NestEgg looks after personal data in line with the General Data Protection Regulation (GDPR). We follow the rules of data minimisation and storage limitation. This means we only collect the information we need, and we only keep it for as long as we need to.
We also limit how much personal information we hold to improve security. This is part of our commitment to following ISO27001 – an international standard for keeping data safe.
Who’s Responsible?
When it comes to the Decision Engine and Loan Matching, NestEgg is the Data Processor. Your Credit Union is the Data Controller. This means the Credit Union is responsible for making sure data is handled properly.
If the Credit Union wants to keep data for longer than NestEgg does, it should export the data from the Decision Engine before it is deleted.
How Long Do We Keep Data?
Declined Applications: Personal data is deleted after 90 days.
ID Check – Failed: Deleted after 90 days.
ID Check – Passed: Deleted after 90 days.
Accepted Applications: Data is kept for the loan term + 1 year. This includes the application, credit report, and summary Open Banking data.
Open Banking Transactions: Available for 90 days from when the applicant connects their account. Summary data is kept unless the applicant removes permission.
Uploaded Documents (like payslips or bank statements): Deleted after 90 days.
A credit report changes every month. So, for declined applications, it’s important that personal data is removed sooner.
Open Banking works the same way – permission to access this data only lasts for 90 days.
Exporting Accepted Applications
For accepted loans, we keep the full decision data longer. But you may still want to save your own copy.
To export a PDF:
Go to the Dashboard.
Find the application marked ACCEPT.
Click the Actions button next to it.
Choose ‘Export to PDF’.
This download includes the credit report, Open Banking summary, and any uploaded documents. Saving this to your core system can help if there are later questions about how you assessed affordability.