Monday - Friday: 8am - 8pm • Saturday: 8am - 6pm • Sunday: 11am - 5pm
Local Call Centre: 0345 08 08 500 • metrobankonline.co.uk • MetroBank_Help
Metro Bank PLC is registered in England and Wales, company number: 6419578. Registered office: One Southampton Row, London, WC1B 5HA. We are authorised by the Prudential Regulation
Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority. ‘Metrobank’ is the registered trade mark of Metro Bank PLC.
137 AF PR000430 (12/20)
pg 8
Trust Account Opening Form and Mandate (continued)
11. PRIVACY NOTICE (continued)
We may also rely on other bases (for example, where the processing is necessary in the performance of a task carried out in the public interest or
in order to protect your vital interests or those of another person or where you have given your consent) on an exceptional basis, where none of
the above apply.
Sensitive personal data
We may collect a limited amount of Special Category Personal data (revealing racial or ethnic origin, religious or philosophical beliefs, trade union
membership, genetic data, biometric data (where that information is used to identify an individual), information concerning physical or mental
health, an individual's sex life or sexual orientation (in order to make appropriate accommodations or adjustments), or to provide biometric
identification services. When we do so, we will explain to you why we need it, and obtain your consent to use it for the relevant purpose.
To the extent permitted by applicable laws, we may collect and process a limited amount of information regarding criminal convictions and
offences and related proceedings (including information relating to allegations and suspicions of criminal offences).
Further processing
If we determine that your personal data is to be used for a new purpose, we will inform you beforehand.
Sharing your information
Your personal information may be shared with third party service providers, including companies belonging to the Metro Bank group, which may
provide products or services to you or us.
We will only share your personal data where necessary and where we have a lawful basis for doing so (for the purposes previously outlined).
Recipients of your personal data include:
• Other parties connected to your account (i.e. joint account holders)
• Credit reference agencies (please see section below)
• Our service providers (such as payment processors, IT service providers, email service providers and web analytics providers)
• Specific subcontractors who help to provide you with the services you have requested
• Tax authorities, regulatory authorities, law enforcement agencies and fraud prevention agencies
• Our insurers, lawyers, auditors, consultants and other professional advisers
• Other banks or financial institutions (where you ask us to share your personal data, or where we are asked to confirm your identity for the
purposes of preventing or investigating financial crime)
• If you want to use our referral to selected third parties to get discounts for their services, or where you want to take advantage of our
functionality to import or export your banking data
• Third parties where you have consented for us to share your data with them.
These recipients may be located in countries around the world (please see “Processing Personal Data outside of the EU (EEA) and UK”).
The personal information we have collected from you will be shared with fraud prevention agencies, who will use it to prevent fraud and money
laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how
your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found at www.cifas.org.uk/FPN.
Your rights
You have specific rights over your personal data, as explained below. These may not apply in all circumstances – we will let you know where this
is the case.
• Data subject access request
• Rectification of inaccurate personal data
• Erasure of personal data
• Restricting processing of personal data
• Right of portability
• Object to the processing of your personal data
• Right not to be subject to automated decision-making
• Right to withdraw consent.
You can exercise your rights by contacting us on 0345 08 08 500, in writing using the contact details given at the top of this document,
or by visiting one of our stores.
We will respond to your request within one calendar month. We may need to confirm your identity before processing your request. If
you can’t give us satisfactory proof of your identity, we have the right to refuse your request. We also have the right to reject requests
that are manifestly unfounded or excessive.
For more information on how we process your personal data, please see our website Privacy Notice
https://www.metrobankonline.co.uk/about-us/privacy-and-security/
Who are we?
Metro Bank PLC (“Metro Bank”, “we” or “us”), registered in England and Wales, company number: 6419578.
We are a controller for the processing activities specified in this Privacy Notice that relate to your personal data.
This Privacy Notice also explains how other parties, including companies belonging to the Metro Bank group, may use your personal data
excluding any products, applications or services that have separate privacy notices which do not incorporate this Privacy Notice.
If you have any questions about this Privacy Notice, or would like more information about how we use your personal data or to exercise any of
your data subject rights (see “Your rights”), please contact our Data Protection Officer:
Write to: Data Protection Officer
Metro Bank PLC
One Southampton Row
London, WC1B 5HA
Email: DataProtectionOfficer@metrobank.plc.uk
If you are unhappy with our management of your information, you have the right to lodge a complaint with the Information Commissioner’s Office.
Please visit www.ico.org.uk for more information.
Our collection and retention of personal data
Personal data includes any information that directly or indirectly (whether alone or in conjunction with other information) identifies you (or
someone else). This includes information such as your name, address and contact details, but also includes, for example, any photograph we
have of you (e.g. when you provide us with a selfie and a copy of a photo ID as part of the account opening process), online identifiers such as IP
address or device ID, and location data.
The personal data we hold about you is limited to information that:
• You have given us directly, for example when you apply for an account or contact us (eg a copy of your ID, a selfie and your contact
information, or details of your query or complaint)
• We capture through the use of CCTV when you visit one of our stores
• We record and monitor through our telephone calls to help improve the products and services we offer
• We receive from trusted third parties during eligibility checks
• We collect during the provision of our contracted services to you (e.g. your account details, and details of your transactions and interactions with us)
• We, or third parties acting on our behalf (such as Google Analytics), automatically collect when you use our website or interact with our emails
(in each case, with your consent, where necessary). Examples of data collected include your IP address, browser type referral source,
information about which parts of our page you have visited and how long you spent on them, the preferences you have set, and whether you
have opened our emails
• We occasionally obtain personal data from publicly available sources, such as social media sites (e.g. we may collect your name and
comments where you mention us in a post) and Government registers (e.g. Companies House).
Where we ask you to provide personal data to us on a mandatory basis, we will tell you at the time of collection. In the event that particular
personal data is required by the contract or law, this will be made clear. We will also explain the consequences of any failure to provide any
mandatory personal data: for example, if you can’t show us proof of identity, this will mean that we can’t open an account for you.
If you open an account with us and you are under 18, we may also collect personal data that directly or indirectly identifies your parent or legal
guardian who helped you open an account. We may use and keep their personal data only for the purposes of checking your identity. You must
not give us personal data about someone else (such as a joint applicant or a parent or guardian) without first getting their permission for it to be
used and released. We will assume that that person has given permission, although we may still ask for confirmation.
At the end of your relationship with us (for example, if you decide to close your account), we retain your personal data for as long as required to
meet our legal and regulatory obligations. Where retention is based on other reasons, we will retain it for no more than seven years, in line with
our data retention policy.
The purposes and lawful basis for our collection of personal data
Your personal data is collected and processed for business and compatible purposes, in accordance with applicable laws and as set out below.
Personal data may occasionally be used for purposes not obvious to you where the circumstances warrant such use (e.g. in fraud investigations
or similar).
We generally process your personal data under one of the following legal bases:
• Our legitimate business interests (described in the section below), except where these are overridden by your interests or fundamental rights
and freedoms which require protection of personal data (“Legitimate Interests”)
• Compliance with our legal obligations (“Legal Obligation”)
• For the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract
(“Contractual Performance”).