Common use of Disclosure to and use by third parties Clause in Contracts

Disclosure to and use by third parties. As Kia Finance and SCUK are joint data controllers of your information, certain information is shared between us. Kia Finance uses your information to administer your finance application and the finance agreement. SCUK uses your information to undertake the underwriting process (for example, to conduct credit and fraud prevention checks and generally assessing lending risks) and to contact you about arrears and to recover monies owed to us, where applicable. We disclose your information to the following third parties: • Our group of companies * whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. • Credit reference agencies (including Experian, Call Credit, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0000 000 0000. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. • Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies). • Third party debt collecting agencies engaged by us to recover monies owed to us. • Any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information. • Your intermediary (or any intermediary that acquires your intermediary’s business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this. • Kia Motors UK Limited whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this. • Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services. • Outsourced service providers required for compliance with a legal or regulatory obligation, provision of your account service or for marketing activities where your consent has been provided. • Market research organisations engaged by us to undertake customer satisfaction surveys and market research. • Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations. • Any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event. Use by credit reference and fraud prevention agencies Please refer to the privacy statement provided to you when you applied for finance with us for more information about the credit reference and fraud prevention agencies that we use and what they do. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Automated decisions and profiling As part of the processing of your information, decisions may be made by automated means. Please refer to the privacy statement provided to you when you applied for finance with us for more information about our use of automated decisions when you make an application for finance. Alternatively you can view a copy of this application privacy statement at www.kiafinance. xx.xx. During the term of the finance agreement we have with you, we may also conduct automated processing of your information in other ways. In particular, we may use automated processing to analyse or predict (amongst others) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your information. For instance, we might do an analysis of certain customer demographics (such as your characteristics). We may also analyse triggers and events such as the maturity dates of your accounts and opening anniversaries. In some instances we may carry out automated processing and decision making to do behavioural scoring, including by looking at the accounts and products you already have with us and how they are being conducted, such as account activity, arrears and other indications of financial difficulties. We will do this where this information is relevant to the product that we think you might be interested in. This will help us to decide whether other products and services might be suitable and appropriate for you. All of this includes an element of automated processing. We will use the information gleaned from this activity to: (i) send direct marketing communications to you where you have consented to this; and (ii) decide which of our other products and services might be suitable and appropriate for you, including those which are offered by us, or by us in conjunction with our partners, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, when you receive them and what marketing activity is conducted by us or one of our third parties. In addition, when we provide a product or service to you, we take into account other information that we hold about you, including how you use this and other accounts you have with us or our group of companies. Data anonymisation and use of aggregated information Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies and Kia Motors UK Limited. Retention of your information If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have. Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed. Please refer to the privacy statement provided to you when you applied for finance with us for more information about the information that we give to credit reference agencies. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years. We may hold your information for a longer or shorter period from that described above where: • the law requires us to hold your personal information for a longer period, or delete it sooner; • you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and • in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place. Transfers to third countries/ where we store your information We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law. Your rights You have the following rights (which may not always apply or be subject to certain circumstances): • to be informed about the processing of your information (this is what this statement sets out to do); • to have your information corrected if it’s inaccurate and to have incomplete information completed; • to object to processing of your information; • to restrict processing of your information; • to have your information erased; • to request access to your information and information about how we process it; • to move, copy or transfer your information (“data portability”); and • rights relating to automated decision making, including profiling. More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at xxx.xxxxxxxxxx.xx.xx or by requesting a copy via email from xxxxxxxxxxxxxxxx@xxxxxxxxxxxx.xx.xx or calling our customer services team on 0800 085 1925. If you would like to discuss or exercise any of these rights, please contact us by writing to 00 Xxxxxxx Xxxx, Xxxxxxx, XX0 0XX or using the above contact information. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns by writing to XXX@xxxxxxxxxx.xx.xx or Floor 2 London Court, 00 Xxxxxx Xxxx, Xxxxxxx, Xxxxxx XX0 0XX. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.

Disclosure to and use by third parties. As Kia Genesis Finance and SCUK are joint data controllers of your information, certain information is shared between us. Kia Genesis Finance uses your information to administer your finance application and the finance agreement. SCUK uses your information to undertake the underwriting process (for example, to conduct credit and fraud prevention checks and generally assessing lending risks) and to contact you about arrears and to recover monies owed to us, where applicable. We disclose your information to the following third parties: • Our group of companies * whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. • Credit reference agencies (including Experian, Call Credit, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0000 000 0000. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xxxxx.xxxxxxxxxxxxxxxx.xxx. • Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies). • Third party debt collecting agencies engaged by us to recover monies owed to us. • Any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information. • Your intermediary (or any intermediary that acquires your intermediary’s business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this. • Kia Genesis Motors UK Limited whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this. • Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services. • Outsourced service providers required for compliance with a legal or regulatory obligation, provision of your account service or for marketing activities where your consent has been provided. • Market research organisations engaged by us to undertake customer satisfaction surveys and market research. • Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations. • Any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event. Use by credit reference and fraud prevention agencies Please refer to the privacy statement provided to you when you applied for finance with us for more information about the credit reference and fraud prevention agencies that we use and what they do. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Automated decisions and profiling As part of the processing of your information, decisions may be made by automated means. Please refer to the privacy statement provided to you when you applied for finance with us for more information about our use of automated decisions when you make an application for finance. Alternatively you can view a copy of this application privacy statement at www.kiafinance. xx.xx. During the term of the finance agreement we have with you, we may also conduct automated processing of your information in other ways. In particular, we may use automated processing to analyse or predict (amongst others) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your information. For instance, we might do an analysis of certain customer demographics (such as your characteristics). We may also analyse triggers and events such as the maturity dates of your accounts and opening anniversaries. In some instances we may carry out automated processing and decision making to do behavioural scoring, including by looking at the accounts and products you already have with us and how they are being conducted, such as account activity, arrears and other indications of financial difficulties. We will do this where this information is relevant to the product that we think you might be interested in. This will help us to decide whether other products and services might be suitable and appropriate for you. All of this includes an element of automated processing. We will use the information gleaned from this activity to: (i) send direct marketing communications to you where you have consented to this; and (ii) decide which of our other products and services might be suitable and appropriate for you, including those which are offered by us, or by us in conjunction with our partners, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, when you receive them and what marketing activity is conducted by us or one of our third parties. In addition, when we provide a product or service to you, we take into account other information that we hold about you, including how you use this and other accounts you have with us or our group of companies. Data anonymisation and use of aggregated information Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies and Kia Motors UK Limited. Retention of your information If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have. Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed. Please refer to the privacy statement provided to you when you applied for finance with us for more information about the information that we give to credit reference agencies. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years. We may hold your information for a longer or shorter period from that described above where: • the law requires us to hold your personal information for a longer period, or delete it sooner; • you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and • in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place. Transfers to third countries/ where we store your information We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law. Your rights You have the following rights (which may not always apply or be subject to certain circumstances): • to be informed about the processing of your information (this is what this statement sets out to do); • to have your information corrected if it’s inaccurate and to have incomplete information completed; • to object to processing of your information; • to restrict processing of your information; • to have your information erased; • to request access to your information and information about how we process it; • to move, copy or transfer your information (“data portability”); and • rights relating to automated decision making, including profiling. More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at xxx.xxxxxxxxxx.xx.xx or by requesting a copy via email from xxxxxxxxxxxxxxxx@xxxxxxxxxxxx.xx.xx or calling our customer services team on 0800 085 1925. If you would like to discuss or exercise any of these rights, please contact us by writing to 00 Xxxxxxx Xxxx, Xxxxxxx, XX0 0XX or using the above contact information. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns by writing to XXX@xxxxxxxxxx.xx.xx or Floor 2 London Court, 00 Xxxxxx Xxxx, Xxxxxxx, Xxxxxx XX0 0XX. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.

Disclosure to and use by third parties. As Kia Genesis Finance and SCUK are joint data controllers of your information, certain information is shared between us. Kia Genesis Finance uses your information to administer your finance application and the finance agreement. SCUK XXXX uses your information to undertake the underwriting process (for example, to conduct credit and fraud prevention checks and generally assessing lending risks) and to contact you about arrears and to recover monies owed to us, where applicable. We disclose your information to the following third parties: • Our group of companies * whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. • Credit reference agencies (including Experian, Call Credit, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0000 000 0000. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xxxxx.xxxxxxxxxxxxxxxx.xxx. • Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies). • Third party debt collecting agencies engaged by us to recover monies owed to us. • Any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information. • Your intermediary (or any intermediary that acquires your intermediary’s business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this. • Kia Genesis Motors UK Limited whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this. • Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services. • Outsourced service providers required for compliance with a legal or regulatory obligation, provision of your account service or for marketing activities where your consent has been provided. • Market research organisations engaged by us to undertake customer satisfaction surveys and market research. • Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations. • Any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event. Use by credit reference and fraud prevention agencies Please refer to the privacy statement provided to you when you applied for finance with us for more information about the credit reference and fraud prevention agencies that we use and what they do. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Automated decisions and profiling As part of the processing of your information, decisions may be made by automated means. Please refer to the privacy statement provided to you when you applied for finance with us for more information about our use of automated decisions when you make an application for finance. Alternatively you can view a copy of this application privacy statement at www.kiafinance. xx.xx. During the term of the finance agreement we have with you, we may also conduct automated processing of your information in other ways. In particular, we may use automated processing to analyse or predict (amongst others) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your information. For instance, we might do an analysis of certain customer demographics (such as your characteristics). We may also analyse triggers and events such as the maturity dates of your accounts and opening anniversaries. In some instances we may carry out automated processing and decision making to do behavioural scoring, including by looking at the accounts and products you already have with us and how they are being conducted, such as account activity, arrears and other indications of financial difficulties. We will do this where this information is relevant to the product that we think you might be interested in. This will help us to decide whether other products and services might be suitable and appropriate for you. All of this includes an element of automated processing. We will use the information gleaned from this activity to: (i) send direct marketing communications to you where you have consented to this; and (ii) decide which of our other products and services might be suitable and appropriate for you, including those which are offered by us, or by us in conjunction with our partners, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, when you receive them and what marketing activity is conducted by us or one of our third parties. In addition, when we provide a product or service to you, we take into account other information that we hold about you, including how you use this and other accounts you have with us or our group of companies. Data anonymisation and use of aggregated information Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies and Kia Motors UK Limited. Retention of your information If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have. Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed. Please refer to the privacy statement provided to you when you applied for finance with us for more information about the information that we give to credit reference agencies. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years. We may hold your information for a longer or shorter period from that described above where: • the law requires us to hold your personal information for a longer period, or delete it sooner; • you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and • in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place. Transfers to third countries/ where we store your information We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law. Your rights You have the following rights (which may not always apply or be subject to certain circumstances): • to be informed about the processing of your information (this is what this statement sets out to do); • to have your information corrected if it’s inaccurate and to have incomplete information completed; • to object to processing of your information; • to restrict processing of your information; • to have your information erased; • to request access to your information and information about how we process it; • to move, copy or transfer your information (“data portability”); and • rights relating to automated decision making, including profiling. More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at xxx.xxxxxxxxxx.xx.xx or by requesting a copy via email from xxxxxxxxxxxxxxxx@xxxxxxxxxxxx.xx.xx or calling our customer services team on 0800 085 1925. If you would like to discuss or exercise any of these rights, please contact us by writing to 00 Xxxxxxx Xxxx, Xxxxxxx, XX0 0XX or using the above contact information. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns by writing to XXX@xxxxxxxxxx.xx.xx or Floor 2 London Court, 00 Xxxxxx Xxxx, Xxxxxxx, Xxxxxx XX0 0XX. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.

Disclosure to and use by third parties. As Kia Finance and SCUK are joint data controllers of your information, certain information is shared between us. Kia Finance uses your information to administer your finance application and the finance agreement. SCUK uses your information to undertake the underwriting process (for example, to conduct credit and fraud prevention checks and generally assessing lending risks) and to contact you about arrears and to recover monies owed to us, where applicable. We disclose your information to the following third parties: •  Our group of companies * whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. •  Credit reference agencies (including Experian, Call Credit, Equifax and Delphi) and fraud prevention agencies. Please refer to the privacy statement provided to you when you applied for finance with us for further information about these agencies and what they do – you can also contact us on 0000 000 0000. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. •  Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies). •  Third party debt collecting agencies engaged by us to recover monies owed to us. •  Any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information. •  Your intermediary (or any intermediary that acquires your intermediary’s business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this. •  Kia Motors UK Limited whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this. •  Third parties acting on our behalf, such as back-up and server hosting providers, IT software and maintenance providers and their agents and third parties that provide income verification services, affordability checks and communication fulfilment services. •  Outsourced service providers required for compliance with a legal or regulatory obligation, provision of your account service or for marketing activities where your consent has been provided. •  Market research organisations engaged by us to undertake customer satisfaction surveys and market research. •  Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations. •  Any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event. Use by credit reference and fraud prevention agencies Please refer to the privacy statement provided to you when you applied for finance with us for more information about the credit reference and fraud prevention agencies that we use and what they do. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Automated decisions and profiling As part of the processing of your information, decisions may be made by automated means. Please refer to the privacy statement provided to you when you applied for finance with us for more information about our use of automated decisions when you make an application for finance. Alternatively you can view a copy of this application privacy statement at www.kiafinance. xx.xxxxx.xxxxxxxxxx.xx.xx. During the term of the finance agreement we have with you, we may also conduct automated processing of your information in other ways. In particular, we may use automated processing to analyse or predict (amongst others) your economic situation, personal preferences, interests or behaviour. This could mean that automated decisions are made about you using your information. For instance, we might do an analysis of certain customer demographics (such as your characteristics). We may also analyse triggers and events such as the maturity dates of your accounts and opening anniversaries. In some instances we may carry out automated processing and decision making to do behavioural scoring, including by looking at the accounts and products you already have with us and how they are being conducted, such as account activity, arrears and other indications of financial difficulties. We will do this where this information is relevant to the product that we think you might be interested in. This will help us to decide whether other products and services might be suitable and appropriate for you. All of this includes an element of automated processing. We will use the information gleaned from this activity to: (i) send direct marketing communications to you where you have consented to this; and (ii) decide which of our other products and services might be suitable and appropriate for you, including those which are offered by us, or by us in conjunction with our partners, or by the Santander group of companies. This means that automated decisions and processing can help to determine what marketing communications you receive, when you receive them and what marketing activity is conducted by us or one of our third parties. In addition, when we provide a product or service to you, we take into account other information that we hold about you, including how you use this and other accounts you have with us or our group of companies. Data anonymisation and use of aggregated information Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. It might be used to conduct research and analysis, including to produce statistical research and reports. This aggregated data may be shared in several ways, including with our group companies and Kia Motors UK Limited. Retention of your information If your application for finance is declined or if your application is accepted but you do not proceed, we keep your information for 6 months or as long as necessary to deal with any queries you may have. If your application is accepted and you proceed, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have. Credit reference agencies will retain the account information that we give to them for 6 years after your account is closed. Please refer to the privacy statement provided to you when you applied for finance with us for more information about the information that we give to credit reference agencies. Alternatively you can view a copy of this application privacy statement at xxx.xxxxxxxxxx.xx.xx. Fraud prevention agencies can hold your information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your information can be held for up to 6 years. We may hold your information for a longer or shorter period from that described above where: •  the law requires us to hold your personal information for a longer period, or delete it sooner; •  you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and •  in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place. Transfers to third countries/ where we store your information We store your information on servers located within the European Economic Area (EEA). The third parties listed under ‘Disclosure to and use by third parties’ may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law. Your rights You have the following rights (which may not always apply or be subject to certain circumstances): •  to be informed about the processing of your information (this is what this statement sets out to do); •  to have your information corrected if it’s inaccurate and to have incomplete information completed; •  to object to processing of your information; •  to restrict processing of your information; •  to have your information erased; •  to request access to your information and information about how we process it; •  to move, copy or transfer your information (“data portability”); and •  rights relating to automated decision making, including profiling. More information on your data subject rights and how to exercise these rights can be found in the ‘Using my information’ booklet available at xxx.xxxxxxxxxx.xx.xx or by requesting a copy via email from xxxxxxxxxxxxxxxx@xxxxxxxxxxxx.xx.xx xxxxxxxxxxxxxxxx@xxxxxxxxxx.xx.xx or calling our customer services team on 0800 085 1925. If you would like to discuss or exercise any of these rights, please contact us by writing to 00 Xxxxxxx Xxxx, Xxxxxxx, XX0 0XX or using the above contact information. We encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have. You can also contact our DPO with any data protection concerns by writing to XXX@xxxxxxxxxx.xx.xx or Floor 2 London Court, 00 Xxxxxx Xxxx, Xxxxxxx, Xxxxxx XX0 0XX. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK’s Data Protection Officer or customer services department, as appropriate. You have the right to complain to the Information Commissioner’s Office where your data has or is being used in a way that you believe does not comply with data protection laws.