Privacy Notice

Using your personal information

Please read this privacy notice to understand how we use and protect the information you provide to us.

Who we are

We are The Co-operative Bank plc, also trading as smile, Britannia and Platform (and known as "the Bank"). When we use the terms we, us or our in this privacy notice, we mean the Bank.

We are a subsidiary of Coventry Building Society, which means that we are part of the following group of companies:

• Coventry Building Society
• Godiva Mortgages Limited
• ITL Mortgages Limited
• The Co-operative Bank Holdings plc and its subsidiaries
• The Co-operative Bank plc (also trading as smile, Britannia, and Platform) and its subsidiaries

This is known as "the Group".

Sharing your information within the Group

We may share your personal data within our Group where we have a lawful basis to do so.

Who is the data controller

Under data protection law, an organisation that decides how the personal information it collects, processes, and holds, is used is called a 'data controller'.

If you're applying for a role with The Co-operative Bank the data controller of your personal information is The Co-operative Bank and Coventry Building Society. If you're applying for a role with Coventry Building Society, the data controller of your personal information is the Coventry Building Society.

Data protection law and how it protects you

Data protection law requires us to manage all personal information in accordance with the data protection principles. In particular, we are required to process your personal information fairly and lawfully. This means you are entitled to know how we intend to use any information you provide. You can then choose whether you want to give it to us so we can provide the product or service you require.

1. Where we obtain the information

Your personal information will be held securely by the Bank so we can (either now or in the future) manage your relationship with us. This will include information you provided when you apply to us, and any additional information provided by you or others in various ways, including:

1. 1.1 Your name, address, email address, telephone number and other contact information;
2. 1.2 Your resume or CV, cover letter, previous and/or relevant work experience or other experience, education, memberships or other information you provide to us in support of an application and/or the application and recruitment process;
3. 1.3 Information from interviews and phone-screenings and assessment processes you may have, if any;
4. 1.4 Details of the type of employment you are or may be looking for, current and/or desired salary, and other terms relating to compensation and benefits packages, willingness to relocate, or other job preferences;
5. 1.5 Details of how you heard about the position you are applying for;
6. 1.6 Any sensitive (known as "Special Categories") and/or demographic information obtained during the application or recruitment process such as gender, information about your nationality, medical or health information and/or your racial or ethnic origin;
7. 1.7 Reference information and/or information received from background checks (where applicable), including information provided by third parties, internal references; and/or
8. 1.8 Information relating to any previous applications you may have made to the Bank and/or any previous employment history with the bank.

We will not retain your personal information for longer than is necessary for the maintenance of your employment, or for legal or regulatory requirements. The Bank retains personal data relating to employees, after the end of the employment term, for a maximum of 7 years to meet our legal requirements. If you have any questions relating to the retention periods applied to your data please contact the Group Data Protection Officer at the following email address [email protected]

2. The personal information we collect and process

The Bank will only gather and process the relevant type and amount of personal information required, allowing us to help you recruit and then manage your employment with us.

The categories of personal information that we collect (or create on your behalf) are:

3. How we use your information

We will use the personal information we hold about you for the following administrative activities:

By processing this information it enables us to manage your application in the efficient way you expect.

Your information will also be used for other purposes for which you give your specific permission, or, in very limited circumstances, when required by law.

4. When we will share your information

We will treat your personal information as private and confidential but will disclose it outside the Bank if:

1. 4.1 Allowed by this agreement;
2. 4.2 You consent;
3. 4.3 Needed by sub-contractors to help us manage your records;
4. 4.4 The law, regulatory bodies or the public interest permits or requires it;
5. 4.5 Needed by organisations who provide us with a service, on the understanding they keep your information secure and confidential, unless you tell us not to;

We will always ensure your information remains safe and secure. Please go to co-operativebank.co.uk/global/thirdparties to see our HR supplier register.

5. Individual Rights

Right to be informed – you have the right to be informed about what we do with the data we have about you.

Right to access – you have the right to access personal data and supplementary information that is held about you by the Bank.

Right to rectification – you are entitled to have your personal data rectified if it is inaccurate or incomplete.

Right to erasure – you have the right to request the removal or deletion of your personal data (also known as "right to be forgotten"), where there is no compelling reason for the Bank to continue processing this data. The Bank can refuse your request where there is a legal obligation to hold the information. This will be further explained to you upon making a request.

Right to restrict processing – you have the right to restrict the processing of your personal data in the following circumstances (i) where you contest the accuracy of the personal data. The Bank will restrict the processing until you have verified the accuracy of the personal data (ii) where you have objected to the processing, and until the Bank has considered the legitimate grounds to override the processing. (iii) when processing is unlawful. (iv) where the Bank no longer needs the personal data but you require the data to establish, exercise or defend a legal claim.

Right to data portability – this right allows you to move copy or transfer your personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

Right to object – you have the right to object to processing for direct marketing (including profiling) purposes. The Bank can refuse this right where there is a legitimate interest for processing your personal data. This will be further explained to you upon making a request.

6. Legitimate Interest Tests

As an essential part of our business, the Bank collects, holds and manages ("processes") data relating to our employees. The data protection regulation recognises in certain circumstances, processing may be deemed "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection".

To validate a specific purpose for data processing is indeed legitimate; the Bank will conduct a legitimate interests test. This will serve to balance our rights to process the data against the data protection rights of the affected individuals.

In making the decision whether or not legitimate interests may apply in each circumstance, we will ensure the balance of rights always favours the individual customer, and the processing will not cause the individual unwarranted harm by means of discrimination, damage to reputation, financial loss, and loss of confidentiality or other significant economic or social disadvantage.

7. Recording phone calls

We will monitor or record phone calls with you in case we need to check we have carried out your instructions correctly, to resolve queries or issues, for regulatory purposes, to help improve our quality of service, and to help detect or prevent fraud or other crimes.

Conversations will also be monitored for staff training purposes.

8. Obtaining a copy of your information

Under data protection law, you have the right to access the personal information we hold about you. Additionally, you have the right to restrict and object to certain data processing.

To request access to the information, and/or to inform us about a data restriction or objection, please contact the Group Data protection Officer at the address below or via email at [email protected]

Group Data Protection Officer
Coventry Building Society
Coventry House
Harry Weston Road
Binley
Coventry
West Midlands
CV3 2TQ

9. Your right to rectify and erase data we hold about you

It is important the information we hold about you is accurate and up to date at all times, as holding incorrect information can have an impact on what the bank shares with third parties such as the taxation authorities.

If you believe we are holding any information relating to you which is incorrect please contact us to let us know what is wrong, and we will work with you to put it right.

10. How we protect your information

We are committed to taking appropriate technical, physical and organisational measures to protect colleague personal information against unauthorised access, unlawful processing, accidental loss or damage, and unauthorised destruction. We also take appropriate measures to ensure the information disclosed to us is kept secure, accurate and up-to-date and kept only for so long as necessary for the purposes which it is used.

We limit access to our internal systems which hold personal information to a selected group of authorised users who are given access to such systems through the use of a unique identifier and password. Access to personal information is limited to and provided to individuals for the purpose of performing their work duties.

11. Changes to privacy notice

We will update this notice to reflect changes to our information practices. If we make any material changes we will notify you by means of a notice on our intranet site prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

12. Contact details for the Bank Data Protection Officer

If you wish to contact the Data Protection Officer in relation to any questions or confidential queries about this privacy notice or the information we hold and process about you, please email [email protected] or write to us at:

Group Data Protection Officer
Coventry Building Society
Coventry House
Harry Weston Road
Binley
Coventry
West Midlands
CV3 2TQ

13. Contact details for the Information Commissioner's Office

If you wish to contact the Information Commissioner for advice or to complain about the way you believe your information is used, please find their address and website below.

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Website: www.ico.org.uk

14. Changes to our Privacy Notice

This Notice is effective from April 2026.

From time to time, we may update the ways we use your personal information. When we do, we'll publish the latest version of our Privacy Notice within our journey.