For the purpose of the General Data Protection Regulation (GDPR) the data controller is Plum Fintech Limited, registered at 2nd Floor, 5-8 Dysart Street, London, EC2A 2BX. We are an appointed representative of Resolution Compliance Limited, and with respect to our regulated activities as investment arranger (Plum Investments) we and Resolution Compliance Limited will act as joint controllers of your personal data. If you have any further questions, you can reach our Data Protection Officer on firstname.lastname@example.org.
We process data collected from you, your bank, and third parties, to make Plum work for you, and comply with regulatory obligations. In short, most importantly we use:
We share your data with other companies to fulfil our contract with you, or comply with regulation:
You may give us information about yourself by accessing our website withplum.com (site), by using the app service or by corresponding with us by phone, e-mail or otherwise.
This is information necessary to provide the basic Plum Service (to fulfil the contract between us) and to comply with regulatory obligations to ‘Know Your Customer’ (KYC):
This is information we require to unlock additional features upon your request and to fulfil the associated contract, or information we might request from you to perform our regulatory obligations:
When you use Plum, or visit our website, we automatically collect information, including personal information, about the parts of the Plum Service you use, and how you use them. This information is necessary for the adequate performance of the contract between us, to enable us to fulfil our regulatory requirements, and given our legitimate interest in being able to provide the Plum Service:
We receive the following personal information about you from our third party service providers who assist us in providing some or all of the Service:
To provide and improve the Plum product — we process the information we collect given our legitimate interest in improving the Plum Service, and in order to fulfil the contract we have with you:
To prevent fraud, and ensure compliance with regulatory obligations — we process the information we collect given our legitimate interest to protect us from fraud, and to comply with our regulatory obligations:
Other Plum users — in providing a referral programme there is a legitimate interest in sharing your Plum name with the person who invited you, to let them know the invite was successful and in order to fulfil the invite terms.
Aggregated Data — we may also share aggregated information (information about our users that we combine together so that it no longer identifies or references an individual user) and non-personally identifiable information for industry and market analysis, demographic profiling, marketing and advertising, and other business purposes. This is not considered personal data under GDPR as it can’t be used to directly or indirectly identify you.
Business Transfers — in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets. If Plum Fintech Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
We generally retain your information for as long as it is necessary for the performance of the contract we have with you, or to comply with our regulatory obligations. If you no longer want us to use your information you can send a request to email@example.com. Please note that if you request erasure of your personal data, we will keep relevant personal information for at least 5 years to comply with our regulatory obligations.
A great thing about the GDPR is that consumers have much more control over how companies like Plum use your data. See below how you can assert those rights with Plum.
Getting a copy of your data — you have the right to get a copy of the data we hold about you. This is free of charge. To do this, please reach out to firstname.lastname@example.org, or talk to our support team by typing ‘chat to human’ in the Plum service.
Rectification of inaccurate or incomplete information — you have the right to ask us to update any information we hold which may be inaccurate, and which you can’t change yourself through the Plum service.
Erasure of data or the ‘right to be forgotten’ — you have the right to ask us to erase personal information we hold on you, and close your Plum account. If you do this, we might maintain personal information we hold on you which is necessary to comply with our regulatory obligations, or to reduce fraud.
Withdrawing consent, and restricting processing — to withdraw consent or restrict processing you may contact customer support. If you withdraw consent to share your financial transaction data, we will be unable to provide the Plum Service to you. Some information you have provided us will be retained after you withdraw consent to comply with regulatory obligations.
Lodging complaints — you have the right to lodge a complaint with the Information Commissioner’s office for any processing carried out by Plum. You can contact the ICO ico.org.uk or telephone: 0303 123 1113.
All information you provide to us is stored on our secure servers. Any transmission of information to our partners (including information to facilitate payments) are encrypted using TLS technology, the current standard in secure communications over the Internet. Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.
Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. Information we deem sensitive (like your bank account number and sort code and your national insurance number if provided) are stored using state-of-the-art symmetric encryption (AES). We will only send your data outside of the European Economic Area (‘EEA’) to comply with a legal obligation, or when we work with third parties in providing you the Plum service. If we do transfer your personal information outside the EEA to our suppliers, we will make sure that it is protected to the same extent as in the EEA.
The energy comparison and switching service is powered by Decision Technologies Limited, a company registered in England & Wales under company number 05341159 with its registered address at First Floor, High Holborn House 52-54 High Holborn London WC1V 6RL ("Decision Tech").
We share your personal data with Decision Tech so that they can help us help you switch. For example, we share your personal data with Decision Tech to find out what energy tariffs are available to you.
Decision Tech will share limited details about you with their suppliers so that we can help you switch. For example, Decision Tech share your address with GB Group plc, who provide Decision Tech’s address look-up service.