The Shawbrook Group plc Shareholder Privacy Notice

Personal data means any information about an individual from which that person can be identified. It does not include data where the individual’s identity has been removed (anonymous data). We may collect, store, use and transfer, the following information about you:

(a) Identity Data including first name, last name, title, nationality, date of birth, and gender.

(b) Contact Data including postal address, email address and mobile and telephone numbers.

(c) Transaction Data including bank account information, tax information, next of kin and beneficiary details, as well as information about your shareholdings, past transactions and dividend payments.

(d) Attendance Data if you register or attend any of our shareholder events, presentations or investor events we may collect your registration details, attendee type, voting record, attendance record.

(e) Adjustments Data including details of any disability you may have disclosed to us in order for us to provide services to you in a more accessible format.

(f) Communication Preferences including preferred language, preferred contact method and your preferences in receiving direct marketing material from us and certain third parties.

(g) Usage Data including information about how you use our site, products and services.

(h) Technical Data includes (where you access the Bank websites), internet protocol (IP) address, login data, browser type and version, time zone settings and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the website.

We will only collect any Special Categories of Personal Data about you (including details about, your race or ethnicity, religious or philosophical beliefs, sex life and sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data) if the law allows us to do so.

We may also collect, use and share aggregated data which is not personal data as it does not reveal your identity either directly or indirectly.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. However, we may process your personal data without your knowledge or consent where this is required or permitted by law.

We collect personal information about you from various sources, including:

Information you provide to us:

• by filling out forms;
• by using our website;
• by corresponding with us by post, phone, e-mail, text, live-chat or otherwise;
• by attending events hosted by us.

Automated technologies or interactions:

• as you interact with our website or e-mails sent to you from us, we will automatically collect Technical Data about your equipment, location, browsing actions and patterns.

Third parties:

• As part of our regulatory duties to conduct identity and financial crime checking procedures with credit agencies, fraud detection agencies and registration or stockbroking industry exchanges as well as public information sources;
• Market researchers
  • From third parties when you have instructed for them to pass information on to us:
    Your broker, agent, Trustee or Investment Company and companies that introduce you to us;
  • Where Computershare as share registrar is informed of a change of details on the share register, these updates will also be applied to your shareholding to ensure we maintain accurate records;
  • Providers of technical, payment and delivery services.

We will keep your data confidential, but we may share it with third parties who work alongside us to deliver our services, fulfil our legal and regulatory obligations or at your request. We may share your personal information under the following circumstances:

• other Shawbrook entities who help us to deliver online portals, products and services in connection with running accounts and services to you;
• under UK company law Shawbrook is required to make available, upon request, its register of members, including name and address of shareholder, number of shares and date of membership;
• anyone acting on your behalf with authority to do so, such as, power of attorney or your professional advisors;
• third parties acting as our Share Registrar who manage our share register such as Computershare;
• banks and other payment service providers in order to process your entitlements and payments;
• credit reference agencies and fraud detection agencies when conducting identification procedures as part of our regulatory responsibilities;
• legal and regulatory bodies such as, the Financial Conduct Authority (FCA), the Prudential Regulatory Authority (PRA), HMRC, the Information Commissioner’s Office (ICO), our professional advisors and the courts;
• organisations that provide us with business support services. For example, account service and administration companies, back-up and server hosting, IT software and maintenance platforms and document storage and management services; and
• third parties who have introduced you to us such as your broker, agent, Trustee or Investment Company;

We require all third parties we share your personal information with to provide sufficient security guarantees and demonstrate a commitment to compliance with applicable law and this privacy notice.

Your personal data will in limited circumstances be transferred outside the UK.

We will only share personal data with others outside the UK when we are legally permitted to do so, namely where:

(a) the UK government has decided that the relevant country has adequate protective rules in relation to data protection in place (an “adequacy decision”); 
(b) we have entered into the relevant “standard contractual clauses” with the recipient of your personal data (these are a set of obligations about how your data is protected and used); or
(c) we can rely on another basis under the law such as that we have to share the personal data because this is necessary for the purpose of a court case, investigation or to protect our legal rights.

In limited circumstances we use automated decision making systems to take decisions about you when:

(a) We conduct assessments for deciding whether your accounts may be being used for fraud or other financial crime;
(b) We undertake anti-money laundering and sanctions checks; and
(c) We verify your identity.

In instances where we make automated decisions about you using your personal data you can object to the decision reached and request that a person reviews it. For additional information, or to exercise this right please submit your request here or alternatively contact us.

Your personal data will not be retained longer than is necessary for us to achieve the purpose for which your personal data was obtained. Certain records, such as those related to your shareholding, will be kept for longer periods in line with our legal, regulatory, tax or accounting requirements.

When considering the retention period for personal data we take into consideration a variety of factors including the sensitivity, nature, amount and potential risk of harm arising from the personal data in question. This process is documented in accordance with our record retention procedures which we review periodically.

We understand the importance of keeping your personal data secure and have put in place appropriate security measures to prevent your personal data being lost, used or accessed in an unauthorised way, altered, destroyed or disclosed. Access to your personal data is limited only to those employees, agents, contractors and other third parties who have a business need to know. Where they process your personal data, they are bound by the same confidentiality requirements and will only do so on our instructions.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any relevant regulator of a breach where we are legally required to do so.

We strive to ensure that your personal information stored by us is kept up to date and accurate. Should any of your personal information that you have provided to us or other third parties change, please contact our Registrar at Computershare through your personalised Investor Centre log-in or through our shareholder telephone number: 0370 702 0003. It may be necessary, in some cases, for us to seek further evidence to verify your request.

Subject to applicable laws, and in order to comply with our legal requirements, regulations, internal policies and procedures for the purposes of the detection and prevention of crime, and to improve your experience when contacting us we will monitor and record calls, emails, text messages, social media messages and other communications.

Right to access

You have the right to access the personal data held about you and to obtain certain prescribed information about how we process it (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and check it is being processed lawfully. 

Right to rectify your personal information

If you discover that we are holding information about you that is inaccurate or incomplete you have the right to have this information corrected, though it may be necessary for us to verify the accuracy of the new data you provide to us.

Right to erasure

You have the right, in certain circumstances, to request us to erase the personal data that we hold about you. It may not always be possible for us to remove your personal data where, for example, we are required to retain information to comply with our legal obligations. In an instance where we are not able to erase your data this fact, and the reasons for the refusal, will be communicated to you.

Right to restriction of processing

You have the right to request a restriction of processing of your personal data in the following circumstances:
(a) if you want us to establish the accuracy of your personal data we hold;
(b) where our use of your personal data is unlawful, but you do not wish us to erase it;
(c) where you need us to hold the data, even if we no longer require it, for the purpose of you establishing, exercising or defending legal claims; or
(d) where you have objected to our use of your data, but we need to verify whether we (or a third party) have an overriding legitimate grounds to use it. 

Right to object to processing

You have the right to object to the processing of your personal data where we (or a third party) are relying on a legitimate interest to process that data, and you believe it has an impact on your fundamental rights and freedoms.

Right to data portability

You have the right to receive, copy, move or transfer your personal information to you or a third party. We will provide to you, or a third party chosen by you, your personal data in a structured, commonly used, machine-readable format. This right only applies to information you provided to us with your consent or as part of a contract and the processing is automated.

Right to withdraw consent

Where we are relying on consent to process your personal data you have the right, at any time, to withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. 

If you have any complaints about how we handle your personal data, please contact us by email at dataprotectionoffice@shawbrook.co.uk 

You also have a right to make a complaint to the supervisory authority in your country of residence or employment or place of the alleged infringement. The Information Commissioner’s Office (“ICO”) is the UK supervisory authority for data protection issues. You can contact the ICO:

by Telephone:0303 123 1113 or 01625 545 745

or in writing to:
Information Commissioner’s Office (ICO) 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF   

or via their website: https://ico.org.uk/

We keep this Shareholder Privacy Notice under regular review and any updates will be posted on our website in the most recent version. Where appropriate changes may be notified to you by post or email. 

Last Updated 20 October 2025