This is how your personal information is used by Union Bank of India (UK) Ltd. Updated January 2026

About us

Union Bank of India (UK) Ltd is registered as a data controller with the Information Commissioner under reference: Z3266289.

If you have any questions, or want more details about how we use your personal information, you can e-mail us at .

Data Protection law has changed on 19 June 2025

This notice lays out most of your rights under the new laws.

Cookies and IP Addresses

• When you visit our website we may collect technical information about your device (including IP address, browser and operating system) for system administration, security and to produce aggregated analytics.
• We use cookies and similar technologies to improve site performance, remember preferences, enable login and personalise your experience. Cookies may also be used for analytics and advertising where you have given consent.
• You can manage or block cookies via your browser settings; doing so may affect your ability to use parts of our site. For guidance about cookies see www.allaboutcookies.org.

Protection of your data by law

• We process personal data only where we have a lawful basis under UK GDPR: to fulfil a contract with you, to comply with a legal obligation, for our legitimate interests, or where you have given consent.
• Where we rely on legitimate interests we balance those interests against your rights and freedoms to ensure fair and proportionate processing.

Our Commitment to You

• To keep your data confidential and secure: we use appropriate technical and organisational measures (access controls, encryption, staff training and secure systems).
• Not to sell your data: we do not sell personal data to third parties.

Where Personal Information Is Collected From

• Directly from you: application forms, account opening, emails, calls, online forms and other communications.
• From your use of our services: website usage, cookies, device and connection data.
• From third parties: credit reference agencies, fraud prevention agencies, banks (including our parent bank), public registers (e.g., Companies House, electoral register), professional advisers, and other service providers.
• From audio recordings and CCTV used for security and service quality.

Who We Share Your Personal Information With

• Credit reference agencies (Experian, TransUnion, Equifax, Dun & Bradstreet) and fraud prevention agencies (e.g., Cifas).
• Our parent bank and other group companies (Union Bank of India).
• Payment processors, card networks, correspondent banks and other financial institutions.
• Third-party service providers (IT, cloud, call centres, document processors) acting as data processors under contract.
• Professional advisers, auditors, legal advisors and regulators.
• Law enforcement or public authorities where required by law.
• Any other party you authorise us to share your data with.

Automated Decisions Using Your Information

• We use automated processing (scorecards, algorithms, profiling) for: credit scoring, affordability checks, fraud detection and prevention, identity verification and to personalise services.
• Where automated decisions have a legal or similarly significant effect you can request human review – contact us to exercise this right.

Data we may already hold; Your application form; Credit reference agencies; Lead Banks; Incumbency Certificates from auditors/accountants

• Data we may already hold: identity details, contact and address history, account and transaction history, previous application data, authentication logs and interaction history.
• Your application form: information you supply when applying for products (personal, business, income, employment, requested product details).
• Credit reference agencies: we may obtain credit and public record data (credit history, CCJs, insolvency data, electoral register) to verify identity and assess creditworthiness.
• Lead banks and correspondent banks: we may verify banking relationships and payment instructions with lead/correspondent banks.
• Incumbency certificates from auditors/accountants: for corporate or trustee accounts we may collect or verify incumbency and authority documentation from auditors/accountants to confirm signatories and authorised officers.

Your Rights

• You have the right to: access your personal data; request rectification; request erasure (in certain circumstances); request restriction of processing; object to processing (including direct marketing); request portability of data where applicable; and withdraw consent where processing is based on consent.

Credit Reference Agencies (CRAs)

• We use CRAs to carry out identity checks, credit assessments and to support account management and collections.
• We share certain personal and financial data with CRAs; they keep records of searches and may share information with other organisations. A CRA search may create a footprint on your file visible to other lenders.
• See CRAs’ privacy pages for details and CRAIN information: Experian, TransUnion, Equifax and Dun & Bradstreet.

Fraud Prevention Agencies (FPAs)

• We use FPAs to prevent and detect fraud and money-laundering. We and FPAs may exchange information about you and other parties.
• If FPAs record fraud-related information it may be retained (typically up to six years) and may be used by other organisations when assessing fraud risk. This may affect your ability to get products or services.

Automated Decisions

• Examples of automated decisions we make: fraud detection alerts, automated suitability checks when opening accounts, credit scoring for lending decisions.
• Where an automated decision is based solely on automated processing and has significant effects you may request human review and an explanation of the logic used.

Consequences of Processing

• If fraud or money-laundering risk is identified, we may decline applications, close or restrict accounts, or refuse to provide services. Records of such findings may be retained by FPAs and may affect others’ decisions about providing you with services.
• If you withhold required information we may be unable to provide products or services or we may delay or refuse to open accounts.

Information We Use

• Types of personal data we use include: name, date of birth, contact details, residential address and residential address history, Contact details including email addresses and phone numbers, financial information, Information about your or your businesses products or services, employment details, driving licence, Information identifying computers/devices used to connect to the internet, including your Internet Protocol (IP) address, call recordings, identity documents, and any other information you provide.

Data Transfers Out of the EEA

• We transfer and process personal data outside the UK/EEA (for example to India – our parent bank and group service providers) for operational, IT and record-keeping purposes.
• Transfers are subject to appropriate safeguards under UK GDPR (adequacy decisions, standard contractual clauses or other lawful transfer mechanisms). Contact us for copies of transfer safeguards.

If You Choose Not to Give Personal Information

• Some personal data is required for us to enter into or perform contracts and to meet legal and regulatory obligations (e.g., identity checks, AML). If you do not provide required data we may be unable to open or service accounts or provide requested products.

How Long We Keep Your Personal Information

• We keep personal data only as long as necessary for the purposes for which it was collected and to meet legal, regulatory and tax obligations. Typical retention periods include:
• Active customer records: for the life of the relationship.
• Transactional and payment records: up to 7 years after account closure (as required by law and for tax/dispute purposes).
• Complaint records: up to 5 years.
• Fraud records with FPAs: up to 6 years.
• If you require specific retention periods for particular categories of data, contact us.

How to Get a Copy of Your Personal Information

• To request a copy of your personal data (subject access request) contact: or write to Data Protection Officer, Union Bank of India (UK) Ltd, 12 Arthur Street, London EC4R 9AB. Provide proof of identity to help us process your request.

If You Think Your Personal Data Is Incorrect?

• If you believe information we hold about you is inaccurate or incomplete, contact us and we will take reasonable steps to verify and correct it. You may also add a notice of correction to explain your position.

Your Rights to Stop Us Using Your Personal Information?

• You may object to our processing where we rely on legitimate interests or where we process your data for direct marketing. We will consider your objection and stop processing where legally required. Some processing may be required by law or necessary for contract performance; in those cases we may not be able to comply with your request.

How You Can Withdraw Your Consent

• Where we rely on consent (e.g., cookies, marketing), you may withdraw consent at any time by contacting us or changing your preferences in your account or browser settings. Withdrawal of consent will not affect processing already lawfully carried out.

How to Make a Complaint

• Contact us first: or by post to: Data Protection Officer, Union Bank of India (UK) Ltd, 12 Arthur Street, London EC4R 9AB.
• If you remain dissatisfied you can complain to the Information Commissioner’s Office (ICO): https://www.ico.org.uk/make-a-complaint; helpline 0303 123 1113; Wycliffe House, Water Lane, Wilmslow SK9 5AF.

Formats for Sharing Data

• You have the right, where applicable, to receive personal data you provided to us in a structured, commonly used and machine readable format, and to request we transmit that data to another controller where technically feasible. Contact us to request data portability.

Contact details

• Data Protection Officer / Data queries:
• Registered office: 12 Arthur Street, London EC4R 9AB
• Telephone: 020 7332 4250