1. Introduction

1.1 Pillar Labs Ltd is regulated and authorised by the Financial Conduct Authority (“FCA”) and a subsidiary of Pomelo Technology US Inc. which comprise a group of companies (“Pomelo Group”or “we”) and respects your right to privacy. This Privacy Notice explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights. This Privacy Notice applies to personal information that we and other third-party entities collect through your use of our app, LemFi Mobile Application (“LemFi App” or “Application” or “App”), and the Credit Monitor Services accessible through the LemFi App.

1.2 If you do not accept the content of this Privacy Notice, please do not use the Credit Monitoring Services.

1.3 Our Data Protection Officer can be contacted at the following email address: dataprivacycounsel@lemfi.com

2. Who are we?

2.1 Pillar Labs Ltd is registered at Jellicoe, 5 Beaconsfield St, London N1C 4EW. The Credit Monitoring Services shall be provided by Pillar Labs Ltd, regulated and authorised by the Financial Conduct Authority; a wholly owned subsidiary of Pomelo Technology US Inc. In addition, the following entities may contribute to providing the Credit Monitoring Services:

• Pomelo Added Services Limited

• RightCard payments Services Ltd

2.2 We provide Credit Monitor Services in conjunction with other third-party entities collectively referred to as “Service Providers''. Please read our Credit Monitoring Terms & Conditions of Service here: Credit Monitoring Terms

3. What is our relationship with RightCard Payment Services Ltd, Equifax and any other Credit Reference Agencies we may use

3.1 Pillar Labs Ltd is an independent, regulated and authorised lender; which may offer credit and Credit Monitoring Services to you. Pillar Labs Ltd, and RightCard Payments Services offer independent Services to the LemFi Customers as both companies are affiliated with each other and subsidiaries of Pomelo Technology Us Inc. Pillar Labs Ltd, may collect your personal data from RightCard Payments Services Ltd, when you provide your express consent to do so.

3.2 Equifax and any other Credit Reference Agencies with whom we may work are independent companies who supply Credit Reports or Credit Scores to Pillar Labs Ltd as part of Credit Monitoring Services. Please refer to the type of information Equifax and any other Credit Reference Agencies may use, collect and process as contained in their Privacy Notice and Credit Reference Agency Information Notice (below see section 12).

3.3 Personal information provided to, or collected by us when you use our Application in respect of Credit Monitoring Services is controlled by Pillar Labs Ltd. The associated processing of your personal data takes place on the basis of an Independent Controller arrangement between PILLAR and Equifax. Under this arrangement, Pillar Labs Ltd will at all times be available for data subjects (you) to address any concerns or questions and/or allow them to exercise their rights under domestic applicable data protection laws regarding their personal information.

3.4 We are committed to safeguarding the personal information of our customers, users, employees and other stakeholders, while helping our customers, employees, investors and society create a deeper impact and make the right decisions.

4. Personal Information we may collect?

4.1 When you sign up for Credit Monitor, we collect and process:

• Identification details: name, date of birth, address history, and contact details (email, phone number), which we may receive from our affiliate company if you are already a LemFi Customer, to enable us to provide Credit Monitor Services.

• Application data: information you provide when applying for our services.

• Credit reference data: credit scores, credit reports, repayment history, public records (such as CCJs or insolvencies), and search footprints from Equifax.

• Financial data: information about your accounts, transactions, repayments, and payment mandates (where relevant to your use of LemFi Credit Product(s).

• Technical and usage data: device identifiers, IP address, and app activity logs.

• Identification details: name, date of birth, address history, and contact details (email, phone number), which we may receive from our affiliate company if you are already a LemFi Customer, to enable us to provide Credit Monitor Services.

• Technical and usage data: device identifiers, IP address, and app activity logs.

5. How do we collect personal information?

5.1 We collect personal information in the following ways:

• Directly from you when you use the LemFi app, sign up for Credit Monitor, or interact with our services.

• From other LemFi group companies (for example, Rightcard EMI) if you are already a LemFi customer.

• From credit reference agencies when we obtain your credit score, credit report, and related information.

• From your use of our app and services, through activity logs, device identifiers, and usage data.

6. How do we use your personal information?

6.1 We use your personal information to:

• Provide Credit Monitor: process your application, obtain your credit score and report from Equifax, and display them in the app.

• Communicate with you: manage your account, update records, answer questions, and handle complaints.

• Improve our services: test and upgrade systems, monitor usage of the app, and analyse aggregated/anonymous data for reporting and product development.

• Marketing and offers: where you have consented, we may:

  • contact you with information about other LemFi products or services that may interest you;

  • use insights from your credit information (for example, your credit score or credit commitments) to identify products that are more likely to be relevant to you;

  • in some cases, check your eligibility for products offered by LemFi or our trusted partners using soft searches that do not impact your credit file.

6.2 We will always ask for your consent before sending marketing communications, and you can withdraw your consent at any time.

7. Why do we need to use your personal information and who do we share it with?

7.1 When you opt in to use the Credit Monitor Services, we’ll need to share some of your information with Equifax and any other Credit Reference Agencies we may use so we can deliver Credit Monitoring Services to you.

• We’ll share your name, date of birth and address with Equifax and any other Credit Reference Agencies we may use so they can verify you as a natural person living in the United Kingdom, before sharing your credit information with us.

• We may also share your email address with Equifax and any other Credit Reference Agencies we may use if needed for them to contact you directly, for example if you raise a dispute about your credit file.

7.2 After you opt in and throughout your use of Credit Monitor Services:

• We’ll use your personal information to provide you the Credit Monitor Services under these terms.

• We may also use your data to share personalised insights with you, or suggest relevant LemFi products (only where you have consented to this, or where we have a legitimate interest to offer or improve our services). We will always make sure these interests do not override your rights or freedoms.

7.3 We share your personal information with:

We may use third-party companies to provide services on our behalf. This may require these organisations to access and process your personal data. These may include:

• Credit Reference Agencies;
• Fraud Prevention Agencies including CIFAS;
• Account Information Service Providers;
• Communications service providers offering mail, email and SMS text services;
• Customer survey providers in order to receive feedback and improve our services;
• IT service providers;
• Data security providers for debugging and product improvement purposes;
• Legal service providers;
• Digital and direct marketing service providers;
• Third party quality assurance providers
• Trusted lenders and brokers who will assess your eligibility for products; and
• Prospective assignees of your account;
• any internal and external service providers to include Cloud Services, Customer Support Services.

7.4 Law enforcement agencies and regulatory bodies

We may share your personal information with the law enforcement agencies and regulatory bodies, where required to comply with our legal obligations.

7.5 Pomelo Technology US Inc Affiliates

We may share your personal data with one or more of the following Pomelo Technology US Inc Affiliates listed in the LemFi Global Privacy Notice to help improve, promote, and deliver the Credit Monitoring Services.

7.6 To comply with our contractual obligations:

We process your personal information to comply with our legal obligations under our terms in providing the Credit Monitoring Services.

7.7 To advance our mutual Legitimate interests:

We may use your personal information to advance our mutual legitimate interest, which may include but is not limited to offering you better and varied services under the LemFi brand through marketing campaigns, product development and enhancements.

8. What are your personal data rights?

As a data subject, you have a number of rights:

• the right to access the personal data we hold about you;
• the right to rectify inaccurate personal data or complete it if it is incomplete;
• the right to have your personal data deleted;
• the right to request restriction of or suppression of your personal data;
• the right to obtain and make use of your personal data for your own purposes across different services ("portability");
• the right to object to the processing of your personal data in certain circumstances;
• rights related to automated decision-making including profiling, and
• the right to withdraw consent at any time. In certain circumstances, we may need to get your consent before we can access or process your personal data. If this happens, we will always ask for your consent first. If you have given us consent in the past but subsequently change your mind, you can withdraw your consent at any time.

8.1 Your data protection rights are subject to certain restrictions and conditions and financial organisations are required to retain a range of your information for legal and regulatory reasons including responsible lending and the prevention of financial crime.

8.2 LemFi or PILLAR is required to keep a record of all the relevant information reported to the Credit Reference Agencies about you and any additional information which is retained by LemFi and PILLAR to comply with its regulatory obligations for six years from the date you last used the Credit Monitoring Services. .

8.3 If you think that any of the personal data we hold about you is wrong or incomplete you have the right to challenge it.

8.4 We will not make a charge for handing your rights request, unless we consider it to be manifestly unfounded or excessive involving a disproportionate effort (particularly if this is a repeated request).

8.5 We will assess your request and if we decide not to act upon it or place certain restrictions on it, we will inform you of our reasons for this.

8.6 You have the right to complain to us and to the data protection regulator, the Information Commissioner's Office. Their address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. They can be contacted by phone on 0303 123 1113 (local rate) or 01625 545745 if you prefer to use a national rate number.

You can find details on how to report a concern at: https://ico.org.uk/make-a-complaint/

9. How long do we keep your personal information?

We will retain your personal data for as long as we are required to under relevant legislation and regulation, and where no specific rules apply, for no longer than it is necessary for our lawful purposes. This will usually be no more than six years from the end of our relationship with you. The retention period of your personal data may need to be extended where we require this to bring or defend legal claims.

We may also retain data for longer periods for statistical purposes, and if so we will anonymise this.

10. How do we protect your information?

We use leading cloud services such as AWS that have adopted industry security best practice frameworks to protect your data in transit and at rest. In addition, we comply with best practice security standards.

11. Changes to Privacy Notice

We may update this Privacy Policy from time to time. Any significant changes will be communicated in-app or by email. Please check this page for the latest version.

12. Other Privacy Notice (relevant to Credit Monitoring Services): Please read these carefully:

Equifax: https://www.equifax.co.uk/privacy-hub/privacy-notice & Equifax Crain Notice https://www.equifax.co.uk/privacy-hub/crain

Experian: https://www.experian.co.uk/consumer/stat/privacy.html and Experian Crain Notice https://www.experian.co.uk/legal/crain/

Transunion: https://www.transunion.co.uk/legal/privacy-centre/pc-bureau and Transunion Crain Notice https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference

LemFi Global Privacy Notice