1 2 3 4 2 3 1
  1. Introduction

This Privacy Policy ("Policy") is issued on behalf of 247 Money Group Limited and applies to the processing of your personal data.

 

References to "we", "our", or "us" in this Policy refer to 247 Money Group Limited trading as both ‘247 Money’ and ‘Choose My Car’, company number 10989530, authorised and regulated by the FCA under firm reference 804906 and registered with the UK Information Commissioner (ICO) ZA456831, which is responsible for handling your data.

 

This Policy, together with our Cookie Policy, Website/Mobile Application Terms and Conditions, Product(s) Terms and Conditions, and any relevant information provided during the application process, outlines the basis on which we process your personal data.

 

We respect your privacy and are committed to safeguarding your personal data. This Policy outlines how we collect, process, and store your personal data when you interact with us through, including but not limited to our website, mobile app, text messages, chatbox, emails, phone calls (including calls made or handled by our AI voice assistant), members portal, services, and any other online or digital method of communication (collectively referred to as our "Platforms"). By using our Platforms, you agree to the collection, use, and processing of your data as described in this Policy.

  1. Important Information

You can opt out of receiving marketing communications at any time. We will never send unsolicited marketing emails or share your data with third parties for marketing purposes without your consent.

This Policy may change from time to time. Please check our website periodically for updates. If significant changes occur, we will notify you where possible.

  1. Controller and Contact Information

We are the data controller and are responsible for your personal data.

For any queries regarding this Policy or how we handle your personal data, please contact our Data Protection Officer (DPO) using the details below:

  1. Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK regulator for data protection issues ( www.ico.org.uk). However, we encourage you to contact us first: Customer Care Form so we can address your concerns.

  1. Data We Collect

Personal data refers to any information about an individual that can identify them. We may collect the following categories of personal data about you:

  • Identity Data: Name (including title), date of birth, information about dependants
  • Sensitive Data: Disability, illness or impairment (if required for legal or service purposes, including information about your health or circumstances that you tell us during a call).
  • Contact Data: Address, phone numbers, email address
  • Financial Data: Bank details, income, expenditure, payment card details, credit checks for finance applications
  • Transaction Data: Details of payments made to and from you, purchase history, vehicle details
  • Technical Data: IP address, device/browser details, login data
  • Profile Data: Preferences, feedback, interests
  • Usage Data: Pages visited, time and date of visits
  • Marketing and Communications Data: Preferences for receiving communications
  • Additional Data: Insurance details, employment details (for business interactions), vehicle information and call recordings, call transcripts and call summaries (for the purposes described in Sections 9 and 9A).

We also collect, use and share aggregated data, such as statistical data, to improve our services. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering. Aggregated data is not considered personal data in law as it does not directly or indirectly identify you.

Children: Our website is not intended for children, and we do not knowingly collect data related to them.

  1. Credit Checking and Automated Decision Making

Whenever you apply for any of our products and/or services, or to make decisions about future products, services and offers that we think you may be interested in the future we and/or our lenders will carry out checks with credit reference agencies ("CRAs"), including:

  • Checks against publicly available information such as the Electoral Register, County Court Judgments (CCJs), bankruptcy or repossession information. These checks may be referred to as "soft searches" or "quotation searches" and are visible to only you;
  • Checks against data relating to your financial situation and financial history. These checks may be referred to as "hard searches" or "credit application searches" and may be visible to other third parties, such as potential lenders

During the lifetime of an agreement introduced through CF247, Choose My Car or provided by 247Money we may complete checks of publicly held information such as the Electoral Register, County Court judgements (CCJ's), bankruptcy or repossession information, as well as data relating to your financial situation and financial history and these may show as 'account management searches' or 'portfolio management searches' and are only visible to you.

We will use this information to:

  • Assess your creditworthiness and whether you can afford to take the product;
  • Verify the accuracy of the data you have provided to us;
  • Prevent criminal activity, fraud and money laundering;
  • Manage your account(s);
  • Trace and recover debts;
  • and ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application.

CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail within the Credit Reference Agency Information Notice (CRAIN). CRAIN is also accessible from each of the three CRAs clicking on any of these links will also take you to the same CRAIN document: Equifax, Callcredit and Experian.

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to "international frameworks" intended to enable secure data sharing.

Our AI voice assistant, Carla (see Section 9A), does not make any decisions about your finance enquiry or application. Any such decisions are made by our staff or by the relevant lender.

  1. How We Collect Data

We use the following methods to collect personal data:

  • Direct Interactions: When you complete forms or contact us via our Platforms, including when you request information or assistance from us, speak with our AI voice assistant, apply for a job with us, or otherwise provide data directly. This may include real-time location data, where applicable, as well as updates or changes to the information you provide over time, such as geolocation data collected through mobile applications or online services to enhance user experience and service delivery.
  • Automated Technologies: Data collected through cookies or similar technologies. ( See our Cookie Policy for details.)
  • Third-Parties: Including lenders, brokers, credit reference agencies, insurers, fraud prevention agencies, and market data providers.
  • Mobile App Location Data: If you use our mobile app, we may collect real-time location data to personalise services.
  1. How We Use Your Data

We process your personal data only when the law allows us to, i.e. when we have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

  • Consent: We rely on your consent when you have actively agreed to the use of your personal data for a specific purpose. This may include marketing, administering a consumer credit agreement, insurance policies, enabling you to search our motor vehicle database before a dealer introduction, or facilitating finance agreements.
  • Contract: We process your data when it is necessary to perform a contract we have entered or are about to enter with you, such as providing services, financing agreements, credit broking, or insurance broking.
  • Legitimate Interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
  • Legal Obligations: We may process your personal data when required to comply with legal obligations. In such cases, we will identify the relevant legal requirement. For example, we may process data to comply with obligations set by HM Government for money laundering and financial crime prevention, the Financial Conduct Authority (FCA) to demonstrate robust systems and controls, or the Information Commissioner's Office (ICO) to ensure appropriate technical arrangements for data processing and control.
  1. Purposes For Which We Will Use Your Personal Data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Use

Type of data

Legal basis

To register you as a new customer

Identity, Contact, Financial, Transaction, Marketing and Communications, Profile

Performance of a contract with you

To process finance and credit applications, including managing payments, fees, charges, and debt recovery

Identity, Contact, Financial, Transaction

Performance of a contract with you; Necessary for our legitimate interests

To manage our relationship with you, including notifying you about policy changes and handling requests/complaints

Identity, Contact, Profile, Marketing and Communications

Performance of a contract with you; Necessary to comply with legal obligations

Marketing, including personalised recommendations, targeted advertising, analytics and market research

Identity, Contact, Profile, Usage, Marketing and Communications

Necessary for legitimate interests (to develop business and study customer behaviour)

Calls made or handled by our AI voice assistant, including call recording, transcription and call summaries (see Section 9A)

Identity, Contact, Profile, Marketing and Communications, Additional Data (call recordings, transcripts and summaries), Sensitive Data (where you tell us about your health or circumstances)

Necessary for our legitimate interests (to contact you about your enquiry, monitor quality, train staff and handle complaints); Necessary to comply with legal obligations; Sensitive Data: necessary to protect the economic well-being of individuals at risk

For employment applications

Identity, Contact

Consent and legitimate interests

In addition to the purposes outlined in the table, the following considerations apply to specific aspects of data processing, including:

  • Open Banking: Customer account data may be shared with regulated providers for financial assessment.
  • Fraud Prevention: Personal data may be shared with law enforcement or fraud prevention agencies.
  • Credit Checks: Information may be shared with credit reference agencies (CRAs) for application evaluation.
  • GAP Insurance: Insurance data is used for underwriting, claim handling, and fraud prevention.
  • Third-Party Sharing: Data may be shared with affiliates, service providers, and legal entities where necessary.

9A. AI Voice Assistant

We use an AI voice assistant, called Carla, to contact people who have made a finance enquiry with Car Finance 247 and to handle some calls to us. Carla will tell you at the start of the call that she is an AI assistant. Carla can ask you questions about your requirements, answer general questions and pass your call to a member of our team. Carla does not provide finance quotes and does not make decisions about your enquiry or application. Those decisions are made by our staff or by the relevant lender.

When you speak to Carla, we collect a recording of the call, a written transcript and a summary of the call, together with details such as the date, time, length and outcome of the call. These are added to our records about your enquiry. We do not use your voice to identify you (voice biometrics).

If you tell Carla something about your health or circumstances that suggests you may need extra support, Carla will pass you to a member of our team, and we will record this so that we can support you appropriately. We process this information where it is necessary to protect the economic well-being of individuals who may be at risk, as permitted by data protection law.

We use this information to progress your enquiry, to monitor and improve the quality of our service, to train our staff, to deal with complaints and to meet our legal and regulatory obligations. We do this on the basis of our legitimate interests and, where relevant, to comply with our legal obligations. We only contact you by phone, including through Carla, where you have agreed to be contacted in this way.

Carla is provided by [vendor name], which processes your information on our behalf under a contract that requires it to keep your information secure and to use it only on our instructions. [Your information is not used to train [vendor name]’s or any other provider’s AI models.] [Your information may be processed in [country/countries], where it is protected by [safeguard, e.g. the UK International Data Transfer Agreement].]

We keep call recordings, transcripts and call summaries for [period], unless we need to keep them for longer, for example because of a complaint or a legal claim.

You can ask to speak to a member of our team at any time during a call with Carla. If you do not want to receive calls from Carla, or any marketing calls from us, you can tell Carla or a member of our team during the call, or contact us as set out in Section 10. You can also ask for a copy of any call recording, transcript or call summary we hold about you (see Section 16).

  1. Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased products from us and you have not opted out of receiving that marketing.

You can ask us to stop sending you marketing messages at any time by completing our Customer Care Form. Simply select "Data" as your option of concern, then choose "Unsubscribe from Marketing." The Customer Care Form can be found on our website: Customer Care Form. Should you need any assistance call us on 0161 524 0023.

You can also tell our AI voice assistant, Carla, or any member of our team during a call that you do not want to receive further marketing calls, and we will stop calling you for marketing purposes.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a services purchase, product experience or other transactions.

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

  1. Cookies

For more information about the cookies, we use and how to change your cookie preferences, please see Cookie Policy.

  1. Sharing Your Personal Data

We do not sell your personal information to third parties. However, we work closely with our manufacturer partners and trusted third-party suppliers to provide essential services.

We may share your information with companies or organisations that provide services on our behalf, such as finance providers, lenders, insurers, marketing agencies, customer support centres, and credit reference agencies for credit checks.

For example, these services may include vehicle funding, credit checks, warranty and insurance products, marketing, events, and market research.

We may also share data with the following:

  • Our subsidiaries or affiliates, for the purpose of managing our customer relationships, administering our business and to provide you with information about other products and services which might be of interest to you;
  • Service providers who need to know the information in order to provide us or you with a product or service (including our third party service providers who process information on our behalf to help run some of our internal business operations including email distribution, electronic signature processing, storage of customer documentation, our HR careers portal, IT services, customer services, AI voice assistant and telephony services and for data analytics (using anonymised data));
  • Third party credit providers at your request where you have been unsuccessful in applying for personal lending services and/or product(s); in which case third party credit providers will become the relevant data controller;
  • Credit and fraud agencies (including Call Credit, Equifax, Experian and Cifas) to help make decisions (See Section 6: Credit Checking and Automated Decision Making for more information).
  • Law enforcement bodies in order to comply with any legal obligation or court order.
  • Third parties for the purpose of validating and assessing fitness and propriety in connection with any application for employment.
  • Entities who may or do acquire any rights in us for the purpose of a business sale or reorganisation;
  • 247 Money business advisors, for the purpose of assisting us to better manage, support or develop our business and comply with our legal and regulatory obligations
  • Occasionally, we may make your details available to reputable suppliers of credit and insurance related services that we feel may be of interest to you where you have agreed to receive such marketing.
  • Debt recovery agencies or service providers, tracing agents or investigators, solicitors or other agents for the purpose of collecting monies or assets due or outstanding on your account;
  • We reserve the right to sell performing and non performing accounts. We will inform you if we do this.

We share only the necessary information required to perform these services and strive to anonymise or aggregate data whenever possible.

This Policy does not apply to services provided by third-party companies or individuals, including products or websites displayed in our 'car search' results.

This Policy also does not cover the data practices of companies that advertise our services or use cookies, pixel tags, and other technologies to deliver relevant ads. For further details, please refer to the section titled 'Access to Website' in our Website Terms and Conditions.

  1. International Transfers

To provide the services you have requested we may share your personal data from time to time, which may involve transferring your data outside the UK.

Whenever we transfer your personal data out of the UK to countries which have laws that do not provide the same level of data protection as the UK law, we only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect any information held in that country or that the service provider acts at all times in compliance with applicable privacy laws.

Some of our service providers, including the provider of our AI voice assistant, may process your personal data outside the UK. Where this happens, we rely on appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement. See Section 9A for more information.

Credit and Finance Companies

Your personal information, including credit scores, may be shared with credit agencies (e.g., Experian) and third-party finance companies for the purpose of facilitating financial agreements. These organisations may conduct additional credit checks as required who may also disclose your information to credit agencies.

Protecting Your Information

We take steps to ensure all third-party partners comply with data protection laws and safeguard your information as we do. Only the necessary details are shared to fulfill their services.

  1. Data Security

We have implemented appropriate security measures to prevent your data being accidentally lost, used or accessed in any unauthorised way, altered or disclosed, including but not limited to:

  • Limited access to personal data - to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
  • Encryption and password protection for sensitive data
  • Regular security audits

Emails sent via the internet may be intercepted, lost, or altered, and we cannot guarantee their security.

  1. Retention of Data

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. Retention periods for recordings, transcripts and summaries of calls with our AI voice assistant are set out in Section 9A.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data: see paragraph 16 below for further information.

  1. Your Rights

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

  • Access: Request a copy of the personal data we hold about you and check we are processing it lawfully;
  • Correct: Update incomplete or inaccurate information, though we may need to verify the accuracy of this;
  • Erase: Request deletion of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  • Restrict: Request the limit or restriction of the processing of your personal data. For example, if you want us to verify the accuracy of your data, you can request that we suspend its processing while we confirm and correct any discrepancies. If you believe our processing of your data is unlawful but you do not want it erased, you can ask us to restrict its use instead. Additionally, if you need us to retain your data, even though we no longer require it, for the purpose of establishing, exercising, or defending legal claims, we can restrict processing upon your request. If you have objected to our use of your data but we need to verify whether our legitimate grounds for processing override your rights, we will suspend processing while we assess this. In any of these cases, we will restrict the processing of your personal data but continue to store it, unless you request otherwise or the restriction is lifted.
  • Object: Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
  • You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see Opting Out of Marketing in Paragraph 10 for details of how to object to receiving direct marketing communications).
  • Withdraw Consent: Revoke any consent given for processing of your data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

To exercise these rights, you can contact us at any time by completing our Customer Care Form. Select the "Data" option and then choose "Data Query." The form can be found on our website or accessed directly here: Customer Care Form. Or alternatively, you can call us on 0161 524 0023.

We try to respond to all legitimate requests within 30 days. Occasionally it could take us longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

  1. Third-party Links

This Policy may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Last updated: 30th September 2026