Privacy Notice

Looking after your personal information is a responsibility we take really seriously. This notice explains how and why we use your information, and what we do to help keep it safe. It also sets out the rights you have when it comes to the information we hold about you.

You don’t have to share your information with us, but we won’t be able to offer you an account if you don’t.

The ‘data controller’ is us, Starling Bank Limited. Our company number is 09092149. Our registered office is at 5th Floor, London Fruit & Wool Exchange, 1 Duval Square, London, E1 6PW. You can contact our Data Protection Officer at privacy@starlingbank.com.

What types of information do you collect?

Information you give us

We collect information about you when you:

• download our app
• apply for an account
• use our app and Online Banking
• make and receive payments
• use our banking services
• visit our websites
• get in touch with us, including through the app, by phone, email, or on social media
• take part in customer research or competitions
• apply to or act as an account holder’s power of attorney

This information might include:

• your name and date of birth
• your photograph ID
• your address (and previous addresses), email address, and phone number
• transactional and financial information, including information about your income
• credit and debit card details
• personal descriptions and photographs
• video or audio files

We might also ask for information about someone else, like if you apply for a Kite Space for a child. If you give us information about someone else, you should let them know that you’ve done this.

Information from third parties

We also collect the types of information listed above from third parties, including:

• our debit card provider
• any companies you use through Marketplace
• our business partners
• sub-contractors in technical, payment, and delivery services
• advertising networks
• analytics providers
• search information providers
• credit reference agencies
• other lenders you use that we’re connected with, like peer-to-peer platforms or mortgage providers

Information from your device

We collect technical information from your device, including your:

• IP address
• login information
• browser type and version, as well as any plug-ins you have installed
• time zone
• operating system and platform
• mobile phone network

If you download the app, we’ll link your mobile number with the device you’ve used.

We also collect information from phone conversations we have with you, including:

• any phone number used to call us, including your phone number and anyone else’s that you use
• any forwarding numbers
• the time, date, and duration of calls
• the content of any calls
• the types of calls

We might also contact you by text message every now and again - like when we share security codes or to let you know we’ve sent you an in-app message. When we do this, we also collect the SMS routing information.

Information about how you use our websites

We collect information on how you use our websites, including:

• the URLs you click to get to, from, and around our website
• the date and time you click any URLs
• the products you view
• how long it takes the pages to respond
• any download errors
• how long you spend on pages
• how you interact with the pages, like where you scroll, click, and hover your mouse

We also use cookies on our websites. You can find more information about this in our cookie policy at https://www.starlingbank.com/legal/cookie-policy

Information about your location

We collect information about your location by using details like your IP address or GPS sensors.

Sensitive information

Every now and then, we might ask you for information that may seem sensitive. We’ll only ask for this when we really need to.

For example, we might need to use facial or voice recognition technology to identify you and protect your account from fraud. As part of our regulatory obligations, we might have to ask you if you have any criminal convictions. Or, if you tell us about a health issue or a difficult situation you’re in, we might ask for more information so that we can make any adjustments to your account that you might need.

How do you use my information?

We have to have a valid reason for using your information. This is called the ‘lawful basis for processing’.

How we use your information – and the lawful basis for using it – depends on the type of information we collect and the reason we collect it.

To operate as a bank

This includes:

• operating bank accounts and allowing you to make and receive payments (including through digital services like GooglePay, ApplePay, SamsungPay, GarminPay, and Click to Pay)
• making sure our app, websites, and services are relevant and give you the best experience they can
• keeping our business and your accounts safe
• training our teams, for which we might use recorded conversations
• resolving problems or answering your questions
• making sure we comply with the law and regulations
• sharing information with credit reference agencies and fraud prevention agencies
• sharing information with security organisations and agencies
• checking if you can work with or for us

The lawful basis for processing this information:

• legitimate interest: we use your data in a way you’d reasonably expect us to. In this case, to provide banking products and services, operate and improve Starling, provide service messages, keep records up to date and comply with legal duties, obligations and regulations that apply to us.
• legal obligation: to comply with the law or other regulation
• contract: we have a contract with you

To connect you to other providers through our Marketplace

This includes:

• operating our Marketplace
• sharing information about you with our partners that you connect with using Marketplace

The lawful basis for processing this information:

• consent: you’ve given us clear and informed consent to use your information for a specific reason
• legal obligation: to comply with legal duties, obligations and regulations that apply to us
• contract: we have a contract with you

To contact you or others

This includes:

• sharing information about our products and services, and letting you know about any changes to them
• sharing information about products and services our partners offer
• sending marketing communications you’ve consented to
• managing giveaways and competitions you take part in

The lawful basis for processing this information:

• legitimate interest: we use your data in a way you’d reasonably expect us to. In this case, to provide and offer products or services, and to operate and improve Starling
• legal obligation: to comply with the law or other regulation
• consent: you’ve given us clear and informed consent to use your information for a specific reason
• contract: we have a contract with you

To research and improve what we offer

This includes:

• measuring how effective, accessible, and commercial our products and services are
• using our findings to improve our products and services, and to inform our marketing communications

The lawful basis for processing this information:

• legitimate interest: we use your data in a way you’d reasonably expect us to. In this case, to provide products and services, and to operate and improve Starling.

Using sensitive information

We need a second lawful basis to be able to process sensitive information. This could include:

• if you or someone acting on your behalf has given us clear and informed consent
• to protect someone’s life
• if we’re carrying out a task to protect or improve your financial wellbeing, or to prevent illegal activity
• if it’s in relation to legal claims

Who do you share my information with?

There are certain organisations we might need to share your information with so we can do the things set out in the 'How do you use my information' section above. This includes:

Organisations we work and connect with

• Affiliated companies, including companies within our group
• Partners, suppliers, subcontractors
• Social media platforms
• Fraud prevention suppliers and analytics providers
• Google Maps and Google Earth

When you use Google Maps and Google Earth, you have to follow the Google Maps/Earth Additional Terms of Service. This includes Google’s privacy policy, which you can read at https://policies.google.com/privacy.

Organisations you can choose to give us permission to share with

• Open Banking providers you use
• Marketplace partners you use
• Organisations who’ve integrated with us through our API
• Other banks in connection with services we offer

Organisations that help to protect against fraud and reduce credit risk

• Credit reference agencies
• Fraud prevention agencies
• The Financial Services Compensation Scheme
• Tax authorities
• The police and other law enforcement agencies

For more information about how credit reference and fraud prevention agencies use your information, you can read their privacy policies at the following websites:

Credit reference agencies

• https://www.transunion.co.uk/crain
• https://www.equifax.co.uk/privacy-hub/crain
• http://www.experian.co.uk/crain/

Fraud prevention agencies

• https://www.cifas.org.uk/fpn
• https://www.synectics-solutions.com/privacy-policy
• https://www.napier.ai/privacy-policy

Our websites and app might sometimes contain links to the websites or apps of organisations we work and connect with. These websites and apps have their own privacy policies and we’re not responsible or liable for these. Please check their policies before you submit any information to these websites or apps

Do you make automated decisions about me?

We use systems to help us make certain decisions. We decide the level of automated decision-making we need on a case-by-case basis.

We use systems to help us make decisions on things like:

• whether to give you an account, or if a product or service is relevant for you
• detecting fraud or money-laundering, and taking action against it

To help us make these decisions, we use information from credit reference and fraud prevention agencies, as well as facial and voice recognition tools.

We also use credit scoring systems to help us decide whether to give you an overdraft, or offer you a higher overdraft limit. These systems work by taking into account information from credit reference agencies as well as information we already hold about you, and analysing how much money we can responsibly lend to you. They’re regularly reviewed to check they stay fair and effective.

If your application for an account, product or service is declined, you can ask for it to be reviewed in full by a human. To do this, send us a message in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not.

Do you apply artificial intelligence and machine learning to my data?

We use artificial intelligence as part of us operating as a bank (for example, during the account application process). We use it to extract information from your application and help us understand if we’re able to offer you an account or service.

We might also use machine learning:

• to prevent fraud
• to transcribe calls you have with us, or identify if you’ve asked us to access your personal information – we do this for training and quality purposes so we can improve the service we give our customers
• for other reasons from time to time, as long as we don’t use machine learning on its own to make a decision

How do you store my information and do you transfer it anywhere?

Where we can, we store and process your information using servers in the UK and European Economic Area (EEA). The servers are secure, and very few people have access to them. All your information stored on these servers is also encrypted, which makes it impossible for anyone who isn't authorised to read it.

The only times your information might go outside the UK and EEA are:

• if a supplier has to store or process it elsewhere, which only applies to a very small number of our suppliers. We try to avoid this, but when it does happen we put safeguards in place to help keep your information secure.
• if you’re outside the UK and EEA and make payments or send messages, or you’re in the UK and EEA and make payments or send messages to other places. If this happens, your information will be stored and processed in line with the countries’ own regulations, which might not be as rigorous as those in the UK and EEA.

We have appropriate technical and organisational measures in place to protect your information. Although we’ll always do our best to keep it safe once it reaches us, we’re not responsible if anything happens to it before that point.

How long do you hold my information for?

We usually keep your information for six years from the date you stop using Starling products or services, which is the minimum the law says we have to keep it for.

What are my rights?

The right to access

You have the right to access information we hold about you. To do this, send us a message in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not.

The right to update

You have the right to update information we hold about you so it’s correct. You can update your address, email address, and phone number in the app. To update any other details, get in touch with us.

We’ll also check in with you every year to make sure the information we hold about you is up-to-date.

The right to delete

You have the right to ask us to delete your information, but we might not always be able to for legal reasons. For example, if you’re applying to open an account and we’ve started checks with a credit reference agency, we have to keep your information to comply with the law and other regulations.

We’ll delete your information if you ask us to, unless:

• we need to keep it for any of the reasons set out in the How do you use my information? section
• we’re not reasonably able to permanently delete it
• you’ve shared the information for use on our website – this might stay publicly available
• you’ve shared the information with other companies, like our Marketplace partners – their own privacy policies will apply

To ask us to delete your information, send us a message in the app or email us at privacy@starlingbank.com.

The right to restrict processing

You can ask us to limit how we use your information. To do this, send us a message in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not.

We’ll do what you ask, unless:

• we need to use it for any of the reasons set out in the How do you use my information? section
• you’ve shared the information for use on our website – this might stay publicly available
• you’ve shared the information with other companies, like our Marketplace partners – their own privacy policies will apply

The right to object

You can ask us to stop using all or some of your information. To do this, send us a message in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not.

We’ll stop using the information you ask us to, unless:

• we need to use it for any of the reasons set out in the How do you use my information? section
• you’ve shared the information for use on our website – this might stay publicly available
• you’ve shared the information with other companies, like our Marketplace partners – their own privacy policies will apply

If you’ve consented to receiving marketing communications, you can withdraw this consent at any time. To do this, you can update your marketing preferences in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not. Any updates might not take effect immediately, so you might still get marketing communications from us for a short time afterwards.

The right to transfer

You can ask us to transfer information about you that you’ve given us to somewhere else. To do this, send us a message in the app if you’re a customer, or email us at privacy@starlingbank.com if you’re not.

We’ll usually transfer your information, but

• there are some reasons we might not be able to
• we might have to keep a copy of it

Either of these things might happen for any of the reasons set out in the How do you use my information? section.

We’ll usually respond to any requests relating to these rights within one calendar month. But if we receive several requests from you, or your request is complex or involves a lot of information, we might need up to three months to get back to you.

How do I make a complaint?

If you think we’ve broken data protection laws when it comes to your information, you can make a complaint. To do this, send an email with your name and details of your complaint to privacy@starlingbank.com. We’ll then investigate and let you know the outcome.

If you’re unhappy with the outcome, you can raise a complaint with the Information Commissioner’s Office (ICO). For more information about the ICO, visit https://ico.org.uk.

About this notice

We might update this notice from time to time. Any changes will become effective as soon as we post the updated version on our websites and app. If we make a significant change, we’ll let you know by email or in-app message.

If you have any questions about this notice, or suggestions on how to improve it, let us know at privacy@starlingbank.com.