Privacy Policy

Introduction

This policy applies to all Cash.je’s operations. It applies to our websites, registration process, products or services that link to this policy or do not have a separate privacy policy.

The purpose of this privacy policy is to give you a better understanding of:

• what information we collect;
• how we use that information;
• how this information is shared;
• your rights and other useful privacy and security related matters.

We hope you take the time to read this policy. It is important to check back often for updates to this policy. If we make changes we consider to be important, we will let you know by placing a notice on the relevant service.

WHO IS THE DATA CONTROLLER?

Rock Box Media Limited, 9 Bond Street, St Helier, Jersey, JE2 3NP.

THE DATA PROTECTION OFFICER (DPO)

Rock Box Media Limited has appointed a Data Protection Officer (DPO). Our Customer Service team will be your initial point of contact if you wish to exercise your rights. Please see the ‘Your rights’ section below. You can contact our DPO at [email protected].

WEBSITE VISITORS

Like most website operators, we collect non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request. Our purpose in collecting non- personally identifying information is to better understand how visitors use our website.

We also collect potentially personally-identifying information like Internet Protocol (IP) addresses for users completing forms on our website. We only disclose logged in user IP addresses under the same circumstances that we use and disclose personally-identifying information as described below.

We may also collect statistics about the behaviour of visitors to our website. For instance, we may monitor the most popular pages on the site. We do not display this information publicly or provide it to others.

COOKIE COLLECTION

A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. We use cookies to help identify and track visitors, their usage of the website, and their website access preferences. Visitors to the website who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using our website, with the drawback that certain features of the website may not function properly without the aid of cookies.

3RD-PARTY COOKIES USED ON THIS SITE:

Google Analytics

Google Analytics collects information entirely anonymously. It reports website trends without identifying individual visitors.

You can opt out of Google Analytics without affecting how you visit our site. For more information on this, please see Analytics opt-out.

COLLECTION OF INITIAL INFORMATION

We collect information about you during the registration process for any of our services. This information may include, but is not limited to your name, e-mail address, phone number and any other details as might be requested from you for the purpose of registration and/or continued use of our services.

We may also collect information from you if you request information or customer support and your social media profile details (name, profile photo and other information you make available to us) when you connect with or contact us through a social media account.

COLLECTION OF ADDITIONAL INFORMATION AND DOCUMENTATION

We may also collect the following additional information and documentation:-

• Property particulars, including residential address.
• Verification of identity documentation, e.g., passport or driving license.
• Verification of residential address documentation, e.g., utility bill or bank statement.
• Confirmation of your financial history, source of wealth and source of income.
• Residential and employment status.

THIRD PARTY AND PUBLICLY AVAILABLE SOURCES

Not all the personal and financial information we hold about you will always come directly from you. We may also collect information from third parties such as our partners, credit service providers and publicly available websites (i.e., social media platforms), to comply with legal and regulatory obligations.

HOW OUR SITE WORKS

Requesting quotes or information

Our site enables people to request quotes or information for the product or service shown or selected on the site (the “Product”).

The service that our site provides is to connect people who are looking to purchase the Product with relevant providers of the Product (“Service Providers”).

If you’d like to request and receive quotes or information for the Product (“Quotes”), please complete and submit our webform.

Once we’ve received your request, we’ll connect you with one or more relevant Service Providers who will contact you in response to your request. In order to connect you with the Service Provider(s), we share the information that you provide to us via our webforms with those Service Provider(s). We’ll tell the Service Providers who you are, and your Product requirements, and they’ll then contact you directly with your requested Quotes. You’ll see on our webform that we have a really clear consent statement. This statement sets out the Service Providers that will contact you.

For certain Products, before connecting you with relevant Service Providers, we may call you to confirm your details or requirements.

You can choose which Service Provider to buy from, but there is no obligation to purchase from any of them.

Other than where we state in this Privacy Policy, we do not share your data with anyone else or use it for any other purpose, except on an aggregate and anonymous basis. This means that we also do not transfer it to any advertising network, or use it to build user profiles.

WHAT DATA WE COLLECT, AND HOW WE COLLECT IT

Contact details and product requirements

If you complete our webform in order to request Quotes or to book an appointment, it will ask you for your contact details, such as your name, email address, telephone number, postal address, and/or postal code.

Our webform will also ask for information regarding your Product requirements. 

From time to time, we change our webforms, and so they may ask you for other information. It will always be clear from the webform what information we’re requesting, and we only request information that is relevant to your request, and the service that we’re providing.

If we call you in response to you completing our webform, we may ask you for additional information to do with your request.

When you visit our site, we will do our best to provide you with the information you are looking for. This will mean that, sometimes, we may ask you for your name and email address (via a pop-up box on our site) so that we are able to send you more information about the products or services that you have shown an interest in. You are not required to submit this information to us and, if you change your mind, you can opt out at any time by clicking the unsubscribe link in the email.

IP addresses

We also store and share Internet Protocol (IP) addresses, as explained below. Every computer or device has an IP address – a unique number – which enables it to communicate with other computers and devices over the Internet.

HOW WE USE YOUR DATA

We use your data (described above) in the following ways.

To connect you with relevant Service Providers

As explained above, if you submit our webform, we’ll pass your request to one or more relevant Service Providers (named on the consent statement). We will do this in a secure way. For example, using HTTP Secure (HTTPS), which means the data is encrypted. The Service Providers then contact you directly with your quotes. They may contact you by telephone, text/SMS or email.

Before we pass your request to any Service Providers, our service may involve an element of automated decision-making. Our technology platform may automatically assess your Product requirements based on the information you have provided us and pass your request to such Service Providers that would like to receive requests for Quotes at the time your request is made.

Some Service Providers may pass your data to third-party credit check agencies as part of your application for specific financial products, and you will be made aware of this in the consent statement. 

To call you to confirm your details or requirements

For certain Products, before connecting you with relevant Service Providers, we may call you to confirm your details or requirements.

We may also call you to ask about your experience using our site and service, and dealing with the Service Providers with which we connected you.

To call you to book an appointment

Where you have requested to book an appointment, we may call you, either in our brand name or in the name of and on behalf of a Service Provider, to book your appointment. 

If we book an appointment for you, we’ll share your details, including any information that you provide on the call, with the Service Provider. We’ll also tell you which Service Provider we’ve made an appointment with. We won’t book an appointment without your approval.

Occasionally, we may not be able to find a suitable appointment for you. If this is the case, we’ll let you know on the call. However, we may be working with other Service Providers that can help you. If this is the case, we’ll pass your enquiry to those Service Providers (either named on the consent statement or during the call), who will contact you directly by telephone, text/SMS or email.

To email or text you about similar products and services – But only if you haven’t opted out of such emails or texts

If you use our quote request service, then, as an existing user, we would like to email you, or send you text/SMS messages, about similar products and services for which we think you might like quotes or information (“Other Products”). Sometimes your mobile network provider may charge you for such SMS messages. 

You will always be given an opportunity to opt out of such messages before we send them, and we will not send such messages if you have opted out.

To create custom and lookalike/similar audiences

We like to work with Facebook, Google and other platforms (“Platforms”) to reach out to you with adverts for Other Products. We also like to use Platforms to reach out to other people who might like to use our quote request service.

We do this in two ways. In both cases, your data, along with other data, is used to create a custom audience and/or a lookalike/similar audience. Whenever an audience is shared with a Platform, the data is first hashed and pseudonymised, meaning that any data within the audience that could identify a person is replaced with an artificial identifier. So, the process is secure. Also, we don’t share more data than we need to for the purpose of creating the audience.

• Custom audience – A custom audience is a list of existing users of our service (“Existing Users”). From time to time, we share this with Platforms. As explained above, the data is first hashed and pseudonymised. The Platform uses this audience to show our Existing Users our adverts for Other Products.
• Lookalike/similar audience – A lookalike/similar audience is an audience created by the Platform. From time to time, we share with Platforms a list of Existing Users. The Platform uses this list to find and create lookalikes – i.e. other Platform users who have similar characteristics to the Existing Users – to which it shows our adverts. Again, as explained above, the data is first hashed and pseudonymised.

As we explain below, at any time, you may object to such activity by emailing us at [email protected].

To improve your in-app experience and for marketing attribution 

We may use data collected in our app to better understand how you interact with our content and track the relevance of our marketing campaigns to your interests. 

To verify that your webform submission is a genuine request - But only where your submission relates to a finance product or service

We work with a third party supplier, Smart Call, so that we can pass on your request to our Service Providers correctly. Smart Call provides lead validation services to our Service Providers. Smart Call receives de-identified data from us about your request. 'De-identified' means that they are unable to establish your real world identity from the data they receive from us. We do not provide them with any access to any contact information other than your telephone number, which could be used by them to identify you as an individual person. Smart Call uses that de-identified data to indicate to us the likelihood that your request has been submitted by a 'real' human and not a robot, or automated request generator. They do this by calling the telephone number associated with your request.

To email you to remind you to complete our webform where its partially completed

If you start but don’t complete one of our webforms, we may email you to remind you to complete that webform. We will only store data inputted by you in a partially completed webform for two hours from when you leave the webform. If you don’t return to the webform to complete and submit the form in two hours, we will permanently delete the data you’ve inputted, subject to an automatic back-up of that data being made and stored for 30 days from the date you partially completed our form. Such back-up will not be readily accessible by us and your data will not be used for any other purpose.

Receiving data from Service Providers

From time to time, Service Providers may return data to us. They may do this if they have a query regarding a request for Quotes or an enquiry that we have sent to them in order to enable us to resolve the query. They may also return data to us, together with confirmation on whether or not a product has been purchased, in order to enable us to improve our marketing. We may also use such data to create custom and lookalike/similar audiences, as explained above.

Working with suppliers

We work with a number of suppliers, who process data on our behalf. These include cloud storage providers, email service providers, and cloud telephony providers. We have appropriate contracts in place with such suppliers to ensure the protection and confidentiality of data.

Suppliers are required to keep the information confidential and secure, and they will only use the information to carry out the instructed services.

We do not transfer your personal data to organisations who wish to use it for their own marketing promotions or other purposes. We only transfer your personal data to other organisations where it is necessary to enable us to provide you with the services you have requested. Where we do so it will be on the basis that these.

CONSENT TO PROCESSING AND ACCEPTANCE OF THIS POLICY

By providing personal information to us as part of the registration process, you fully understand and expressly consent to the processing of that data as described within this policy. If you do not agree to this policy, please advise the DPO at Cash.je.

YOUR RIGHTS

Under the General Data Protection Regulation (GDPR) and more specifically the Data Protection (Jersey) Law 2018, you, as a data subject, have a number of rights which are detailed below. Some of these only apply in specific circumstances and are qualified in several respects by exemptions in data protection legislation. We will advise you in our response to your request if we are relying on any such exemptions.

1. Access to personal data
   You have a right to request a copy of the personal information that we hold about you. Should you wish to make such a request, please see the ‘How to contact us’ section for information on how to contact us. You should include adequate information to identify yourself and such other relevant information that will reasonably assist us in fulfilling your request. Your request will be dealt with as soon as possible but no later than within one month.
2. Correction of personal data
   You can request us to rectify and correct any personal data that we are processing about you which is incorrect.
3. Right to withdraw consent
   Where we have relied upon your consent to process your personal data, you have the right to withdraw that consent.
4. Right of erasure
   You can request us to erase your personal data where there is no compelling reason to continue processing. This right only applies in certain circumstances and is not a guaranteed or absolute right. Any regulatory or legal requirement to retain your records will take precedence.
5. Right to data portability
   This right allows you to obtain your personal data that you have provided to us with your consent or which was necessary for us to provide you with our products and services in a format which enables you to transfer that personal data to another organisation.
6. Right to restrict processing of personal data
   You have the right in certain circumstances to request that we suspend our processing of your personal data. Where we suspend our processing of your personal data we will still be permitted to store your personal data, but any other processing of this information will require your consent, subject to certain exemptions.
7. Right to object to processing of personal data
   You have the right to object to our use of your personal data which is processed on the basis of our legitimate interests. However, we may continue to process your personal data, despite your objection, where there are compelling legitimate grounds to do so or we need to process your personal data in connection with any legal or regulatory claims.
8. Rights relating to automated decision making and profiling
   You have the right not to be subject to a decision which is based solely on automated processing (without human involvement) where that decision produces a legal effect, or otherwise significantly affects you. This right means you can request that we involve one of our employees or representatives in the decision-making process. We are satisfied that we do not make any automated decisions of this nature.
   

CHANGES TO THE PRIVACY POLICY

Although most changes are likely to be minor, we may change our Privacy Policy from time to time, and at our sole discretion. We encourage visitors to frequently check our Privacy Policy. Your continued use of the website and the products and services after any change in this Privacy Policy will constitute your acceptance of such change.

HOW TO CONTACT US

For any requests related to your personal information or any of your rights referenced above, please feel free to contact us in one of the following ways:-

EMAIL

[email protected]

IN WRITING

Rock Box Media Limited, 9 Bond Street, St Helier, Jersey, JE2 3NP

FILING A COMPLAINT

If you are not satisfied with how we manage your personal data, you have a right to make a complaint to the Jersey Office of the Information Commissioner.

OTHER USEFUL PRIVACY & DATA SECURITY RELATED MATTERS

RECORD RETENTION

We retain personal information for as long as we reasonably require it for legal or business purposes. For the jurisdictions in which operate, and subject to us not having a legal or regulatory requirement, or a risk management reason for retaining your information for a longer period, your information will not be kept for longer than 5 years following that date on which your relationship with us ceases. We will take all necessary steps to ensure that the privacy of information is maintained for the period of retention.

SECURITY

We recognise that online security and data protection is an area of vital importance for all our customers, so it is important to us that you have confidence in the security of your personal details. We are committed to employing security measures to protect your information from access by unauthorised persons and to prevent accidental or unlawful processing, disclosure, destruction, loss, alteration and damage. As the security of some communications via the internet is not completely secure, we cannot guarantee the security of any information that you disclose using your internet connection. You accept the inherent security implications of using the internet and Rock Box Media Limited Limited will accept no liability for any direct, consequential, incidental, indirect, or punitive losses or damages arising out of such an occurrence.