Who we are?
Data Privacy Manager
- What Personal Data We Collect?
- Where we collect your personal data from?
- How do we use your personal data?
- Who we share your data with?
- How long do we keep your information?
- The law protects you
- Data and ATMs
- Third Party Links
- Sending Data outside of the EEA
- If you choose not to give this information
- Data Security
- Your Legal Rights
- How to get a copy of your information?
- How to complain?
- Possible future changes
What Personal Data Do We Collect?
|Contact Details||Your name, where you live, how to contact you i.e. email, phone|
|Financial||Bank account and sort code details|
|Contractual||Signed agreements for the services we provide you|
|KYC supporting documents||Details about you taken from documents such as passport number, driving license or birth certificate, utility bills.|
|Land Registry||Property details and names of Freehold/Leasehold ownership|
|Communication||What we find out about you from letters, phone calls and emails we received from you.|
|Consent||Any permissions or consent you have provided us.|
|Companies House||Business/organisation companies house information|
Where we collect your personal data from:
- When you complete a form on any of our group business web-sites
- When you enter into a contract with Cardtronics
- When you provide information in emails or letters
- When you speak to us on the phone
- When you apply for any of our services
- When you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies.
- Fraud prevention agencies
- Government and law enforcement agencies
- Public information sources including DVLA, Land Registry and Companies House
- Vetting and other agents working on our behalf
How do we use your personal data?
|Purpose/Activity||Type of data||Lawful basis for processing including basis of legitimate interest|
|To manage our relationship with you or your business, take orders, process and deliver products and services to you including complaint and dispute resolution. Managing how we work with other companies that provide services to us and our customers||Contact and identity data, documentation, financial data, usage and technical data||
(a) Performance of a contract with you e.g. making payments, service communications
(b) Necessary for our legitimate interests e.g. KYC
(c) legal duty – record retention
|To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)||Identity and contact data, technical and usage data||
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligation
|Security and risk management including detection and investigation and reporting of financial crime. Managing risk for us and our customers.||Contact and identity data, documentation, financial data, usage and technical data, CCTV images.||
(a) Performance of a contract
(b) Necessary for our legitimate interests including crime prevention and detection)
(c) legal duty
|To develop new ways to meet our customers’ needs and grow our business, develop new products and services.||Usage and technical data.||(a) Necessary for our legitimate interests|
- Internal Third Parties: other companies in the Cardtronics group acting as joint controllers or processors and who provide IT, system administration and other services to the group and its customers.
- External Third Parties: service providers, acting as processors who provide services to Cardtronics and its customers.
- Professional advisers acting as processors or joint controllers including lawyers, bankers, fraud and other crime prevention agencies, auditors and insurers.
- HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers who require reporting of certain activities.
- Agents and advisers who we use to help run your accounts and services, collect what you owe, and explore new ways of doing business
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
How long do we keep your information?
- To respond to any questions or complaints.
- To show that we treated you fairly.
- To maintain records according to rules that applies to us.
The law protects you
- To fulfil a contract we have with you, for example to make sure that we pay the right amounts to the right person
- When it is our legal duty to do so, including for instance retention of records for audit or other purposes, or
- When it is in our legitimate commercial or business interest, including for example for KYC or “know your client” purposes to ensure that we are contracting with the right person or organisation, or
- When you consent to it.
Data and ATMs
Third Party Links
Sending Data outside of the EEA
- Follow your instructions.
- Comply with a legal duty.
- Work with our agents and advisers who we use to help run your business accounts and services.
- Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. More information can be found here on the European Commission Justice website.
- Put in place a contract with the recipient (data processor) that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website,
- Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA. Further information can be found on the European Commission Justice website.
If you choose not to give this information
The personal information we have for you is made up of what you tell us, and data we collect when you use our services, or from third parties we work with.
We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest’. That is when we have a business or commercial reason to use your information. It must not unfairly go against what is right and best for you.
You can ask us to stop sending you marketing messages by contacting us at any time.
If you change your mind you can update your choices at any time by contacting us.
- Deter those having criminal intent;
- Assist in prevention and detection of crime;
- Facilitate with the identification, apprehension and prosecution of offenders;
- Monitor security of CTUK buildings and vehicles;
- Identify vehicle movement problems around CTUK buildings.
Your Legal Rights
Request a Copy of your Personal Data
Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Contact details are below.
Request correction of the personal data that we hold about you.
This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. Contact details are below.
Request erasure of your personal data.
This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which overrides your rights and freedoms. Contact details are below.
Request restriction of processing of your personal data.
This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. Contact details are below.
Request the transfer of your personal data to you or to a third party.
We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Contact details are below.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Contact details are below.
How to get a copy of your information
You can access your personal information we hold by filling in the form here or by writing to us at this address:Data Protection Team
Cardtronics UK Ltd,
PO Box 476,
We will respond to Subject access requests within 30 days.