Which? Financial Services privacy notice

This privacy notice was last updated on 8 August 2023.
^{Version 6}

About this notice

Who we are

Which? Financial Services Limited has been dormant since 1 July 2022 and ceased to be authorised and regulated by the FCA with effect from 20 December 2022.

Which? Money Compare, Which? Mortgage Advisers and Which? Insurance Advisers were trading names of Which? Financial Services Limited, part of the Which? Group and closed in 2019. To find out more about the Which? Group see the 'About Us' section of our general terms. If you are a member of Which? or using any of our other websites or products and services, please also check our general privacy notice.

Even though Which? Financial Services Limited is now a dormant company, for the purposes of data protection legislation, Which? Financial Services Limited (Company No 07239342) is still a controller of the personal information you previously provided in relation to Which? Mortgage Advisers, Which? Insurance Advisers and Which? Money Compare products and services. Our registered address is 2 Marylebone Road, London, NW1 4DF.

Which? Financial Services Limited is referred to in this privacy notice as "we", "us" or "our".

What this notice applies to: This notice applies to personal information we collected about you when you interacted with us, for example when you contacted us about Which? Mortgage Advisers or Which? Insurance Advisers services, or that we collected from third parties, as described in this privacy notice. It sets out:

i. what information we collected, and from whom;
ii. how we use that information;
iii. who we share your information with;
iv. how your information is protected;
v. your rights in relation to the information we hold about you; and
vi. how long we keep your information.

What this notice does not apply to: This notice does not apply to any services provided by the Consumers' Association or Which? Limited, where a different privacy notice applies. For further details please see Which?'s privacy notice.

Changes to this privacy notice: We keep our privacy notice under regular review, and we encourage you to periodically review this page for the latest information on our privacy practices. Any material changes will be notified to you by updating them on our website together with any such other methods as may be appropriate.

1. What information did Which? Financial Services collect?

Information you provided to us voluntarily in relation to Which? Mortgage Advisers and Which? Insurance Advisers:

You may have given us your personal information when you:

• used our products and services;
• used our websites or online calculators;
• completed automated enquiries around specific product needs;
• corresponded with or contacted us;
• requested a call back either through our websites or through affiliates' websites;
• agreed to be referred to us; or
• otherwise interacted with us or provided information to a third party to be referred to us.

2. What types of information does Which? Financial Services process?

We collected, and store the following types of information:

• your name and contact details (including your postal address, telephone number, email address(es), membership number, and social media identity);
• identification information (such as your date of birth, your National Insurance number, passport, driving licence, proof of address and three year address history and/or birth certificate);
• financial information (such as bank details or credit/debit card details, salary details and payslips, retirement information, credit commitments and debts, mortgage details, financial expenditure, utility bills, council tax bills, bank and credit card statements, credit reports, and tax calculations and tax credit correspondence);
• employment information;
• health and lifestyle information;
• details about your possessions;
• details about the products and services we provided to you;
• information you or dependants provided on other individuals (for example joint applicants for a product or service);
• information provided when you used our products or services, including where you were previously seeking guidance or advice;
• correspondence you have had with us;
• details about you that are stored in documents in different formats, or copies of them; and
• any other information shared with us as described in section 1 above.

3. How does Which? Financial Services use my information, and on what legal basis?

The following sections describe in more detail how Which? Financial Services, or one of the companies who work on our behalf, may use your information, and in particular the legal grounds on which we rely in doing so.

What we use your personal information for

We use the information collected for a number of purposes, including:

• to respond to complaints and seek to resolve them;
• to communicate with regulators, legislators, insurers and corporate stakeholders; and
• to obey laws and regulations that apply to us.

The legal grounds we rely on to process your information

The legal grounds on which we rely are:

• to fulfil our contractual obligations;
• to pursue our legitimate interests;
• your consent; and / or
• to fulfil a legal duty.

Legitimate interests

When we rely on our legitimate interests, these are as follows:

• keeping our records up to date;
• ensuring that complaints can be dealt with appropriately;
• complying with legal and / or regulatory requirements;

Where we process personal information which is particularly sensitive ("special category data"), such as health data, we do this on the basis that you have provided explicit consent for us to do so, or on the basis that such processing is necessary in the establishment, exercise or defence of legal claims:

• we process personal data relating to health in order to establish, exercise or defend our legal rights, for example when in order to defend ourselves against any legal claims or pursue any legal claims ourselves; and

• we process personal data relating to health where we have a legal or regulatory obligation to use such personal information, for example, when regulators such as the Financial Conduct Authority (FCA) and the Information Commissioner's Office (ICO) wish us to maintain certain records of any dealings with you.

4. Who does Which? Financial Services share my information with?

We, or one of the companies who work on our behalf, share your personal information with the following third parties:

Data processors

We shared your personal information with third parties who provide services to Which? Financial Services Limited or who act on our behalf, for instance other parts of the Which? group, vendors, IT and other suppliers. We do not authorise these companies to use or disclose your personal information except for the purpose of providing the service we request of them. Which? group companies are all based in the United Kingdom ("UK"), but some third party data processors will be based outside of the UK.

Group companies

We share your information between companies in our group for the following purposes:

• responding to requests to exercise your rights;
• responding to complaints and enquiries and seeking to resolve them; and
• keeping our records up to date.

We may have also shared your information with other members of our group if you indicated to us that you would like to hear about their Which? products and services.

All members of our group are based in the UK and comply with similarly high standards in the treatment of your information and will use it only for the purposes set out in this privacy notice.

A full list of companies/brands within our company group is available here.

Third parties involved in corporate transactions

Which? Financial Services may share your information with third parties involved in any reorganisation, restructuring, merger or sale, or other transferring of assets, provided that the receiving party agrees to respect such personal information in a manner that is consistent with this Privacy Notice.

Other third parties

These third parties may be companies with which we have a relationship in relation to products and services provided to you.

Other circumstances in which we will disclose your information

We will disclose your information to local and foreign regulators (such as the Financial Conduct Authority), governments, law enforcement authorities, advisers, insurers, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, for example to detect, prevent or investigate security breaches, fraud or other crimes.

We will also disclose your information to establish, exercise or defend legal claims, for example: (i) to enforce our Terms and Conditions; (ii) to ensure the safety and security of our users, consumers and third parties; and (iii) to protect our rights and property and the rights and property of our website visitors, consumers and third parties.

Location of third parties

Some potential recipients of your information might be located outside of the UK and the European Economic Area ("EEA"), in jurisdictions which do not have the same data protection laws as those in the UK. If we do transfer your information outside of the UK we will take appropriate steps to protect that information, which include:

• transferring to third parties in jurisdictions that the UK (or the European Commission had, at 31 December 2020), determined offer adequate protection for your information (information relating to adequacy decisions is available here); and
• entering into an agreement with the recipient, which includes clauses that the UK Information Commissioner's Office has determined offer adequate protection for your information. For more information, please contact us using the details outlined in section 7 (How may I contact Which? Financial Services about its privacy notice?) below.

5. What are my data protection rights?

You have the following rights in relation to your personal data:

• Access:  The right to request access to and a copy of your personal information (which can be done by emailing [email protected]);
• Restriction: You can ask us to pause processing your information in certain circumstances (e.g. you are disputing its accuracy);
• Rectification: You can have any inaccuracies in your personal information corrected;
• Deletion: You can ask us to delete all your personal information in certain circumstances (e.g. if the information is no longer necessary for the purposes for which it was collected);
• Objection: You can object to us processing your personal information in certain circumstances;
• Objection to marketing:  Please see the main Which? Group Privacy Notice for information about how to opt-out of direct marketing communications;
• Portability: You can ask us to transfer your information electronically to you or another organisation in certain circumstances;
• Withdrawal of consent: Where we rely on your consent to process your information, you can withdraw consent at any time, although this will not affect our uses of your personal information prior to the withdrawal of your consent; and
• To lodge a complaint with the Information Commissioner's Office ("ICO") or other relevant supervisory authority: You can complain to the ICO or other relevant supervisory authority about any aspect of our handling of your information.

More information about the right to complain can be found at https://ico.org.uk/for-the-public/. If you have any questions about these rights, or you would like to exercise them, please contact us using the details at section 7 (How may I contact Which? Financial Services about its privacy notice) below.

Please be aware that you are under no obligation to provide us with your personal information. However, failure to do so may, in some circumstances, prevent us from being able to interact with you.

When exercising your data protection rights we may ask you to verify your identity in order to help us respond efficiently to your request.

If you would like to exercise any of the above rights, please email or write to us using the details outlined in section 7 (How may I contact Which? Financial Services about its privacy notice?) below. All of these rights are free to exercise and we will do our best to respond to you as quickly as possible and in any event, within one month of receipt of your written request. We will inform you within one month of receipt of such request if we will need longer to respond, for example due to the complexity of the request.

We want to make sure that your personal information is accurate and up to date. Please always let us know if you think that it is not and needs updating. Details of how to get in touch are in the section How may I contact Which? Financial Services about its privacy notice? below.

6. How long is my information retained?

Where we are still processing your personal data, we will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information. At the end of that retention period, your data will either be deleted or anonymised. Examples of our retention periods are:

• Where we need to keep your information for financial reporting obligations, we would normally keep it for ten years from the date of payment.
• Where we need to keep your information for dealing with legal claims or complaints, we would normally keep it for seven years from the end of that matter.
• Where we gave advice, we keep personal information for up to six years from completion date.

7. How may I contact Which? Financial Services about its privacy notice?

You can contact us by post, telephone and email as follows:

Email: 

[email protected] (for access requests under section 5 and all general queries)

[email protected] (to manage your marketing and analytics preferences)

Telephone number: 029 2267 0000

Postal Address:

General Counsel, Which?, 2 Marylebone Road, London, NW1 4DF

To find out more about Which? group and who we are, please look at the 'About Us' section of our general terms.

8. Changes to this Privacy Notice

Which? may need to update this Privacy Notice from time to time. You can see when the Privacy Notice was last updated by checking the date at the top of the page. A summary of changes can be found in this section, along with the date they were made.

If we make any updates, such as materially changing how we use your personal data, we will alert you as required by applicable privacy laws.

09.01.20 - Section 6 - Clarification on how long your personal data is retained.

07.08.20 - Full review of privacy notice to reflect closure of the Which? Mortgage Advisers and Which? Insurance Advisers businesses.

02.06.21 - Section 4 - updated to reflect the changes following the UK's departure from the EU in relation to international data transfers outside of the UK.

08.08.23 – Updated to reflect deauthorisation of Which? Financial Services.