Understanding your data rights

The quickest way to send us a request is through OneTrust, our data rights portal.

Once you’ve submitted the form and signed in, you'll be able to communicate directly with our team. They’ll also be able to upload any requested documents in the portal.

Whenever you receive a response from the team, you'll receive an email which will prompt you to log in to OneTrust. If you then click on your request, you'll be able to view any comments from the team, reply and download any documents.

You can download our Data Subject Rights Request form and post this to us. You can also draft a letter, but please make sure it is signed.

You can send the form or a letter to FREEPOST CBS CUSTOMER SERVICES.

If you write the address exactly like this – in capital letters and on one line - then you don't need to pay for postage.

You can call us on 0800 121 8899 to make a request. We’re open Monday to Friday 8am-7pm or Saturday 9am-2pm.

You could also make a request in one of our branches. You’ll be verified when making a request this way. This will help prevent the team from needing to request more information. You'll be verified by normal branch processes which might require some form of ID.

Yes, this is called the right of access, and is more commonly known as a Subject Access Request. It allows you to get a copy of your personal data and some supplementary information. We provide supplementary information to you through a copy of our Privacy Notice.

With a Subject Access Request, we can only share your personal information. If you need a third party to ask for this on your behalf, they’ll need to give us a letter of authority from you.

If you have a joint account and would both like to access your information, you’ll both need to submit a request. This can be done together or separately, and you’ll both need to provide the information we need to verify you.

This is called the right to be informed. 

Our Privacy Notice gives details of how we may use your information, depending on whether you have a mortgage or savings account. It also covers who we're likely to share your information with.

We update this notice regularly, so please check our website to make sure you’re looking at the latest version.

Yes, this is called the right to rectification.

If you think the information we hold on you is incorrect or incomplete, you can ask us to change this.

But this right is not absolute. We’ll take reasonable steps to make sure the information is accurate to our knowledge. If we believe the information you’ve asked us to change is already correct, we won’t amend this.

We'll let you know our response, whatever the outcome.

Yes, this is called the right to erasure or the right to be forgotten. This means you can ask us to delete your information in some cases.

This isn't an absolute right. This means it only applies where:

• Your personal information isn’t being used for the purpose we originally collected or used it.
• You gave us consent to use your information but have now withdrawn it.
• You've objected to us using your information and we're relying on legitimate interest to contact you. More detail on legitimate interest is available in our Privacy Notice.
• You've objected to us using your information for direct marketing.
• We haven't complied with data protection rules when processing your information.

If we need to keep your information for a legal obligation, then we won’t be able to delete this until the necessary retention timescale ends.

Yes, you can. There are two rights that apply here.

The first is the right to restrict processing. This means that you can ask us to temporarily limit the ways that we use your information, including not to delete it. But this is not an absolute right and you can only ask us to do this where:

• You’ve challenged the accuracy of your information
• You’ve objected to us using your information
• You need us to not delete your information where we’ve processed your information against data protection law or you need it in order to action or defend legal claims.

The second is the right to object. This means that you can ask us to stop processing your personal information at any time. This objection might be for some or all of your information. But this is not an absolute right and it only applies where:

• We use it for our legitimate interest.

We might refuse to comply with your request. We’ll do this if we have a strong enough reason to process your information that outweighs your objection.

If you object to us using your information for direct marketing purposes, it is an absolutely right and we must comply. 

Yes, this is the right to data portability.

This means you can ask us to provide you with your personal information in an accessible format a machine can read, such as a csv file. This means that you may not be able to read it as it's designed for a computer to read.

Under this right we can also send the information in this format to another organisation you've requested. We must comply with this request if it's technically feasible.

Yes, this is the right to not be subject to a decision based solely on automated processing, including profiling.

This means that if a decision about you is made automatically (without people involved), you have the right to ask for a person to review it and to understand how the decision was made. You also have the right to object to certain types of automated profiling.

We’re not allowed to make decisions based solely on automated processing if the decision affects your legal rights or other important matters, unless the decision is:

• Necessary for a contract – such as a credit decision for a mortgage
• Authorised by law – such as to prevent fraud or tax evasion
• Based on your explicit consent.

Yes, we can. Alongside the ones mentioned above, you also have the right to withdraw your consent.

We mainly rely on your consent for direct marketing purposes. You can update your preferences at any time through Online Services, by post, by phone or by popping into a branch. If we've had your consent for another purpose, such as for research, then please contact us.

You also have the right to make a complaint, to us or the regulator or both, if you believe we haven’t handled your personal information in line with data protection law.

You can make a complaint by calling us, sending a message, writing to us or popping into a branch.

If you're not happy with our response then you can complain to the Information Commissioner's Office, an independent government organisation or write to:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow SK9 5AF

If you've come to us as a candidate or are currently, or formerly, employed by us then the rights mentioned above still apply to you.

You'll be able to make a request using any of the methods outlined at the top of this page. And if you're a current employee, you'll also be able to make a request internally to the team.