THE DEBTCO PRIVACY POLICY

Effective from 18/10/2020

The Debtco Privacy Policy sets out how Debtco UK Solutions Limited and all subsidiaries (hereafter known as DebtCo UK) uses and protects your personal data. DebtCo UK may decide to change this policy by updating this page. To understand any changes made, be sure to check this page on a regular basis.

Why does DebtCo UK have access to and processes your personal data?

Under the terms of your original agreement with the lender of credit, your personal data may be passed to a third party in the event that repayments are not made as agreed for the purposes of debt collection.

DebtCo UK is a debt collection agency. We are part of the Taurus DebtCo Holdings (UK) Limited organisation, registered with the companies house under number 14993479.

The original creditor has assigned your account to DebtCo UK who will now assume the day to day responsibility over your account. DebtCo UK is the data controller, unless we are not the owners and acct as the data processor on the instructions of the data controller (our client).

Following the assignment of your account, the original creditor transferred your personal data to DebtCo UK. The data originates from when you first applied for credit and includes limited data collection by the original creditor during the life or your accounts, such as contact detail updates, payment history, and default details. Additional information such as statements, copy of agreements, and identification copies may be obtained from the original creditor upon request and subject to availability.

The process of debt collection is of public interest and we at DebtCo UK have a legitimate interest to process your personal data as your account has legally been assigned to us. The processing of your personal data is necessary to collect the debt and is not allowed even if you do not consent to the processing.

In accordance with our legitimate interest, we may also undertake activities such as:

• Tracing
• Analytics and scoring to ensure compliance with sound debt collection practices
• Enrichment of the data from different sources e.g. Credit Reference Agencies, 3^rd party tracing specialists
• Obtain data from suppliers where our legal grounds for processing permit us to do
• Review historical or active other cases we hold on you (from previous accounts or other client accounts serviced by us)
• Search public registers

We will verify that the data we hold on you is correct and share your data with approved third parties such as other debt collection agencies, process servers, and solicitors. Your data will be held securely in compliance with data protection legislation.

What type of personal data are you processing about me and why?

We hold a number of different data elements that supports us in the management of your account. In order for us to be able to communicate with you and to ensure correct identification, we process your name, date of birth, contact details such as address and address history, telephone number(s) and e-mail address(s). We may also hold information such as bank account number(s) and direct debit request forms.

In order to evaluate your ability to repay we process financial information such as your payment history, default details, credit history information, and information on your debt, income assets, credit agreements, loans and credit ratings (past and present). This is processed in order for us to undertake a risk assessment, and risk management, agree on repayment plans, to assess affordability and your current circumstances.

To understand your circumstances and to make an informed decision on how to manage your account, we also process your reasons for non-payment subject to the information you provide to us. For example; individual or family circumstances, employment situations, and/or health conditions (please refer to the special data categories section) may affect your ability to repay.

The personal data we hold is also required to enable us to pursue legal actions and/or obtain enforcement. Legal action is, however, used as the last resort having first exhausted all other available options to agree repayment. We also use your personal data to ensure sound collection practices such as through scoring activities based on historic and performance-based information; by recording telephone conversations to train our employees and to document communications received from you. For our team member's security and to keep personal data safeguarded at all times, we also use closed-circuit television surveillance cameras within all our group locations.

We have a legal obligation to provide your personal data when we are audited by regulatory authorities to prevent, monitor, and evidence any fraud, money laundering, and other criminal activities.

As part of our corporate responsibility, we also provide anonymised statistics, scorecards, and analysis where your data may be used to assist in the accurate pricing of portfolios or to assist in the identification of new customer contact strategies to enable us to ensure fair customer outcomes.

The information we hold on you may be anonymised and used for developing our business. However, where necessary to secure your personal data and to ensure appropriate development of and changes in our IT system, your personal data may be used on an “as is” basis.

Unless otherwise agreed with you or there is a legal requirement, we will not include special categories of personal information (see below)

Are you processing any sensitive data (special categories of data) on me?

Unless otherwise agreed with you or where there is a legal requirement, or DebtCo UK believes it is in your ‘vital interests, we will not process special categories of personal information on you (often known as ‘sensitive personal data such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life).

It may however benefit you to notify us of any health condition, disability, and/or personal information relating to your private life that may impact on your ability to repay your account. This will allow us to take reasonable steps to accommodate your needs or requirements such as allowing sufficient breaks in your payment arrangement, providing breathing space (suitable time) to seek free independent debt advice, or adjusting your payment arrangement.

This information will be used by us to assist you and will be kept as long as it is required for this purpose, or until such time as you notify us that you no longer consent to its processing or it is unnecessary for the establishment, exercise, or defence of legal claims. This is not a blanket right and DebtCo UK will review your request to ensure its compatibility with DebtCo UK legal grounds for processing.

When collecting any special categories of data disclosed by you in helping us understand your circumstances, we will obtain your specific and informed consent to process the data. We will also inform you at the point of capturing this data to whom the data will be disclosed. In some cases, this information may be disclosed to the original creditor as part of their ongoing auditing or as part of a dispute that you may raise that necessitates DebtCo UK sharing this data accordingly.

Withdrawal of consent

You have the right to withdraw your consent where DebtCo UK is processing your data using consent as the legal basis. In the context of administering your account, this legal basis is only likely to apply, where you have disclosed ‘special categories of personal data to DebtCo UK. We will (where our legitimate interest does not override this right) consequently stop processing the data.

DebtCo UK reserves the right to continue processing the data, where we believe that it would not be in your ‘vital interests. For example, where DebtCo UK believes that to stop processing the data may result in significant harm to your well-being.

Do I have to provide you with my personal data?

Most (if not all) personal data that we process about you comes from another source than yourself, such as the original client, Tracing and approved data suppliers.

You may choose to provide us with additional personal data or special categories of personal data. Such information helps us to manage your account with due care and diligence for your benefit.

Will my personal data be transferred to another country?

As we are part of the Taurus DebtCo Holdings (UK) Ltd we may transfer your data to another country outside of the European Economic Area (EEA). If we do so, we will ensure there are suitable safeguards in place to comply with the GDPR.

Generally your personal data will not be transferred outside of the EEA. However, in cases of international debt collection, your personal data may be transferred to one of our representatives or sub-contractors working in the relevant country.

We also use third party service providers to store or who may access your data, which may be located outside of the EEA, including, but not limited to the United States. We will never transfer your personal data outside of the EEA without ensuring the safety and protection of your personal data. In relation to transfers to the United States, we will rely on the Privacy Shield, which is an international data transfer agreement where US companies commit to a higher level of privacy protection than is required by US law.

We may also disclose information outside of these groups to help prevent fraud, or if required to do so by law.

How long do you store my personal data?

We will retain your data as long as required for the lawful purpose for which it was obtained, as long as we have a legitimate interest to keep it e.g. to ensure good debt collection practices and to be able to defend ourselves against legal claims. We are also legally obliged to keep your personal data for a period of time to prevent and detect fraud, detect and evidence money laundering and for financial audits. For statistical purposes we will keep pseudonymised and anonymised data.

Where a debt is due and payable, this data will be retained until such time the debt is either extinguished, paid (settled) or closed.

Data will be maintained in accordance with the following retention timescales:

• Customer data (including correspondence) will be retained for six years following account closure to allow for the defence of legal claims;
• Customer call recordings will be retained for a period of six months from the date of the call (this may be extended where a complaint or legal case necessitates the holding of the call recording for a longer period);
• Debtco will process data for statistical purposes to help improve its debt collection practices. Where this is undertaken, personal details will be anonymised and retained for up to nine years;
• We will also delete your data in our backups, but only when the backup tape comes up for destruction, according to our backup policy. Data on backups will be retained for a period of five years.

What rights do I have?

It is important you understand that it is your personal data that we process and that we want you to be comfortable with us doing so. Even if we do not need your permission to process your personal data, you have certain rights in relation to the processing of your personal data.

So what does that mean?

You have the right to be informed:

You have the right to be informed about the collection and use of your personal data. This is a key transparency requirement under the GDPR. DebtCo UK’s Privacy Policy provides you with information including: our purposes for processing the personal data, retention periods for that personal data, and who it will be shared with.

The right to access:

You may request information on how we process your personal data, including information on:

• Why we process your personal data.
• What categories of personal data we process.
• Who we share your personal data with.
• How long we store your personal data or the criteria for determining this period.
• What rights you have.
• From where we have received your personal data (if we have not received it from you).
• If your personal data has been transferred to a country outside of the EEA, how we ensure the protection of your personal data.

All the above information is available in this Privacy Policy.

You may also request a copy of the personal data we process about you. This is known as your Right to Access. Additional copies where considered manifestly unfounded may be combined with a fee or rejected where deemed appropriate.

Right to rectification:

It is important that we have the right information about you and we encourage you to let us know if any of your personal data is incorrect, e.g. if you have changed your name or moved address.

Right to erasure (to be forgotten):

If we process your personal data in an unlawful manner, you may ask us to delete this information. It is however unlikely that we will delete your data unless you have settled the account or it is closed.

Right to restrict processing:

From the time you have requested we correct your personal data or if you have objected to the processing, and until we have been able to investigate the issue or confirm the accuracy of your personal data (or changed it in accordance with your instructions), you may be entitled to the restriction of processing. This means that we (except for storing the personal data) may process your personal data only in accordance with your consent, if necessary with reference to legal claims, to protect someone else's rights or if there is an important public interest in the processing.

In many circumstances, it will be necessary for Debtco UK to continue processing data, to protect the rights of another natural or legal person, or because it’s an important public interest of the union or member state as previously stated.

Please note that once we believe that we have resolved the dispute or validated the accuracy of the data we hold, we will continue to process your data in accordance with our overriding legitimate interest.

Right to object:

If you believe that we do not have the right to process your personal data, you may object to our processing. In such cases, we may continue processing only if we can show our overriding legal grounds for processing out-weigh your rights and freedoms under the GDPR. However, we will process your personal data if it is required for the determination, exercise or defence of legal claims (note that this right only provides you with the ability to raise your objections, not a blanket right to have any and all processing ceased).

How to complain about the use of your data or exercise my rights?

If you wish to raise a complaint about how we handle your personal data, including in relation to any of the rights outlined above, you can contact our Data Protection Officer at dpo@taurus-debtco.com or write to Data Protection Officer, Kings Chambers. Office 10. Queens Street. Derby. DE1 3DS and we will investigate your concerns.

If you are not satisfied with our response, or believe we are processing your data unfairly or unlawfully, you can complain to the Information Commissioner’s Office (ICO). You can find further information about the ICO and their complaints procedure here.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to our customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website experience by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

How do I disable cookies?

Follow the instructions via this link: https://www.avast.com/c-enable-disable-cookies

What happens if I disable cookies?

This depends on which cookies you disable, but in general the site may not operate properly if cookies are switched off. If you only disable 3rd party cookies you will not be prevented from properly using this site. If you disable all cookies you may not be unable to use dynamic areas of this site.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Privacy Policy. You should exercise caution and look at the Privacy Policy applicable to the website in question.

Accessing your personal information

You may request details of personal information which we hold about you under the General Data Protection Regulation. Whilst Debtco will not charge you to access the information you have requested, we reserve the right, where additional copies are requested and are considered manifestly unfounded, to charge a fee or reject the request where deemed appropriate.

If you would like to request a copy of the information held on you please visit our contact us page.

If you believe that any information we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any information found to be incorrect.

‍