Privacy Policy

Last updated: October 2026
 

Castlemilk Credit Union is committed to protecting your personal information and respecting your privacy.

This Privacy Notice explains how we collect, use, store and share your personal information, the reasons why we use it, and the rights you have in relation to your personal information. It applies to members, applicants for membership, borrowers, prospective members, website users and other individuals whose personal information we process.
 

1. Who we are

Castlemilk Credit Union is the data controller responsible for the personal information covered by this Privacy Notice.

​

Our contact details are:

Castlemilk Credit Union
155 Castlemilk Drive
Glasgow
G45 9UG

Telephone: 0141 631 2952
Email: enquiries@castlemilkcu.co.uk

​

When we refer to "we", "us", "our" or "the Credit Union" in this Privacy Notice, we mean Castlemilk Credit Union.

​

2. The personal information we collect

The personal information we collect will depend on your relationship with us and the products or services you use.

We may collect and process information including:

Identity information

​

This may include:

• your name;

• title;

• date of birth;

• age;

• membership number;

• identification documents;

• photographs or other information used to verify your identity; and

• information required to meet our legal and regulatory obligations.

​

Contact information

​

This may include:

• your home address;

• previous addresses;

• email address;

• telephone or mobile number; and

• your communication preferences.

​

Financial information

​

This may include:

• bank account details;

• income;

• expenditure;

• savings;

• debts and other financial commitments;

• benefits or other sources of income;

• payment and repayment information; and

• information relating to your financial circumstances.

​

Membership and account information

​

This may include:

• your membership details;

• savings account information;

• account balances;

• transaction history;

• payments into and out of your account;

• loan applications;

• loan balances;

• repayment history; and

• information about the products and services you hold with us.

​

Credit and lending information

​

Where you apply for credit, we may process information including:

• the amount you wish to borrow;

• the purpose of the loan;

• your income and expenditure;

• existing borrowing and financial commitments;

• your history of repaying debts;

• your credit history and credit score;

• defaults;

• insolvency or bankruptcy information; and

• other information relevant to assessing affordability and creditworthiness.

​

Information about your interactions with us

​

We may collect information about:

• enquiries you make;

• correspondence with us;

• complaints;

• telephone, email or other communications;

• applications and forms submitted to us; and

• your use of our services.

​

Website and technical information

​

When you use our website or online services, certain technical information may be collected, including:

• IP address;

• browser and device information;

• information about how you use our website;

• pages visited; and

• cookie and similar technology information.

​

For more information about our use of cookies, please see our Cookie Policy.

​

Special category and other sensitive information

​

In limited circumstances, we may need to process information that is considered particularly sensitive under data protection law.

​

We will only process this information where we have an appropriate lawful basis and, where required, an additional condition permitting us to process special category information.

​

3. How we collect your personal information

We may obtain personal information directly from you when you:

• apply to become a member;

• open or operate an account;

• apply for a loan;

• make payments or repayments;

• contact us;

• complete a form;

• use our website, app or online services;

• make a complaint;

• update your details; or

• otherwise communicate with us.

​

We may also obtain personal information from other sources where permitted by law.

​

These may include:

• credit reference agencies;

• fraud prevention agencies;

• banks and payment service providers;

• public registers and publicly available sources;

• government departments and public authorities;

• regulatory and law enforcement bodies;

• service providers acting on our behalf; and

• other third parties where you have authorised them to provide information to us or where we are otherwise legally permitted to obtain it.

​

4. Why we use your personal information

We may process your personal information for purposes including:

​

Managing your membership

​

We use personal information to:

• process membership applications;

• verify your identity;

• establish and maintain your membership;

• administer your accounts;

• maintain accurate membership records; and

• communicate with you about your membership.

​

Providing savings and other account services

​

We use personal information to:

• administer savings accounts;

• process deposits and withdrawals;

• maintain account and transaction records;

• provide statements and account information; and

• respond to enquiries about your account.

​

Assessing and administering loans

​

We may use your information to:

• process loan applications;

• assess affordability and creditworthiness;

• verify information provided in an application;

• obtain and consider credit information where appropriate;

• make lending decisions;

• administer your loan;

• collect repayments;

• manage missed payments or arrears; and

• recover money owed to us.

​

Preventing financial crime and protecting our members

​

We may process personal information to:

• verify identity;

• prevent and detect fraud;

• prevent money laundering and other financial crime;

• protect members and their accounts;

• investigate suspicious activity; and

• comply with our legal and regulatory obligations.

​

Meeting legal and regulatory obligations

​

As a financial services organisation, we are subject to legal and regulatory requirements.

​

We may therefore process personal information to comply with obligations imposed upon us by law, regulators, courts, law enforcement agencies and other competent authorities.

​

Operating and improving our services

​

We may process information to:

• operate our business;

• provide customer and member support;

• improve our products and services;

• maintain the security of our systems;

• investigate problems;

• produce management information and statistics;

• maintain appropriate records; and

• protect our legal rights.

​

Communicating with you

​

We may use your contact information to provide important information relating to:

• your membership;

• your accounts;

• loans;

• changes to our products or services;

• changes to terms and conditions;

• security matters; and

• other service-related matters.

​

Marketing

​

Where permitted by law, we may contact you about products, services, news or activities that we believe may be relevant to you.

​

Where consent is required for a particular type of marketing, we will obtain your consent.

​

You can ask us to stop sending you direct marketing communications at any time.

​

5. Our lawful bases for using your information

Data protection law requires us to have a lawful basis for processing your personal information.

​

Depending on the circumstances, we may rely on one or more of the following:

​

Contract

​

We may need to process your information to enter into or perform a contract with you, for example when administering your membership, savings or a loan.

​

Legal obligation

​

We may need to process your information to comply with legal or regulatory obligations that apply to the Credit Union.

​

Legitimate interests

​

We may process personal information where this is necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by your rights and interests.

​

These legitimate interests may include:

• operating and improving the Credit Union;

• protecting our members and assets;

• preventing and detecting fraud;

• maintaining the security of our systems;

• managing and recovering debts;

• maintaining appropriate business records; and

• establishing, exercising or defending legal claims.

​

Consent

​

In some circumstances we may rely upon your consent.

​

Where we rely on consent, you can withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

​

Other lawful bases and additional conditions may apply where we process special category or other particularly sensitive personal information.

​

6. What happens if you do not provide information

Some personal information is necessary for us to provide membership, savings, lending or other services and/or to meet our legal and regulatory obligations.

​

If you do not provide information that we reasonably require, we may be unable to:

• accept you as a member;

• open or operate an account;

• process a loan application;

• provide a particular product or service; or

• continue providing certain services to you.

​

We will explain where providing particular information is necessary.

​

7. Credit reference and fraud prevention agencies

​

When you apply for credit or use certain services, we may obtain information from credit reference agencies and/or fraud prevention agencies where appropriate.

​

Information obtained may include information about your financial circumstances, credit history, existing borrowing, repayment history, defaults, judgments and other information relevant to assessing creditworthiness, affordability, identity or fraud risk.

​

Where applicable, information about applications, accounts and repayment history may also be provided to credit reference or fraud prevention agencies.

​

Records held by these organisations may be used by other organisations to assess applications, verify identity, prevent fraud and money laundering, manage accounts and recover debts.

​

The Credit Union should confirm the credit reference and fraud prevention agencies it uses and whether separate Credit Reference Agency Information Notices need to be linked from this section before publication.

​

8. Who we may share your information with

Where necessary and permitted by law, we may share personal information with organisations including:

• credit reference agencies;

• fraud prevention agencies;

• banks and payment service providers;

• organisations providing IT, software, hosting and communications services to us;

• organisations providing professional services to us, such as auditors, accountants and legal advisers;

• debt collection and recovery services;

• identity verification providers;

• regulatory bodies;

• law enforcement agencies;

• government departments and public authorities;

• courts and other bodies where disclosure is required by law; and

• other organisations where you have authorised us to share information or where we otherwise have a lawful reason to do so.

​

Where another organisation processes personal information on our behalf, we require appropriate safeguards to protect that information.

​

We do not sell your personal information.

​

9. International transfers

Some organisations providing services to us may process or store personal information outside the United Kingdom.

​

Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism and safeguards are used as required by applicable data protection law.

​

The Credit Union should verify whether any of its current technology, cloud, website, app, communications or other providers process member information outside the UK before publication.

​

10. How long we keep your information

We will only retain personal information for as long as reasonably necessary for the purposes for which it was collected and to meet our legal, regulatory, accounting and reporting obligations.

​

The length of time information is retained will depend on:

• the nature of the information;

• the product or service concerned;

• our legal and regulatory obligations;

• applicable limitation periods;

• whether the information may be required in connection with a complaint, dispute or legal claim; and

• our legitimate business and record-keeping requirements.

​

When personal information is no longer required, we will securely delete or anonymise it in accordance with our retention procedures.

​

Before publication, this section should be checked against the Credit Union's actual data retention schedule. Specific retention periods can be added where appropriate.

​

11. How we protect your information

We take appropriate technical and organisational measures to protect personal information against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction.

​

Access to personal information is restricted to people who require it for legitimate purposes, and organisations processing information on our behalf are required to protect it appropriately.

​

12. Automated decision-making and loan applications

The Credit Union may use automated processing when assessing loan applications.

​

Information considered as part of the lending decision may include:

• the amount applied for;

• your income and expenditure;

• your credit score and credit history;

• your history of repaying debts;

• the number and value of County Court Judgments (CCJs);

• accounts in default;

• publicly available insolvency information;

• bankruptcy information;

• your age; and

• other information relevant to affordability and creditworthiness.

​

The process may apply lending policies, such as minimum age requirements and other lending criteria, and may use statistical information to assess the likelihood that a loan will be repaid based on relevant characteristics and previous repayment outcomes.

​

Where a decision about you is made solely by automated means and produces legal or similarly significant effects, you have rights relating to that decision.

​

Where applicable, you can ask for human intervention, express your point of view, obtain an explanation of the decision and challenge the decision.

​

Important: this section must be checked against Castlemilk Credit Union's actual loan decision-making process before publication, including whether any lending decision is made solely through automated processing.​​