal information to such information as is necessary for the purposes set out in Section 2 above. Personal information requested over the course of your relationship with us may include, but is not limited to, the following:
Identity information:Name, date of birth, proof of identification (such as driving licence or passport). Examples of how we use this information include: to identify you and to comply with our legal and regulatory obligations.
Contact information:Address, telephone number, email address. Examples of how we use this information include: to manage and administer your loan(s) with us, to send you information which you request and to respond to your queries and complaints.
Personal circumstances:Employment status and details, financial circumstances including income and expenditure, assets, borrowings, savings, lifestyle needs. Examples of how we use this information include providing you with products such as a new loan or restructuring or rescheduling of a loan.
Interactions with Pepper staff:Whenever a staff member meets you or contacts you, a note of this interaction is recorded on our loan management system. In addition, we sometimes record telephone conversations to improve services, for training purposes, to resolve complaints and as required by relevant regulations and Central Bank of Ireland Codes of Conduct. However, we will always let you know when we are recording our calls with you.
Health information:With your consent, we sometimes process information on your health when you are applying for a product or service or over the course of your relationship with us. You may choose to share health information with us, for example, if you are in financial difficulties as a result of a health issue you may provide us with this information in writing or by phone in which case it may be included in a call recording.
Other:We may also collect and process personal information made available by other parties, for example credit reference agencies such as Central Credit Register or Irish Credit Bureau; or entities such as An Post.
4. Your rights in relation to the personal information you have given to PepperYou have a number of rights in relation to the personal information which Pepper holds about you. If you choose to exercise any of these rights, we may ask you to verify your identity by providing us with additional documentation such as an up to date proof of identity.
4.1 Right of access to your personal information
Fees:Typically there is no fee for a copy of your personal information although we have the right to apply a reasonable fee in exceptional circumstances if your request is manifestly unfounded or excessive.
Format of response:You may request that the information is provided to you orally, in a hard copy format or in electronic format. If you require the information in electronic format, you will need to provide us with your email address. We will email the information to you encrypted with a password and you will need to contact us by telephone to provide you with the password. It is important to be aware that email is not a fully secure means of communication.
Exclusions:Some personal information is exempt from the right of access, such as personal information that is not available from a reasonable and proportionate search, privileged information, confidential expressions of opinion or where providing a copy would adversely affect the rights and freedoms of others.
4.2 Right to correct your personal information
Restrict processing:While we are considering your query, you may request that we restrict processing your personal information.
4.3 Right to delete your personal information
You may request deletion or erasure of your personal information in the following circumstances, provided there are no legal obligations or overriding legitimate grounds that require us to keep it:
- Where the personal information is no longer necessary for the purpose for which it was collected.
- Where you withdraw your consent (in the case of data held in reliance on your consent such as those in 2.4 above).
- Restrict processing: While we are considering your query, you may request that we restrict processing your personal information
4.4 Right to withdraw your consent
4.5 Right to request your information be transferred
4.6 Right to objectWhere your personal information is being processed on the basis of our legitimate interests, we must ensure that there is a fair balance between our legitimate interests and your rights. If you disagree with your personal information being processed in this manner, you are entitled to object.
5. How do we use Automated Decision MakingTo help us make decisions quickly and to improve our service to customers, we may use automated decision making as part of our loan application process. This means that some parts of the decision making process are fully automated with no human intervention. Currently we use automated decision making for our mortgage loan ‘Approval-in-Principal’ (“AIP”) process based on information provided by you. In certain cases however, the decision may be referred to an underwriter to review. This type of processing is necessary to assist us in making a decision in relation to your application. You have the right to express your point of view and contest an automated decision by contacting us through the channels in Section 12 below.
6. How do we use your personal information for direct marketing?Sometimes we may want to make you aware of products and services which we think may be of interest to you based on the product or service you have already received from us, and the personal information we hold about you. If you have consented to direct marketing we may send you marketing communications. You may also have consented to us sharing your personal information with carefully selected third parties and partners whose products or services we think may be of interest to you. If you would like to withdraw your consent at any time, please refer to Section 2.4 above.
7. How we keep your information safeWe make every attempt to ensure your personal information is protected and secure. We do this by considering data privacy when developing, designing, selecting and using new systems, products and processes that are used to hold or process that personal information and by limiting access to your personal information. We use a variety of technical and organisational security measures to protect your personal information. These include computer safeguards; ensuring files are stored securely and that our offices have adequate security.
8. Who has access to your information and who do we share it with?
8.1 Staff and onsite suppliers
8.2 Third parties within the European Economic Area (“EEA”)
- We may share your information with insurers, solicitors, accountants, valuer, estate agents, advisers and other consultants who act on our behalf or to obtain advice.
- We may use third parties such as print providers and document storage providers.
- We use the services of a number of IT suppliers of systems and technology.
- We may share your information with third parties to comply with our legal obligations.
8.3 Third parties outside the EEA
- The European Commission has decided that the country or organisation we are sharing your information with will protect it adequately;
- We have entered into a contract with the organisation with which we are sharing your information to ensure it is adequately protected on terms approved by the European Commission; or
- The transfer has been authorised by a relevant data protection authority.
8.4 Central Credit Register (CCR), credit reference and fraud prevention agencies
- To manage and take decisions about your accounts, including assessing our creditworthiness when you are applying for a new product, and checks to avoid indebtedness.
- If you apply to have your existing loan restructured.
- If an amendment is required to the records held on the CCR or ICB.
- For prevention of fraud, money laundering or criminal activity.
- To trace debtors and recover debt.
8.5 Loan acquisitions or transfer of rights
How long do we retain your personal information?By providing you with a loan, we create records that contain your personal information. Records can be held on a variety of media (physical or electronic) and formats. Your personal information is retained for different periods of time depending on the purposes for which they are required to be retained. We hold your personal information while you are a customer and for a period of time after that. If you have a loan with us, normally we keep customer account records for up to seven years after your relationship with us ends. Other personal information may be kept for shorter periods. Sometimes we may have to keep your information for longer periods, for example where we need to retain information or documents relating to actual or prospective legal proceedings, a court order or an investigation by law enforcement agencies or our regulators.
Use of Pepper websites
10.2 Use of your personal information
- Information that you provide by filling in forms on the Websites, including your name and the account number for your loan. We may also ask you for information when you report a problem with the Website or when you use the Website to contact us. If you contact us, we may keep a record of it.
- Details of transactions you carry out through the Website, including payments made in respect of loans held by us but not details of debit cards used to make such payments.
- Details of your visits to the Website, including, but not limited to, traffic data, location data, web logs and other communication data, whether this is required for our own purposes or otherwise, and ther esources that you access.
By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Data Privacy Notice. Any payment transactions will be encrypted using SSL technology. The Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that they have their own privacy statements and that we do not accept any responsibility or liability for these statements. Please check these statements before you submit any personal data to these websites.
10.3 Types of information we collect and how it is used
- IP Addresses: We may collect information about your computer, including, where available, your IP address, operating system and browser type, for system administration. This is statistical data about our users’ browsing actions and patterns and does not of itself identify any individual.
- Cookie technology: Our websites use ‘cookie’ technology. The Cookies Policy on our website explains what cookies we use and how you can adjust your preferences.
11. Updates to this Data Privacy NoticeThis Data Privacy Notice may be updated from time to time. You will always find the most up to date version on our websites at www.peppermoney.ie or www.peppergroup.ie.
12. How you can contact usIf you have any queries about your data protection rights, you can contact us in the following ways: By phone at the following number or in writing at the following address:
For Pepper Money:
|Write to:||Customer Services, Pepper Money, PO Box 693, Shannon, Co. Clare|
|Phone:||1890 995 998 or +353 (0)61 236925|
|For Pepper Asset Servicing:|
|Write to:||Customer Services, Pepper Asset Servicing, PO Box 687, Shannon, Co. Clare|
|Phone:||+353 (0)61 705900|
|If you wish to raise a query or make a complaint in relation to how we handle(d) your personal information, you can write to our Data Protection Officer, at the following address.|
|Write to:||Data Protection Officer, Pepper Money & Pepper Asset Servicing, 4th Floor Two Park Place, Upper Hatch Street, Dublin 2.|
|In the event that you are not satisfied with our response to your query or complaint, you may be entitled to complain to the Office of the Data Protection Commission:|
|Write to:||Office of the Data Protection Commission Canal House, Station Road, Portarlington, Co. Laois.|
|Phone:||+353 57 868 4800 or LoCall: 1890 252231|