Credit

Revolving Credit Privacy Notice

Last updated: 12 May 2026

History

PART A: GENERAL PRIVACY PROVISIONS

Introduction

This Privacy Notice (“Notice”) is issued by the companies within the Pomelo Technology US Inc. group of companies (“Pomelo Group” or “we”) that provide services to you through the LemFi Mobile Application (“LemFi App” or “Application” or “App”). It explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights.

This Notice applies to personal information collected through your use of the LemFi App and any of the Services accessible through the LemFi App, including Remittance Services, Card Services, Credit Services, Credit Monitoring Services, and Savings Account Services (together, the “Services”).

Application users, clients, customers, and account holders are referred to collectively as “Users” or “you”. The Application together with the Services and all content contained therein are referred to collectively as the “Resources” as further described in our Terms & Conditions.

Please read this Notice carefully to understand our policies and practices for collecting, processing, and storing your personal information. If you do not agree with our policies and practices, your choice is not to use the Resources.
Services means your current and future use of any of our existing or new products, including, but not limited to the delivery, management, marketing and processing of such Services, whether through us or third-party Service providers.
This Notice is specific to users of the LemFi App who are resident in the United Kingdom and is governed by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and relevant Financial Conduct Authority (“FCA”) requirements.
Our Data Protection Officer can be contacted at the following email address: dataprivacycounsel@lemfi.com.

Who are we?

The specific data controller for your personal information depends on which Services you use:

  • Remittance and Card Services: RightCard Payment Services Ltd (“RightCard”), registered at Jellicoe, 5 Beaconsfield Street, London N1C 4EW, United Kingdom. RightCard is authorised and regulated by the Financial Conduct Authority as an Electronic Money Institution (FCA Firm Reference Number: 900424) and as an Introducer Appointed Representative of Pillar Labs Ltd (FCA Firm Reference Number: 996727).

  • Credit Services and Credit Monitoring Services: Pillar Labs Ltd (“Pillar”), registered at Jellicoe, 5 Beaconsfield Street, London N1C 4EW, United Kingdom. Pillar is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 996727).

  • Savings Account Services: RightCard Payment Services Ltd, acting as data controller in conjunction with ClearBank under an independent controller arrangement.

RightCard and Pillar are both subsidiaries of Pomelo Technology US Inc., which is a global financial technology company registered at 251 Little Falls Drive, Wilmington, DE 19808, USA.

The Pomelo Group’s other entities include: Pomelo Technology Canada Ltd; Pomelo Two US LLC; Pomelo Added Services Ltd; Pomelo Australia Limited; and Pomelo Remits Europe Ltd. Personal data may be shared among these entities in accordance with this Notice.

We are committed to safeguarding the personal information of our customers, users, employees and other stakeholders, while helping our customers, employees, investors and society create a deeper impact and make the right decisions.

If you wish to contact us in relation to questions regarding your personal information, we refer you to the ‘Contact Us’ section below.

Our service partners

Different entities within the Pomelo Group and their third-party partners play different roles in providing each Service. The specific relationships, data controller arrangements, and third-party partners relevant to each Service are set out in the Product-Specific Schedules in Part B of this Notice.

What data do we collect?

The information we may collect about you will vary depending on how you interact and engage with us and which Services you use. It may include the following:

  • Personal identification information: name, date of birth, place of birth, nationality, gender, email, address (current and previous), demographic information, and phone number. We may verify your address via utility bills or through an electronic address verification method.

  • Supplemental identification information: government-issued identity documents, live photo images captured, passport, driver’s license, national insurance number, source of income/wealth and employment information including its status and history.
    Financial information: income/wealth verification documents, bank account statements, income, sources of income, employment details, salary, outgoings, loans, existing credit and debts, rent payable, mortgages, credit cards, any other financial commitments, previous defaults, banking history, and any other financial information made available through Open Banking channels.

  • Device information: device name, type and unique identifier, software version, language, timestamp, and timezone associated with the device, IP address and location.

  • Behavioural data: information on your behaviour on our App, including screens viewed, links clicked, keystrokes, and actions taken; including use of any functions/features or failure to verify the account or lack of transactions (dormant position) and User Application activities carried out within the App.

  • Transaction information: information related to the use of the Services, types of Services requested, dates and times of such requests, payment methods, information on beneficiaries, frequency of use, and other similar information.

  • Location data, including User location searches.

  • Communications data: messages, comments, or file transmissions.

  • Internet connection information: information about your internet connection, the equipment you use to access our Resources, and usage details.

  • Information specific to our App, including that provided during your use of the App.

  • Additional verification information: any additional information required by us to verify your identity, which may include capturing the image of your face in real time for facial matching and/or recognition.

  • Details of any contacts that we have had with you, including any telephone, email or other communication.

  • Information collected through customer feedback surveys.

  • Any personal information you may provide us through social media channels or promotions held by us or our partners.

  • Any existing information already held by us for products or Services provided by us to you using the LemFi App.

Additional data categories specific to individual Services (including credit reference data, Open Banking data, and loan or savings account details) are set out in the relevant Product-Specific Schedules in Part B.

How do we collect your data?

We collect personal data about you in the following ways:

  • Directly from you when you download or use the Application, register, fill in information on the LemFi App, place an order for any of our products or Services, manage your account online, or correspond with us by email, phone or otherwise.

  • By observing how you access and use our products and services, including how you use our App, manage your accounts, and when you submit applications and other information to us.

  • From other LemFi group companies.

  • From organisations that have your consent to share your data with us or for a separate legal basis for a specific or defined purpose.

  • From public sources, for instance the Companies House register, the Individual Insolvency Register, the ‘Open Register’ part of the electoral register.

  • From third-party organisations such as Fraud Prevention Agencies.

  • When you enable access to your device’s location tracking functionality, whether the Application is running in the foreground or background.

  • When you register for any of the Services.

  • When you voluntarily complete a customer survey or provide feedback.

  • When you submit content to the Application, like reviews, messages, or comments.

  • When you agree to participate in the testing of new products and Services.

Additional collection methods specific to individual Services (including from Credit Reference Agencies, Account Information Service Providers, and Open Banking platforms) are set out in the relevant Product-Specific Schedules in Part B.

How will we use your data?

We collect and use personal data, which may include personal information, in order:

  • To facilitate account creation and authentication, and otherwise manage Users’ accounts.

  • To provide the Services and the other Resources to Users.

  • To enhance the safety and security of our Users and Services, including by protecting you and us from errors, misrepresentations, fraud, and/or contraventions of laws or criminal activity.

  • To verify Users’ identity, and for processing and recording financial transactions made through the Application and assessing Users’ financial stability.

  • To administer our relationship with you and our business, such as providing and managing your access to and use of our Services (contractual necessity).

  • For due diligence, verification, and fraud prevention analysis.

  • For customer support to understand, resolve your requests and overall customer experience.

  • For research and development, improving our Services and developing new products (legitimate interest).

  • To enable communications between Users.

  • To send marketing and non-marketing communications to Users (with consent or under legitimate interest).

  • In connection with legal proceedings.

  • To carry out our obligations and enforce our rights arising from any contracts with Users, including for billing and collection or to comply with legal requirements.

  • To provide Users with information, products, or Services that a User requests from us.

  • To comply with our legal and regulatory obligations, including FCA requirements.

  • To set up and process payments and prevent fraudulent transactions.

  • To trace your whereabouts if we cannot contact you.

  • To recover any money you owe us.

  • To monitor and record calls, emails, SMS and other communications for security, quality control, training and fraud prevention purposes.

We do not sell or share User personal data with third parties for their direct marketing purposes, except with Users’ consent.

Additional processing purposes specific to individual Services are set out in the relevant Product-Specific Schedules in Part B.

We collect and use personal information only where we have one or more lawful grounds for doing so under the UK GDPR. Our grounds for processing your data are as follows:

A Contractual necessity

We may process your information where it is necessary to enter into a contract with you or to perform our obligations under that contract. This may include processing to: assess your eligibility for the products and services we provide; set up your account; verify your contact information; collect and provide required information and documents including statements and formal notices; disburse money and process payments; manage fees, charges and interest due on your account; send you service communications and notices required by law; collect and recover outstanding sums owed to us; and address any enquiries or complaints we receive from you.

We may process your data where it is a legal or statutory obligation on us. This may include processing to: confirm your identity; detect, investigate and report transactions in order to comply with laws relating to money laundering, financial crime and international sanctions; maintain records of our business as required by law; comply with laws requiring us to provide information to any national authority for the calculation and collection of tax; respond to enquiries and requests for information by the Financial Conduct Authority and Information Commissioner’s Office; create and submit regulatory reports; and protect vulnerable customers.

C Legitimate interest

We may process your information when we have a business or commercial reason to do so, provided it does not unfairly go against what is right and best for you. This may include processing to: develop new products and services; contact you to make you aware of such products and services; monitor and improve our website and App; maintain and develop our business systems; share information with organisations who introduce you to us; recover monies owed; and share your information for the purpose of preventing fraud and financial crime.

The Company may collect and use personal data based on your consent. For example, we may collect personal data through voluntary surveys, or through the Application to verify your identity based on your real-time facial image. Where you have provided consent, we may use your personal data to offer you additional Services, including Services offered in conjunction with independent third-party Service providers.
You can revoke your consent at any time (subject to legal or contractual restrictions). However, you will not be able to use any Service or feature that requires collection or use of that personal data. Withdrawal of your consent will not affect the lawfulness of the processing of your personal data prior to the withdrawal.
Additional legal basis details specific to individual Services are set out in the relevant Product-Specific Schedules in Part B.

8 Data sharing and disclosure

We may share your personal data:

A With Pomelo Group subsidiaries and affiliates

We share data with our subsidiaries and affiliates to help us provide our Services or conduct data processing on our behalf. This includes sharing data between RightCard and Pillar for the purposes of facilitating your use of integrated Services.

B With service providers and business partners

We provide data to vendors, consultants, marketing partners, research firms, and other service providers or business partners. These include:

  • Fraud Prevention Agencies including CIFAS.

  • Cloud storage providers (including Amazon Web Services based in the USA).

  • Call centres and customer support providers.

  • Communications service providers offering mail, email and SMS text services.

  • Marketing partners and marketing platform providers.

  • Data analytics providers.

  • Research partners and customer survey providers.

  • Security and fraud prevention vendors.

  • Consultants, lawyers, accountants, and other professional service providers.

  • Insurance and financing partners.

  • IT service providers and data security providers.

  • Third-party quality assurance providers.

  • Investors.

Additional service-specific sharing partners are set out in the relevant Product-Specific Schedules in Part B.

We may share your personal data if we believe it is permitted or required by applicable law, regulation, operating licence or agreement, legal process or governmental request, or where the disclosure is otherwise appropriate due to safety or similar concerns. This includes sharing personal data with law enforcement officials, public health officials, other government authorities, or other third parties as necessary to enforce our terms, protect our rights or property, or in the event of a claim or dispute. This also includes sharing data in connection with any merger, divestiture, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business.

9 How we work with Fraud Prevention Agencies

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services or finance.

The Fair Processing Notices for CIFAS provides further details on how your information will be used by us and these fraud prevention agencies, and your data protection rights.

10 Result of processing

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies and may result in others refusing to provide financing to you. If you have any questions about this, or believe that your information has been processed inaccurately, please contact us.

11 Automated decision-making

We may use your personal data in automated processes to make decisions about you. You have the right not to be subject to a decision based solely on automated processing, if this will have a legal or other significant effect on you (certain exceptions apply).

We use automated decision making in:

  • Fraud and money laundering risk identification.

  • Profiling to identify whether you are suitable for products and services we offer and to inform you of these.

  • Determining appropriate action to take where your account has gone into arrears or default.

You have the right to ask for any automated decision to be reconsidered manually. We may require additional relevant information from you before human oversight of a specific decision will take place.

Additional automated decision-making specific to individual Services (including credit scoring and affordability assessment) is set out in the relevant Product-Specific Schedules in Part B.

12 Special categories of personal data

We will not typically ask you for any ‘special categories’ of personal data. This is also referred to as ‘sensitive personal data’ and includes information revealing an individual’s political opinions, racial or ethnic origin, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning health or data concerning an individual’s sex life or sexual orientation.
We may process personal data about your health or medical conditions, where we need to understand this to provide you with support, or to make adjustments in how we provide you with information or provide you with additional services that you may need. Companies acting on our behalf specialising in identifying vulnerable customers may also process such data for this purpose. If we process such data, we will do so to comply with our legal obligations to support you if you are, or become a vulnerable customer, and to establish, take or defend any legal action.

13 International data transfers

We may transfer your personal data to third parties or affiliates located outside the United Kingdom, including but not limited to the United States, Canada, European Union member states, Nigeria, Kenya, Ghana, and the Philippines. These countries may have different data protection laws than the United Kingdom, and in some cases, they may not provide the same level of data protection.

Whenever we transfer information outside of the United Kingdom, we ensure that the transfer complies with the UK GDPR and Data Protection Act 2018 so that your personal information is adequately protected. To ensure the continued protection and security of your personal data, we implement appropriate safeguards including the use of the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules, or other measures approved by the Information Commissioner’s Office.

We use Amazon Web Services (AWS) based in the United States of America to provide storage, retrieval and access associated to your account, transactions and personal data.

You may request additional information regarding data transfers outside the UK and obtain a copy of the appropriate safeguards by exercising your rights set out in section 16 below.

14 Data retention and deletion

We retain user profile, transaction, and other personal information for as long as a user maintains their account and, except as otherwise permitted or required by applicable law or regulation, only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will retain your personal data for no longer than it is necessary for our lawful purposes. This will usually be no more than six years from the end of our relationship with you.

We retain location, device, and usage data for a minimum of 7 years (subject to changes based on our legal and regulatory obligations); while it retains such data, it may also use it for purposes of safety, security, fraud prevention and detection, and research and development.

The retention period of your personal data may need to be extended where we require this to bring or defend legal claims.

We may also retain certain information if necessary for purposes of safety, security, and fraud prevention.

Users may request deletion of their account at any time. Following such requests, we delete the data that we are not required to retain for purposes of regulatory, tax, insurance, litigation, or other legal requirements.

We may anonymise Users’ personal information so that it can no longer be associated with a particular User. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice or consent.
Additional retention periods specific to individual Services are set out in the relevant Product-Specific Schedules in Part B.

15 How do we protect your information?

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to secure Users’ personal information from accidental loss and from unauthorised access, use, alteration, and disclosure. We store all information on secure servers. Any payment transactions will be encrypted using SSL technology.

We use leading cloud services such as AWS that have adopted industry security best practice frameworks to protect your data in transit and at rest. In addition, we comply with best practice security standards.

The safety and security of User data also depends on each User. Where we have given a User (or where a User has chosen) a password for access to certain parts of the Resources, each User is responsible for keeping its password confidential.

16 What are your data protection rights?

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

  • Right of access: the right to get an overview of the personal information that we process about you.

  • Right to rectification: if your personal information is inaccurate or incomplete, the right to ask us to rectify or complete it.

  • Right to erasure (‘right to be forgotten’): the right to request that we delete your personal information to the extent permitted by applicable law.

  • Right to data portability: the right to ask us to transfer your personal information directly to you or to another party of your choice, where technically feasible.

  • Right to restrict processing: the right to request that we restrict or stop the processing of your personal information held by us for a certain period of time, or for an indefinite period.

  • Right to object: the right to object to the processing of your personal information, including the unconditional right to object to direct marketing.

  • Rights related to automated decision-making including profiling: the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you.

  • Withdrawal of consent: the right to withdraw your consent to the processing of your personal information at any time.

Your data protection rights are subject to certain restrictions and conditions. Financial organisations are required to retain a range of your information for legal and regulatory reasons including responsible lending and the prevention of financial crime.

We will not make a charge for handling your rights request, unless we consider it to be manifestly unfounded or excessive (particularly if this is a repeated request). We will assess your request and if we decide not to act upon it or place certain restrictions on it, we will inform you of our reasons.

To exercise your rights, please contact us at dataprivacycounsel@lemfi.com.

If you feel we are unresponsive or disagree with our data privacy practices, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). Their address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. They can be contacted by phone on 0303 123 1113 (local rate) or 01625 545745 (national rate). You can find details on how to report a concern at: https://ico.org.uk/make-a-complaint/

17 Marketing

We may send you information about products and Services of the Company, always with your consent. You may provide consent to marketing and promotional communication when you enrol for the Services.

If you have agreed to receive marketing materials, you may always opt out at a later date. You have the right at any time to stop us from contacting you for marketing purposes. If you no longer want to receive marketing-related emails, you may opt out by following the instructions in any such email.

When we first collect your data, we will give you the opportunity to confirm your preferences. Any electronic marketing communications we send you will include clear instructions to follow should you wish to unsubscribe at any time. You may also amend your contact preferences by notifying customer services via email or telephone.

Please note that if you opt out, we may still send you important administrative messages, from which you cannot opt out.

18 Cookies and similar technologies

We may use cookies and similar tracking technologies when you use the LemFi App and associated websites. For further information on the types of cookies we use, why, and how you can control cookies, please refer to our separate Cookie Policy available at https://lemfi.com/legal/cookies-policy.

19 Children’s personal information

Our Resources are not intended for persons under 18 years of age. No one under age 18 may provide any information to or on the Resources. We do not knowingly collect personal information from persons under 18. If you are under 18, do not use or provide any information on the Resources or through any of its features, register on the Resources, make any purchases through the Resources, use any of the interactive or public comment features of the Resources, or provide any information about yourself to us. If we learn we have collected or received personal information from a person under 18, we will reject the application or close the account and delete that information. If you believe we might have any information from or about a child under 18, please contact us at dataprivacycounsel@lemfi.com.

The App may contain links to other websites. This Privacy Notice applies only to the App. If you navigate to any other website from a link in the App, you should review the privacy notice of such website.

21 Changes to this Privacy Notice

If we make material changes to how we treat our users’ personal information, you will be notified in the Application and/or by email. Any significant changes will be communicated in-app or by email. Please check the App for the latest version. The date this Notice was last revised is identified at the top of this document.

22 Contact us

If you have any questions about this Privacy Notice, the personal information we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact our Data Privacy Manager at dataprivacycounsel@lemfi.com.
If you feel we are unresponsive or disagree with our data privacy practices, you have the right, under applicable law, to file a complaint with the Information Commissioner’s Office (ICO). See section 16 above for ICO contact details.

PART B: PRODUCT-SPECIFIC SCHEDULES

The following schedules supplement the General Privacy Provisions set out in Part A. They detail processing activities, data categories, legal bases, sharing arrangements, and retention periods that are specific to individual products. Where a matter is not addressed in a product-specific schedule, the General Privacy Provisions in Part A apply.

Schedule 1: Remittance and Card Services

1. Data Controller

RightCard Payment Services Ltd is the data controller for personal data collected and processed in connection with the Remittance and Card Services.

2. Service partners

Card issuance infrastructure is provided by Marqeta, and card payments are processed through the Visa network. We do not share data directly with Visa; data exchange occurs through Marqeta.

3. Additional data processing

In addition to the general processing purposes set out in Part A, personal data collected for Remittance and Card Services may be used for:

  • Processing international and domestic money transfers.

  • Issuing digital and physical cards (virtual and physical Visa cards issued by RightCard via Marqeta infrastructure).

  • Enabling use of the “Send Now Pay Later” (SNPL) feature, including SNPL International Transfers and SNPL Local Transfers, where such feature is available in conjunction with Credit Services.

  • Executing transactions at merchants and ATMs.

  • Facilitating Mobile Wallet integrations.

4. Sharing with Card Services partners

Marqeta receives personal identifiable information (name, address, PAN card number) to create an account and transactional details (purchase amount, merchant, available limit or balance) to enable customers to use the cards. Card payment processing may involve Visa. We do not share data directly with Visa; all data exchange occurs through Marqeta. Please refer to the Marqeta Privacy Notice and Visa Privacy Notice for further information.

5. Access to your contact list

With your express permission, we may access your contact list on your mobile device so that you can identify your contacts on LemFi to allow you to send money to friends and family on the LemFi App.

We transmit and use this information to help you easily filter your friends on LemFi and to help you transact with your contacts if you choose to connect your contact list information with your Account. We only access your contact list information with your explicit permission.

We will not send messages to your contacts or make use of the data for any other purpose.

Schedule 2: Credit Services

1. Data Controller

Pillar Labs Ltd is the data controller for personal data collected and processed in connection with Credit Services.

2. Relationship between RightCard and Pillar

RightCard onboards customers to the Remittance product, including IDV/KYC checks. Only customers who have already been onboarded through the RightCard process are eligible to apply for credit. Pillar can then rely on the relevant outputs from that onboarding journey, together with CRA, Open Banking and other credit data, to make the actual creditworthiness, affordability and lending decisions. RightCard acts as Introducer Appointed Representative of Pillar.

Pillar is an independent, authorised and regulated lender which processes credit applications linked to your personal and financial information. This includes but is not limited to:

  • Performing financial and credit suitability analysis on your financial information.

  • Obtaining your credit references from Equifax and other CRAs and conducting verification of your financial information, including income, current or past residential addresses.

  • Accessing your bank account information via Open Banking platform to assess your income, outgoings and affordability for Credit Services.

  • Providing underwriting criteria and applying those to your financial and personal information to determine eligibility and suitability for Credit Services based on automated decision-making processes.

  • Determining lending limits and repayment plans.

  • Reviewing and managing customer credit ledgers and reconciling repayments.

  • Managing collection and debt recovery in the event of overdue payments and default.

  • Reviewing customer credit applications and managing the credit application journey.

3. Credit-specific data categories

In addition to the general data categories set out in Part A section 4, when you use Credit Services we may also collect and process:

  • Credit reference data: credit scores, credit reports, credit affordability verification data, credit analysis reports, repayment history, public records (such as CCJs or insolvencies), search footprints from CRAs, and automated decisions related to individual applications for credit facility.

  • Open Banking data that you have authorised us to access.

  • Information collected from Credit Reference Agencies, Fraud Prevention Agencies and Account Information Service Providers.

  • Details of any loans or credit accounts you hold or have held with us.

  • How and when a Card was used in conjunction with Credit Services.

  • Information on transactions related to the Credit or Card products to evaluate your use of our services, and for any other analysis.

4. Credit-specific collection methods

In addition to the general collection methods set out in Part A section 5, for Credit Services we also collect data:

  • From Credit Reference Agencies, who provide information on your financial behaviour and credit history.

  • From Account Information Service Providers via Open Banking platforms.

  • From RightCard, where Pillar relies on onboarding data collected by RightCard for credit applications.

5. Credit-specific processing purposes

In addition to the general processing purposes set out in Part A section 6, for Credit Services we also use your data:

  • For credit checks, credit scoring, affordability assessments, and offering credit products.

  • To process and complete applications for loans and credit products.

  • To search Credit Reference Agencies’ and Fraud Prevention Agencies’ records.

  • To use the loan amount granted to a User and assign that to the User’s Card to allow them to make use of the Credit granted.

In addition to the general legal bases set out in Part A section 7, for Credit Services we also rely on:

  • Contractual necessity: sharing information to assess your creditworthiness with CRAs, Fraud Prevention Agencies and Account Information Service Providers; assessing your eligibility for similar products including new loans; providing you with credit enabled and used through the use of a virtual or physical card.

  • Legal obligation: assessing affordability of any credit products for which you apply.

  • Legitimate interest: conducting statistical analysis, analytics and profiling, for example, to create scorecards, models and variables in connection with the assessment of credit, fraud, vulnerabilities, risk or to verify identities, to monitor and predict market trends, and for analysis such as loss forecasting; selling debts to other firms; obtaining finance for the products we provide.

7. How we use Credit Reference Agencies

To process your application for Credit Services, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”). Where you take services from us we may also make periodic searches at CRAs to manage your account with us. To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to: assess your creditworthiness and whether you can afford to take the product; verify the accuracy of the data you have provided to us; prevent criminal activity, fraud and money laundering; manage your account(s); trace and recover debts; and ensure any offers provided to you are appropriate to your circumstances

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your accounts including settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt and payment performance. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders or financial services providers.

Where you have a financial association with someone your records may be linked, so you should discuss your application with them before you make it. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully file for a disassociation with the CRAs to break that link.

8. Credit-specific automated decisions

In addition to the general provisions on automated decision-making in Part A section 11, for Credit Services we use automated decision making specifically for: credit scoring and affordability assessment using data from online forms, your use of our App, CRAs and other third parties. If you do not agree with the decision, you have the right to appeal and ask for the decision to be reconsidered manually. We may require additional relevant information to be provided by you before human oversight of a specific decision will take place.

We also use profiling in conjunction with partners when developing new prospect marketing campaigns. If your behaviour is consistent with money laundering or known fraudulent conduct, or is inconsistent with previously provided information, or you appear to have deliberately hidden your true identity, we may decide that you pose a fraud and money laundering risk.

9. Credit-specific sharing

In addition to the general sharing provisions in Part A section 8, for Credit Services we may share your data with:

  • Pillar Labs Ltd as the lender.

  • Credit Reference Agencies (including Equifax, Experian, TransUnion).

  • Account Information Service Providers (including TrueLayer).

  • Debt Collection Agencies, Debt Management Companies and companies specialising in customer reconnection, asset repossession and general information-gathering visits.

  • Debt purchasers.

  • Trusted lenders and brokers who will assess your eligibility for products.

  • Prospective assignees of your account.

If we cannot offer you a product, we may check your eligibility for loans and/or other relevant credit products from our panel of trusted lenders and brokers. We will always seek your consent to do this and in assessing eligibility our partners will always use soft checks that will not impact your credit file.

10. Open Banking for credit repayments

We use TrueLayer Limited (www.truelayer.com) as an Account Information Service Provider to enable you to send information on your payment accounts to us and other service providers. TrueLayer is also used as a Variable Recurring Payments (VRP) service, allowing Pillar to collect loan repayments from customers via open banking. Please refer to the TrueLayer Privacy Notice for details on how it processes your personal data.

11. Credit-specific data retention

Pillar is required to keep a record of all the relevant information reported to the Credit Reference Agencies about you and any additional information retained for regulatory compliance for six years from the date that the loan is settled/closed. If your account is recorded as defaulted, the data is kept for six years from the date of the default. This may be extended where required to bring or defend legal claims.

Schedule 3: Credit Monitoring Services

1. Data Controller

Pillar Labs Ltd is the data controller for personal data collected and processed in connection with Credit Monitoring Services.

2. Relationship with CRAs

Equifax and any other Credit Reference Agencies with whom we may work are independent companies who supply Credit Reports or Credit Scores to Pillar as part of Credit Monitoring Services. Personal information is subject to an independent controller arrangement between Pillar and Equifax. Pillar may collect your personal data from RightCard Payment Services Ltd when you provide your express consent.

3. Credit Monitoring-specific data

When you sign up for Credit Monitor, we collect and process:

  • Identification details (name, date of birth, address history, contact details) which we may receive from our affiliate company if you are already a LemFi customer.

  • Application data: information you provide when applying for our services.

  • Credit reference data: credit scores, credit reports, repayment history, public records (such as CCJs or insolvencies), and search footprints from Equifax.
    Financial data: information about your accounts, transactions, repayments, and payment mandates (where relevant to your use of LemFi Credit Products).

  • Technical and usage data: device identifiers, IP address, and app activity logs.

4. Credit Monitoring-specific sharing with Equifax

When you opt in to use the Credit Monitor Services, we share your name, date of birth and address with Equifax and any other CRAs so they can verify you as a natural person living in the United Kingdom before sharing your credit information with us. We may also share your email address with Equifax if needed for them to contact you directly, for example if you raise a dispute about your credit file.

5. How we use Credit Reference Agencies for Credit Monitoring

To provide Credit Monitoring Services, we will supply your personal information to CRAs and they will give us information about you including your credit score, credit report, and related credit file information. We use this information to provide Credit Monitoring Services to you, including displaying your credit score and report in the App.

6. Marketing based on credit data

Where you have consented, we may: contact you with information about other LemFi products or services that may interest you; use insights from your credit information (for example, your credit score or credit commitments) to identify products that are more likely to be relevant to you; and in some cases, check your eligibility for products offered by LemFi or our trusted partners using soft searches that do not impact your credit file.

7. Credit Monitoring-specific data retention

Pillar is required to keep a record of all the relevant information reported to the Credit Reference Agencies about you and any additional information retained for regulatory compliance for six years from the date you last used the Credit Monitoring Services.

8. Relevant third-party privacy notices

Please read the following privacy notices carefully:

Schedule 4: Savings Account Services

1. Data Controller

RightCard Payment Services Ltd is the data controller for personal data collected and processed in connection with the Savings Account Services.

2. Relationship with ClearBank

We provide Savings Account Services in conjunction with ClearBank. The associated processing of your personal data takes place on the basis of an Independent Controller arrangement between ClearBank and RightCard Payment Services Ltd. ClearBank is an independent, regulated and authorised financial institution which may process your use of the Savings Account linked to your personal and financial information. This includes:

  • Performing financial and any other suitability analysis on your personal or financial information.

  • Obtaining credit references or conducting verification of your financial information.

  • Accessing your bank account information via Open Banking to assess income, outgoings and affordability if required.

  • Determining suitability and eligibility for Savings Account Services.

  • Reviewing and managing customer Savings Accounts.

  • Managing collection and payments in and out of the Savings Account, including assigning interest.

  • Reviewing and approving Savings Account applications.

Please read ClearBank’s privacy conditions at: https://clear.bank/legal/privacy-notice

3. Savings-specific data categories

In addition to the general data categories set out in Part A section 4, when you use Savings Account Services we may also collect and process:

  • Open Banking data that you have authorised us to access.

  • Information collected from Credit Reference Agencies, Fraud Prevention Agencies and Account Information Service Providers.

  • Details of any savings accounts you hold or have held with us.

  • Information on transactions related to the Savings product to evaluate your use of our services.

4. How we use Credit Reference Agencies for Savings

To process your application for Savings Account Services, we may perform credit and identity checks on you with one or more CRAs. We may also make periodic searches at CRAs to manage your account with us. We use this information to assess your eligibility for the Savings Account Services, verify the accuracy of your data, prevent criminal activity, fraud and money laundering, and manage your account.

5. Savings-specific data use

In addition to the general processing purposes set out in Part A, personal data collected for Savings Account Services may be used for:

  • Processing and completing your application for a Savings Account and its continued use.

  • Making an initial decision and assessing your eligibility for the Savings Account Services.

  • Monitoring, reviewing and improving the content and appearance of our website and App.

  • Pre-populating fields on our site to make it easier for you to navigate as a returning customer.

  • Sharing your personal information amongst Pomelo Group Entities to provide or offer additional services.

6. Savings-specific sharing

In addition to the general sharing provisions in Part A section 8, for Savings Account Services we may share your data with:

  • ClearBank.

  • Credit Reference Agencies.

  • Account Information Service Providers.