SMART LEASE - DATA PRIVACY NOTICE

The Data Protection Act requires Smartlease to manage personal information in accordance with the Data Protection Principles. In particular, our business is required to process your personal information fairly and lawfully. This means that you are entitled to know how we intend to use any information you provide. You can then decide whether you want to give it to us in order that we may provide the product or service that you require. All our employees are personally responsible for maintaining customer confidentiality. We provide training and education to all employees to remind them about their obligations. In addition, our policies and procedures are regularly audited and reviewed. Your information will be held by Smartlease. Your personal information will be held securely in Smartlease systems so that we can manage your relationship with us. This will include information you provide when you apply to us, and any additional information provided by you or others in various ways, including: (a) in applications, emails and letters, during telephone calls and conversations in our office(s) (where applicable), when registering for services, when you participate in competitions and promotions, through Smartlease websites, and during financial reviews. We will not retain your personal information for longer than is necessary for the maintenance of your account, or for legal or regulatory requirements. We may share the personal information we hold about you with finance companies and vehicle suppliers / delivery agents for the following administrative activities (a) providing you with products and services and notifying you about either important changes or developments to the features and operation of those products and services; (b) responding to your enquiries and complaints; (c) administering offers, competitions, and promotions; (d) undertaking financial reviews and also for the following data sharing activities (e) facilitating the secure access to online platforms and also for the following data sharing activities: (f) updating, consolidating, and improving the accuracy of our records; (g) undertaking transactional analysis; (h) arrears and debt recovery activities; (i) testing new systems and checking upgrades to existing systems; (j) crime detection, prevention, and prosecution; (k) evaluating the effectiveness of marketing, and for market research and training; (l) customer modelling, statistical and trend analysis, with the aim of developing and improving products and services; (m) assessing lending and to obtain a finance decision with our panel of lenders; (n) managing your relationship including arranging delivery of your vehicle via third party agencies. By sharing this information it enables us, to better understand your needs and run your accounts in the efficient way that you expect and in finance applications to enable us to get a finance decision for you and in turn offer our services.

Your data may also be used for other purposes for which you give your specific permission, or, in very limited circumstances, when required by law or where permitted under the terms of the Data Protection Act 1998. We will treat your personal information as private and confidential, but may disclose it outside the Smartlease if: (a) allowed by this agreement; (b) you consent; (c) needed by our agents, advisers or others involved in running accounts and services for you or collecting what you owe; (d) needed by subcontractors to help us manage your records; (e) HM Revenue & Customs or other authorities require it; (f) the law, regulatory bodies, agreements between Smartlease and the Government or other regulatory bodies or the public interest permits or requires it; (g) required by us or others to investigate or prevent crime; (h) needed by market research companies to assist us in providing better products and services for you; or (i) to any other parties connected with your account (including guarantors). (j) required as part of our duty to protect your accounts, for example we are required to disclose your information to the UK Financial Services Compensation Scheme (FSCS). (k) you use price comparison websites or other similar services to research or purchase financial products and services. These providers will use information about you and your relationship with us to help ensure you get the best results from their services, enabling you to make an informed choice. (l) we need to give the information to a third party or finance company to seek credit approval for your required service. We will always ensure your information remains safe and secure. The Government also requires us to screen applications that are made to us to ensure we are complying with the international fight against terrorism and other criminal activities. As a result of this we may need to disclose information to government bodies. Smartlease may in the future wish to sell, transfer or merge part or all of their business or any associated rights or interests, or to acquire a business or enter into a merger with it. If so, they may disclose your personal information to a potential buyer, transferee, or merger partner or seller and their advisers so long as they agree to keep it confidential and to use it only to consider the possible transaction. If the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your personal information in the same way as set out in this notice. Credit scoring takes account of information from three sources - the information you provide on your application, information provided by credit reference agencies and information that may already be held about you by Smartlease. A credit scoring system will consider information from these sources, to make an overall assessment of your application. The credit scoring methods used are regularly tested to ensure they remain fair, effective and unbiased.

Using a credit scoring system helps finance companies to lend responsibly. If you submit an application and it is declined through this automated process, you can contact us within 21 days to have the decision reconsidered. You also have the right to ask that the decision is not made based solely using a credit scoring system. Credit Reference Agencies (CRAs) collect and maintain information about consumers' and businesses' credit behaviour. This includes Electoral Register, fraud prevention, and credit information - including details of previous applications and the conduct of your accounts - and public information such as County Court Judgements, decrees, and bankruptcies. The information that Smartlease and other organisations provide to credit reference agencies about you, your financial associates and your business (if you have one) may be provided to other organisations and used by them and us to: (a) help make decisions, for example when: (i) checking details on applications for credit and credit-related or other facilities; (ii) managing credit and credit-related accounts or facilities; (iii) recovering debt; (iv) checking details on proposals and claims for all types of insurance; (v) checking details of job applicants and employees; (b) detect and prevent crime, fraud and money laundering. (c) check your credit history; (d) verify your identity if you, or someone financially linked with you, applies for services; (e) trace your whereabouts; and (f) undertake research, statistical analysis and systems testing. If Smartlease need to make a credit decision when you apply for a credit-based product or service (via our panel of lenders/finance companies) or to review the amount of credit it provides under an existing agreement, such as an additional lease vehicle, your records will be searched, along with those of anyone who is financially associated with you such as your spouse or partner. The CRA will keep a record of this search and place a "footprint" on your credit file, whether or not the application proceeds. The finance companies we use may give details of your account and how you conduct it to credit reference agencies, including if you borrow and do not repay in full and on time. If you fall behind with your payments and a full payment or satisfactory proposals are not received within 28 days of a formal demand being issued, then a default notice may be recorded with the CRAs. Any records shared with CRAs will remain on file for 6 years after your account is closed, whether it has been settled by you or as a result of a default. Other organisations may see these searches and updates if you apply for credit in the future, and these may affect your ability to borrow from other lenders. If you apply for or hold an account in joint names, or tell us that you have a spouse or financial associate, a financial association will be created between your records, including any previous and subsequent names used by you. This means that your financial affairs may be treated as affecting each other. These links will remain on your and their files until such time as you or your partner is successful in applying for a disassociation with the CRAs to break that link. You must be sure that you have their agreement to disclose information about them. Searches may be made on all joint applicants, and search footprints will be left on all
applicants' records.

You have a right to apply to the credit reference agencies for a copy of your file. Our Finance companies carry out credit searches using Experian, Equifax and or Call Credit, and details of how you have run your account(s) may be disclosed to all the credit reference agencies. The information they hold may not be the same and there is a small fee that you may need to pay to each agency that you apply to. Their addresses are: • Experian Consumer Help Service, PO Box 9000, Nottingham NG80 7WP or call 0344 481 8000 or log on to www.experian.co.uk • Equifax plc, Credit File Advice Centre, PO Box 1140, Bradford BD1 5US or log on to www.equifax.co.uk • CallCredit, Consumer Services Team, PO Box 491, Leeds LS3 1WZ or call 0330 024 7579 or log on to www.callcredit.co.uk We have systems that protect our customers and ourselves against fraud and other crime. Customer information can be used to prevent crime and trace those responsible. Our Finance companies will share your personal information from your application with fraud prevention agencies. If false or inaccurate information is provided and fraud is identified, details of this fraud will be passed to these agencies. Law enforcement agencies may access and use this information. We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when: • Checking details on applications for credit and credit related or other facilities. • Managing credit and credit related accounts or facilities. • Recovering debt. • Checking details on proposals and claims for all types of insurance. • Checking details of job applicants and employees. Please contact us if you want to receive details of the relevant fraud prevention agencies used by our finance companies. We and other organisations may access and use from other countries the information recorded by fraud prevention agencies. We may ask you to provide physical forms of identity verification when you open your account. Alternatively, we may search credit reference agency files in assessing your application. The agency also gives us other details and information from the Electoral Register to verify your identity. The agency keeps a record of our search, whether or not your application proceeds. Our search is not seen or used by lenders to assess your ability to obtain credit. To comply with money laundering regulations, there are times when we need to confirm (or reconfirm) the name and address of our customers. This information may be shared with our finance companies. The Data Protection Act does not generally apply to companies but it does cover personal data relating to sole traders and partnerships. When we receive an application from a business we may perform a search with a credit reference agency on the individual company directors or partners, or any guarantors.

Making sure we deliver excellent customer service is very important to us and to do this various methods of communication may be used to keep you updated about your account. Most of the time we communicate by telephone or post, but we recognise that email is becoming a more popular process. If we decide to use email to contact you, we will only do this if we have ensured that using email will not put your information at risk, or, if you have requested we email you, that we have explained the risks of sending an "insecure" email and that you are happy to accept that risk. We may monitor or record phone calls with you in case we need to check we have carried out your instructions correctly, to resolve queries or issues, for regulatory purposes, to help improve our quality of service, and to help detect or prevent fraud or other crimes. Conversations may also be monitored for staff training purposes. As part of our ongoing commitment to understanding our customers better, we may research comments and opinions made public on social networking sites such as LinkedIn, Twitter and Facebook. Under the Data Protection Act you have the right of access to your personal data. The Act allows us to charge a fee of £10 for this service. If anything is inaccurate or incorrect, please let us know and we will correct it. For further details on how to request a copy of your information, please write to: Compliance Manager – Smartlease, Moulton Park Business Centre, Unit S10, Redhouse Rd, Northampton NN3 6AQ Smartlease will use your personal information so we can provide you with product details and offers that are more relevant to you. This may include products and services from companies outside of our Group if we believe they may be of interest to you or benefit you financially. This contact may continue after your relationship with us ends. We might contact you by mail, telephone, email, or text message unless you have asked us not to. We may also display personalised messages when you use our online services. You can change your preferences at any time by calling us, or writing to us. Unless you have given us your consent, we will not provide information about you to companies outside our group to use for their own marketing purposes. We keep our privacy notice under regular review and we will reflect any updates within this notice. This privacy notice was last updated May 2018