We will only process your personal data when we meet one of the following lawful conditions:

• When we have a lawful contract with you;
• When it is our legal duty;
• When we have a legitimate interest;
• If we need to act in your vital interests; or
• When you have provided us consent to process it.

If we process your personal data that has been obtained from someone other than you, we will let you know without undue delay.

NM Finance, Portal House, 7b Alkmaar Way, Norwich International Business Park, Norwich, NR6 6BF. The point of contact for all personal data related queries is the Data Privacy Manager.

We share your personal data with the appropriate:

• Credit reference agencies;
  • NM Finance conduct credit checks through TransUnion (formerly Callcredit), for further information about TransUnion and the information it holds click the link below:
    https://www.callcredit.co.uk/legal-information/bureau-privacy-notice
• Fraud prevention agencies;
• UK regulators and other legal authorities; and/or
• Appointees who are instructed to act on your behalf, for example a solicitor.

We will never sell or share your information with marketing companies.

We take all reasonable technical and procedural precautions to prevent the loss, misuse or alteration of your personal information. All business data is stored off-site on a server at a secure location and managed by a trusted third-party contractor. NM Finance Ltd do not operate internationally; our business services are limited to the United Kingdom.

We will retain your information for as long as it is needed to provide you with our services and manage our relationship and also to comply with our legal obligations, resolve disputes and enforce our agreements. In practice this could be throughout your lifetime, but this does not prejudice your right to request that your personal data is no longer processed by us (The Right to Object).

The GDPR extends your rights in respect of your personal data. It should be noted that these are qualified in so much that they do not necessarily apply in all situations. The ‘rights’ are listed below.

• • Right to be informed;
  • The right to access;
  • Right to rectification;
  • Right to erasure;
  • Right to restrict processing;
  • Right to data portability;
  • Right to object; and
  • Rights related to automated decision making.
    For a more detailed explanation about each of these rights please look at our Data Protection Policy or the Information Commissioner’s Office (ICO) website using

https://ico.org.uk

Exercising your rights and access to your personal information

If you wish to exercise your right to access to your personal data, please contact the Data Privacy Manager. We will then contact you to check your identity and may request documents to prove it. For all other queries regarding our processing of your personal data and the exercising of all of your rights, please contact the Data Privacy Manager.