Privacy Notice

Who we are?

Cardtronics” means the Cardtronics group of companies, including Cardtronics Plc and all of its subsidiaries. The Group is made up of a number of business entities and while those entities operate in a number of different ways and in a number of different jurisdictions, this notice sets out the general principles in accordance with which Cardtronics will collect, process and treat your data. We will let you know which of the group entities you will have a direct relationship with, when you engage with us with a view to taking out a product or service. When we mention Cardtronics, “we”, “us” or “our” in this privacy notice, we are referring to the relevant company in the Cardtronics group responsible for processing your data.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing your personal data so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

If you have any queries about how Cardtronics processes your personal data please contact us via this online form here and we will get back to you.

Data Privacy Manager

We have also appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your rights, please contact the data privacy manager using the details set out below.

Contents

Privacy Notice

• What Personal Data We Collect?
• Where we collect your personal data from?
• How do we use your personal data?
• Who we share your data with?
• How long do we keep your information?
• The law protects you
• Data and ATMs
• Third Party Links
• Sending Data outside of the EEA
• If you choose not to give this information
• Marketing
• CCTV
• Data Security
• Your Legal Rights
• How to get a copy of your information?
• How to complain?
• Possible future changes
• Cookies

Privacy Notice

This privacy notice is to let you know how Cardtronics will look after your personal information. This includes what you tell us about yourself and what we learn by having you as a customer. This notice explains how we do this and explains your privacy rights and how the law protects you. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

What Personal Data Do We Collect?

We collect contact details in each case and then supplementary information required for the purposes of fulfilling the relationship Cardtronics has with you which may in the case of an employment relationship include special categories of data.

We also collect, use and share statistical or demographic data. This may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Where we collect your personal data from:

We will collect personal data about you through any of our Cardtronics group businesses:

• When you complete a form on any of our group business web-sites
• When you enter into a contract with Cardtronics
• When you provide information in emails or letters
• When you speak to us on the phone
• When you apply for any of our services
• When you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies.

We will also collect data about you from third parties we have an association with, including:

• Fraud prevention agencies
• Government and law enforcement agencies
• Public information sources including DVLA, Land Registry and Companies House
• Vetting and other agents working on our behalf

How do we use your personal data?

Here is a list of all the ways that we will use your personal information and the lawful basis for collecting and processing your data.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Who we share your data with?

We have to share your personal data with the parties set out below for the purposes set out in the table above.

• Internal Third Parties: other companies in the Cardtronics group acting as joint controllers or processors and who provide IT, system administration and other services to the group and its customers.
• External Third Parties: service providers, acting as processors who provide services to Cardtronics and its customers.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, fraud and other crime prevention agencies, auditors and insurers.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers who require reporting of certain activities.
• Agents and advisers who we use to help run your accounts and services, collect what you owe, and explore new ways of doing business
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

How long do we keep your information?

We will keep your personal information for as long as you are a customer of Cardtronics. We will only retain your personal data after that for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

After you stop being a customer, we may keep your data for one of these reasons:

• To respond to any questions or complaints.
• To show that we treated you fairly.
• To maintain records according to rules that applies to us.

The law protects you

The protection of the privacy of your data is not only a legal requirement for Cardtronics but it is also important to us.

Data Protection law says that we are allowed to collect and use personal information only if we have a proper reason to do so. Therefore we will only collect, retain and use your data:

• To fulfil a contract we have with you, for example to make sure that we pay the right amounts to the right person
• When it is our legal duty to do so, including for instance retention of records for audit or other purposes, or
• When it is in our legitimate commercial or business interest, including for example for KYC or “know your client” purposes to ensure that we are contracting with the right person or organisation, or
• When you consent to it.

Generally we do not rely on consent as a legal basis for processing your personal data. In most cases we will need to collect and process your data in relation to a contractual relationship you have with Cardtronics or on the grounds of a legitimate business interest. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below. Where we rely on a legitimate business interest to process your data we will carefully assess to what extent processing is necessary and ensure that our business interests do not infringe your own interests and fundamental rights.

Data and ATMs

When you use one of our ATMs you need to be aware that the details from your card will be captured and shared with your card issuer for the purposes of validating the requested transaction. The details from your card together with the details of the requested transaction will be used by Cardtronics, a number of third party service providers and your card issuer to authenticate and approve or decline the transaction request; Cardtronics does not use any form of automated decision making in this process but other third parties and/or your card issuer might. The details Cardtronics collects from your card as part of a transaction have been anonymised by your card issuer and Cardtronics has no means of reconciling your card number (which is further anonymized and encrypted) with a living individual. As such Cardtronics does not consider card and transaction details to be personal data for the purposes of data protection law but this also means that Cardtronics cannot identify you in the event of a disputed ATM transaction – if you encounter any issues in using one of our ATMs, you should in the first instance contact your card issuer to raise a “LINK Discrepancy Form”.

Please note that Cardtronics may as part of the transaction validation process be asked by the card issuer to retain the card inserted into the ATM. This may be as a result of the card being out of date, the card being abused, where the incorrect PIN number has been attempted a number of times or where an incompatible card has been inserted. Note that under the LINK rules and regulations, Cardtronics cannot return captured cards to users under any circumstances and any cards collected from the ATM will be securely destroyed on collection. If an ATM has retained your card, in most circumstances this will be at the request of your card issuer and you should contact them in the first instance.

Third Party Links

Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Sending Data outside of the EEA

We share your personal data within the Cardtronics group. This may involve transferring your data outside the European Economic Area (EEA). In addition, some of our third party service providers are located outside of the EEA or use cloud based services that are operated on servers located outside the EEA. We will only send your data outside of the EEA to:

• Follow your instructions.
• Comply with a legal duty.
• Work with our agents and advisers who we use to help run your business accounts and services.

If we do transfer information to our agents or advisers outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. We’ll use one of these safeguards:

• Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. More information can be found here on the European Commission Justice website.
• Put in place a contract with the recipient (data processor) that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website,
• Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA. Further information can be found on the European Commission Justice website.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

If you choose not to give this information

We may need to collect personal information by law, or under the terms of a contract we have with you. If you choose not to give us this personal information, it may delay or prevent us from meeting our obligations. It may also mean that we cannot perform services needed to run your accounts or business services. It could mean that we may have to cancel a product or service you have with us.

Any data collection that is optional would be made clear at the point of collection.

Marketing

We may use your personal information to tell you about relevant products and offers. This is what we mean when we talk about ‘marketing’.
The personal information we have for you is made up of what you tell us, and data we collect when you use our services, or from third parties we work with.
We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest’. That is when we have a business or commercial reason to use your information. It must not unfairly go against what is right and best for you.
You can ask us to stop sending you marketing messages by contacting us at any time.
If you change your mind you can update your choices at any time by contacting us.

CCTV

Cardtronics operate closed circuit television (CCTV) systems in and around Cardtronics facilities and assets to provide a safe and secure environment for staff, visitors, the general public and also to protect CTUK’s property and assets. We operate CCTV to:

• Deter those having criminal intent;
• Assist in prevention and detection of crime;
• Facilitate with the identification, apprehension and prosecution of offenders;
• Monitor security of CTUK buildings and vehicles;
• Identify vehicle movement problems around CTUK buildings.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your Legal Rights

You have the right to:

Request a Copy of your Personal Data

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Contact details are below.

Request correction of the personal data that we hold about you.

This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. Contact details are below.

Request erasure of your personal data.

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which overrides your rights and freedoms. Contact details are below.

Request restriction of processing of your personal data.

This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. Contact details are below.

Request the transfer of your personal data to you or to a third party.

We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Contact details are below.

Withdraw Consent

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Contact details are below.

How to get a copy of your information

You can access your personal information we hold by filling in the form here or by writing to us at this address:

We will respond to Subject access requests within 30 days.

How to complain

Please let us know if you are unhappy with how we have used your personal information. You can contact us using our online form.

You also have the right to complain to the Information Commissioner’s Office. Full details of how to do this are on the Information Commissioners website. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Possible future changes

The Data Privacy laws will change on 25 May 2018. We are working with our industry to improve the way your personal data is managed. We’ll update this notice with any changes relevant to the processing of your data as and when this happens.

Cookies

To find out more about how we use cookies please see our cookie notice.

This Privacy Policy is effective April 2018.