In this Privacy Notice:

Data Protection Legislation means the General Data Protection Regulation ("GDPR") and UK Data Protection Act 2018; together with all other applicable and national implementing legislation relating to privacy or data protection; and where we use the terms "personal data", "data subject", "controller", "processor" and "process" (and its derivatives), such terms shall have the meanings given to them in the Data Protection Legislation.

INTRODUCTION

ICICI Bank UK PLC (ICICI Bank) is committed to keeping your personal data private. We shall process any personal data we collect from you in accordance with Data Protection Legislation and the provisions of this Privacy Notice. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

DATA CONTROLLER

For the purpose of the GDPR ICICI Bank is the data controller of your information. This means that we are responsible for deciding how we hold and use your personal data. We are required under Data Protection Legislation to notify you of the information contained in this Privacy Notice.

DATA PROTECTION OFFICER

We have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal data, please contact the DPO at the contact details set out below. Ms Nalini Modi, The Data Protection Officer, ICICI Bank UK PLC, One Thomas More Square, London, E1W 1YN.

COLLECTING INFORMATION FROM YOU

ICICI Bank will collect and process your personal data you provide us through application forms, Bank or service provider’s website, face-to-face and electronic communication (including telephone conversations) in order to provide our services to you.

THE KIND OF INFORMATION WE HOLD ABOUT YOU

We may collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Date of birth
• Gender
• Employment status and salary
• Marital status and dependants
• Financial information
• Pay records
• Location of employment or workplace
• Copies of driving licences or other IDs like passports
• Information we obtain from third parties, such as information that we obtain when verifying details supplied by you and information collected from publicly available sources such as Companies House. Such third parties may include fraud prevention agencies, banks, merchants and credit reference agencies.
• Other information about an individual that you or they disclose to us when communicating with us
• CCTV footage and other information obtained through electronic means
• Photographs
• IP addresses
• Cookies (please see our COOKIES policy )

In addition we may collect, store and use following information about you while you access your bank account with us through the imobile app:

• Bayuserid
• First name
• Middle name
• Last name
• MPIN - Storing in base64 encoded format.
• CIFNumber
• Password - Storing in base64 encoded format.
• WLDevice ID
• Device model
• Device OS version
• Device OS Type
• Last login success date
• First activated date
• Last reactivated date
• Special category data and/or - data/details relating to your health, marital or partnership status (e.g. any kind of vulnerability, health condition )

Please note, however, that in certain circumstances it may be still lawful for us to continue processing this information even where consent has been withdrawn, if one of the other legal bases described below is applicable.

LAWFUL GROUNDS FOR USING YOUR INFORMATION

We are permitted to process your personal data in compliance with Data Protection Legislation by relying on one or more of the following lawful grounds:

• You have explicitly agreed to us processing such information for a specific reason.
• The processing is necessary to perform the agreement we have with you or to take steps to enter into an agreement with you.
• The processing is necessary for compliance with a legal obligation we have.
• The processing is necessary for the purposes of a legitimate interest pursued by us, which might be:
• to provide services to you;
• to ensure that our customer accounts are well-managed;
• To prevent, detect, investigate and prosecute fraud and alleged fraud, money laundering and other crimes and to verify your identity in order to protect our business and to comply with laws that apply to us and/or where such processing is a contractual requirement of the services or financing you have requested;
• to protect our business interests;
• to ensure that complaints are investigated;
• to evaluate, develop or improve our services; or
• to keep our customers informed about relevant services, unless you have indicated at any time that you do not wish us to do so.

PURPOSES OF PROCESSING

Specifically, we and our other group companies may use your information for the following purposes and under the following legal bases:

AUTOMATED DECISION MAKING

If you apply to us for a product, your application may be processed by an automated decision-making process which may carry out credit and affordability assessment checks to determine whether your application will be accepted. Where these automated processes suggest that your application should be rejected, we will manually review your application before making a final decision. We may also use automated processes to decide credit limits.

We may also carry out automated anti-money laundering and sanctions checks. This means that we may automatically decide that you pose a fraud or money laundering risk if the processing reveals your behaviour to be consistent with that of known fraudsters or money launderers, is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk: (i) we may refuse to provide the services you have requested, or we may stop providing existing services to you; and (ii) a record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services or employment to you.

If you have any questions about this, please contact us on the details set out below.

INFORMATION SHARING

We keep all your personal data confidential. However, in order to be able to service your needs to the best of our ability, we may share any information you provide to us with our group companies and their agents, counterparties and support service or data providers, wherever located. If you have provided information to other members of our group, those entities may also share that information with us. We will ensure that if we share such information with third parties, any such disclosure is at all times in compliance with Data Protection Legislation.

To help us provide services, your data will be processed internally and externally by other third parties. We use third parties for [administrative, servicing, monitoring and storage of your data]. We will outsource some services to third parties whom we consider capable of performing the required processing activities so that there is no reduction in the service standard provided to you by us.

The recipients or categories of recipients, of your information may be:

• Any revenue service or tax authority including to HMRC, if obliged to do so under applicable regulations. For Common Reporting Standards and FATCA, we may also have to report your account(s) to the necessary tax authorities.
• UK and overseas regulators and authorities in connection with their duties (such as crime prevention).
• Anyone to whom we may transfer our rights and/or obligations;
• Any other person or organisation after a restructure, sale or acquisition, as long as that person uses your information for the same purposes as it was originally given to us or used by us (or both).
• Credit reference, identity and address verification organisations who may record and use your information and disclose it to other lenders, financial services organisations and insurers. Your information may be used by those third parties to make assessments in relation to your creditworthiness. ICICI Bank UK PLC uses professional services of below Credit Reference Agencies (CRA) and privacy notice of these agencies will also be applicable in addition to the Bank’s privacy notice with respect to Data Protection regulations and guidelines. Please refer Credit Reference Agency Information Notice (CRAIN) link given below of the respective CRA for more details. We perform identity checks on you with one or more credit reference agencies. To do this, we will supply your personal data to the credit reference agencies and they will give us information about you. We will also continue to exchange information about you with credit reference agencies while you have a relationship with us.
  
  Examples of circumstances when your information will be shared include:
  
  
  • Checking your identity on a regular basis to comply with regulations and the law
  • Providing identity check services to you where you have requested that the government, or another third party, confirms your identity

Credit Reference Agency	Contact Details
Experian Limited (https://experian.co.uk/crain)	Post: Experian, PO BOX 9000, Nottingham NG80 7WF. Website: https://ins.experian.co.uk/contact Email: consumer.helpservice@uk.experian.com Phone: 0344 481 0800 or 0800 013 8888

• Fraud prevention agencies and law enforcement agencies who will use it to prevent fraud and money-laundering and to verify your identity if false or inaccurate information is provided by you and fraud is identified. We, fraud prevention agencies and law enforcement agencies may access and use your information for example, when:
• Checking details on applications for credit and credit related or other facilities;
• Managing credit and credit related accounts or facilities;
• Recovering debt;
• Checking details on proposals and claims for all types of insurance.

Fraud prevention agencies can hold your personal data for different periods of time. If they’re concerned about a possible fraud or money laundering risk, your data can be held by them for up to six years.

Privacy policy – ICICI Bank Google Pay

Mobile Payment / Payment through Mobile Apps

This privacy policy explains how your personal data is used in Google Pay “The Service”. This is in addition to the uses of your personal data described in your account terms and conditions and the data protection statement. You should read this alongside the Google Pay Terms and Conditions. 

We collect information about you when you register for and use The Service. This may include your phone number and details of your transactions. Contact and shipping details are also captured for Google Pay transactions over the internet.

If you register your ICICI Bank debit or credit cards for The Service, you agree for your personal and transactional data to be used and shared as set out below.

Using your personal data

You agree that:

• ICICI Bank UK Plc ('ICICI Bank') will collect and use your personal data to verify your ICICI Bank card(s) and to facilitate your use of The Service once you’ve registered your card as a Digital Card. Information about your Digital Card and your latest transactions will be stored on your Android device so you can make contactless or in-app transactions.

• Your information will be used to deal with Google Pay queries, authorise payments, prevent and detect fraud, comply with legal requirements and industry standards, and to help ICICI Bank develop, maintain, and improve our products and services. We’ll use your details to send you service messages about The Service via notifications, email/SMS and post.

Sharing your personal data

You agree that:

• Your Digital Card data, and contact and shipping details for Google Pay in-app transactions can be shared with retailers so they can deal with your transactions.

• We may share your personal data with the ICICI Bank Group, ICICI Bank’s associated companies, and service providers and agents acting under ICICI Bank’s instructions.

• Your transactional data may be shared with VISA so they can process the transaction and support the Digital Card provision.

• Transactional data may also be shared with Google and its Affiliates ('Google') so they can display the last 10 most recent transactions within Google Pay, comply with applicable law and regulations and further develop and promote Google Pay. If you’ve switched on location services, Google may see your locational data and may include the location of your last 10 transactions within Google Pay as well as details of the transaction itself. For more information on how Google will use your data, please see Google’s Privacy Policy.

Please note that ICICI Bank is not responsible for the security of The Service or any third party provider to Google. Any information you give them is covered by their own Terms and Conditions.

Privacy policy – ICICI Bank Apple Pay

Mobile Payment / Payment through Mobile Apps

This privacy policy explains how your personal data is used in the Apple Payment Service (Apple Pay). This is in addition to the uses of your personal data described in your account terms and conditions and the data protection statement. You should read this alongside the Apple Pay Terms and Conditions. 

We collect information about you when you register for and use Apple Pay. This may include your phone number and details of your transactions. Contact and shipping details are also captured for Apple Pay transactions over the internet.

If you register your ICICI Bank debit or credit cards for Apple Pay, you agree for your personal and transactional data to be used and shared as set out below.

Using your personal data

You agree that:

• ICICI Bank UK Plc (‘ICICI Bank’) will collect and use your personal data to verify your ICICI Bank card(s) and to facilitate your use of Apple Pay once you’ve registered your card as a Digital Card. Information about your Digital Card and your latest transactions will be stored on your Apple device so you can make contactless or in-app transactions.

• Your information will be used to deal with Apple Pay queries, authorise payments, prevent and detect fraud, comply with legal requirements and industry standards, and to help ICICI Bank develop, maintain, and improve our products and services. We’ll use your details to send you service messages about Apple Pay via notifications, email/SMS and post. 

Sharing your personal data

You agree that:

• Your Digital Card data, and contact and shipping details for Apple Pay in-app transactions can be shared with retailers so they can deal with your transactions.

• We may share your personal data with the ICICI Bank Group, ICICI Bank’s associated companies, and service providers and agents acting under ICICI Bank’s instructions.

• Your transactional data may be shared with VISA so they can process the transaction and support the Digital Card provision.

• If you’ve switched on location services, Apple (Apple Distribution International and Apple Inc.) may see your locational data. For more information, please see Apple’s Privacy Policy. 

Please note that ICICI Bank is not responsible for the security of the Apple Pay service or any third party provider to Apple. Any information you give them is covered by their own Terms and Conditions.

DETAILS OF DATA TRANSFERS OUTSIDE THE UK

Information about you in our possession may be transferred to other countries outside the United Kingdom (particularly to our parent company in India) for any of the purposes described in this Privacy Notice.

You and they understand and accept that these countries may have differing (and potentially less stringent) laws relating to the degree of confidentiality afforded to the information it holds and that such information can become subject to the laws and disclosure requirements of such countries, including disclosure to governmental bodies, regulatory agencies and private persons, as a result of applicable governmental or regulatory inquiry, court order or other similar process. In addition, a number of countries have agreements with other countries providing for exchange of information for law enforcement, tax and other purposes.

When we, or our permitted third parties, transfer information outside the United Kingdom, we or they will impose contractual obligations on the recipients of that data to protect such information to the standard required in the United Kingdom. We or they may require the recipient to subscribe to international frameworks intended to enable secure data sharing. In the case of transfers by us, we may also transfer your information where the transfer is to a country deemed to provide adequate protection of your information or you have consented to the transfer.

If we transfer your information outside the United Kingdom in other circumstances (for example because we have to provide such information by law), we will use best endeavours to put in place appropriate safeguards to ensure that your information remains adequately protected.

RETENTION AND DISPOSAL OF DATA AND OUTPUT

We will only keep the information we collect about you on our systems or with third parties for as long as required for the purposes set out above or as required to comply with any legal obligations to which we are subject. This will involve us regularly reviewing our files to check that information is accurate and up-to-date and still required.

We will normally destroy or erase data after statutory timelines lapse. However, we may retain your information, or information relating to your account after you cease to be a customer for longer than this, provided it is necessary for a legal, regulatory, fraud prevention or other legitimate business purpose.

STORAGE OF YOUR PERSONAL DATA AND DATA SECURITY

All information you provide to us is stored in our secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know basis. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Please read the section on our website relating to online security which can be accessed here http://www.icicibank.co.uk/personal/privacy-notice.page?

OUR COMMUNICATION WITH YOU

We may communicate with you via electronic mail (e-mail). We will never ask you for your password or account number.

When you contact us through any of our communication channels including visiting a local branch or calling the telephone banking service, we will verify your identity by asking you a number of questions based on information known to us about you and the transactions on your account. We may record your calls for training, quality and security purposes.

MARKETING INFORMATION

We and other members of our group may use your information from time to time to inform you by letter, telephone, text (or similar) messages, email or other electronic means, about similar services which may be of interest to you or them.

You may, at any time, request that we cease or do not send such information by one, some or all channels, by contacting us using the contact details set out below.

RIGHTS OVER YOUR PERSONAL DATA

Under certain circumstances, by law you have the right to:

• Be informed about the processing of your personal data (i.e. for what purposes, what types, to what recipients it is disclosed, storage periods, any third party sources from which it was obtained, confirmation of whether we undertake automated decision-making, including profiling, and the logic, significance and envisaged consequences).
• Object to your personal data being processed for a particular purpose or to request that we stop using your information.
• Request not to be subject to a decision based on automated processing and to have safeguards put in place if you are being profiled based on your personal data.
• Ask us to transfer a copy of your personal data to you or to another service provider or third party where technically feasible and otherwise required by applicable regulations.
• Withdraw, at any time, any consent that you have previously given to us for our use of your personal data.
• Ask us to stop or start sending you marketing messages at any time.
• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.
• Request the erasure of your personal data. This enables you to ask us to delete or remove personal data where you think that we do not have the right to process it.

Any request for access to or a copy of your personal data must be in writing and we will endeavour to respond within a reasonable period and in any event within one month in compliance with Data Protection Legislation. We will provide this information free of charge unless the request is manifestly unfounded or excessive. We will comply with our legal obligations as regards any individual’s rights as a data subject.

If you would like to contact us in relation to any of the rights set out above please contact us using the following contact details. To protect your privacy and security, we may take reasonable steps to verify your identity before providing you with the details.

Ms. Nalini Modi, The Data Protection Officer, ICICI Bank UK PLC, One Thomas More Square, London, E1W 1YN.

RIGHT TO COMPLAIN TO THE ICO

You can contact the ICO if you have any concerns about how the ICICI Bank has handled your personal data and you also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. You can contact the ICO via their helpline on 0303 123 1113. You can find out more information about your rights as a data subjects, their regulatory powers and actions they can take on their website https://ico.org.uk/

THIS PRIVACY NOTICE

The content or services mentioned on our website may be changed in future and consequently this Privacy Notice may also change. Any changes we may make to this Privacy Notice in the future will be posted on this page and where appropriate, notified to you by email. We recommend that you re-visit this page regularly and inform us if you do not agree to any term mentioned here.