Skipton B.Soc Privacy policy email

tls123

This sounds extremely worrying a number of customers on Trust Pilot have expressed their concerns but Skiptons’ responses are lacking in detail probably written by Artificial intelligence. Skipton should not be sharing data with a default opt in policy this is wrong i don’t think the ICO would look favourably at this. Skipton seem arrogant to try this with their customers it’s just another way of Skipton Building Society milking their customers. Data is highly profitable and Skipton are exploiting this. 

OrangeBlueGreen

This is an odd move by Skipton.

caper7

I have only just opted out thanks to seeing this thread (Thank you!)
The email arrived on the 4th. I am unclear if they are clarifying something they were already doing or if it's new. If it's a new policy, have our email addresses already been shared between the time of their announcement/email and us opting out (in my case 5 days)?
I have gone to the effort of setting up dedicated email accounts for banking institutions to try and keep them as secure as possible and Skipton think randomly sharing my email address is a good idea?
I'm livid. 

itsthelittlethings

I think you’re allowed to share data for certain purposes, they are not randomly sharing your data, they’re sharing it with their ad agency.

masonic

They are allowed to share it if you consent to it. This must be clear affirmative action, not a default opt-in with an opt-out buried within the policy.

It's a bit of an assumption that you'd use the same email address for Skipton as you would on social media, if you use social media.

Agree with comments about ICO. Complaint to Skipton will be more effective.

I've received no notification of this yet, so I don't know when it is to start, but I certainly don't want Facebook processing my email address. It looks like I'm safe though as I never accept optional cookies, and presumably this is just the use of third party cookies for tracking (which I block, along with all social media widgets on websites).

If it is tracking through use of cookies, then you'll be giving clear affirmative acceptance when you allow advertising cookies on the Skipton website 

Stolas

I wrote a complaint several days ago myself. 

I’ve also asked them to clarify if the address has already been shared, and if so, who with. Still waiting to see if they respond with anything meaningful. 

janusdesign

caper7 said:

I have only just opted out thanks to seeing this thread (Thank you!)

same here - saw the email last week, assumed it was just about adverts on the site (which I wouldn't see anyway) and thought no more about it... was only seeing this thread that made me look into it further and opt-out.

for me, I too use a unique email address with Skipton (not linked to any social media) - so if I ever received spam emails to that address, I know it will have come from Skipton.

masonic

A little bit of research on the Wayback machine shows that this policy is not new. Back in December 2017 they had a very simple policy with no mention of social media use of customer data. Then by May 2019, the sharing of data with social media platforms for profiling purposes was added with no specific details of who they were sharing data with. Due to the web technologies used, an archive of the detail of the policy isn't available again until May 2022, where there is specific mention of sharing data with Facebook, and no opt-out link. This policy has remained (with update of Facebook Ireland to Meta Ireland) until 1st July. The page was updated some time over the following week to disclose that your email address is one of the details shared, and add the opt-out, which was there by 7th July.

So they've been sharing data with social media platforms for at least 6 years, including Facebook for at least 3 years, and the recent update is the ability to opt out of this. Whether email address sharing is new, or they've just made the policy a bit more detailed, I don't know, but they've certainly been handing over personal data for a long time.

gt94sss2

I received a response to my complaint which I am posting here as I assume others will get a very similar response.

In brief, Skipton rejected it..

As outlined in our communication, we work with social media and advertising providers to deliver adverts about our products and services which we believe to be relevant to you. One of the ways we do this involves sharing limited personal information, such as your email address, with trusted partners, under the lawful basis of legitimate interest. Doing this, enables them to present adverts that are more tailored to your interest.

I would like to take this opportunity to explain that we have additional security in place to protect your information when it is shared. We use a technique before sharing the data which renders it unintelligible. This means your personal data, like your email address, is transformed using a method that scrambles the information. This ensures that only the intended third-party can check to see if they hold any matches i.e to see if they already hold your data. Please note our partners retains a record of any matches but do not retain the information we share.

Please be assured that:

-We only share your data with third parties where there is a lawful basis to do so, and we ensure that any sharing is secure and appropriate.

- You can opt-out of the sharing of your data with our advertising partners and social media companies at any time.

Data Protection law requires us to satisfy one of several conditions in order to lawfully collect, use, store and share your personal information. Obtaining consent is one of those conditions but it's not the only one.

There is a condition that allows us to pursue our 'legitimate interests' so long as this doesn't override your rights. This is the condition we are relying upon to share personal data with our advertising partners and social media providers.

The activity is necessary for us to provide more personalised online adverts to our customers.

Prior to the latest update we communicated, our data privacy notice already contained information about sharing information with social media companies. Given our commitment to transparency we felt it was appropriate ahead of starting this activity to expand on this information and communicate the change along with details of how to opt-out.

If you prefer not to receive personalised adverts, you can opt out by following the link provided in our email and entering the email address we hold for you. It's important to note that this opt-out only applies to the personalisation of adverts on online media platforms. It does not prevent all advertising and it does not affect other forms of data processing.

 

x44

Yes - the rejection to my complaint dropped though my letterbox today - same words used by them in their letter to me.