Version 1.1 - 1st July 2019
Chartsbridge is a debt collection and enforcement business. We are authorised and regulated by the Financial Conduct Authority (FCA) for the provision of certain services that we provide.
In order that we can provide our services, we collect and use personal data about individuals. This means that we are a data controller and we are responsible for complying with Data Protection laws. We adhere to the Principles of Data Protection, as set out in the Data Protection Act 2018 and the General Data Protection Regulations (GDPR). We do not undertake automated decision making about (or profiling of) personal data.
How the law protects personal information
Data Protection regulations say that we are only allowed to use personal information if we have a proper reason to do so. This includes sharing personal information outside our business. Data Protection regulations requires us to have one or more of these reasons:
- When it is in our legitimate interest;
- When it is our legal duty;
- To fulfil a contract;
Processing personal information
Debt collection and enforcement services are provided in the public interest. We have a legitimate interest to process your personal data if your account has been issued to us for debt collection or enforcement activities. The processing of your personal data is necessary and lawful if your account has been issued to us for debt collection or enforcement activities, even if you do not consent to the processing. In accordance with our legitimate interest we may undertake activities such as:
- Enhancement of data from different sources such as Credit Reference Agencies (CRAs);
- Obtaining data from suppliers where our legal grounds for processing permits us to do;
- Tracing of individuals, vehicles and assets;
- Reviewing historical cases we hold on you (such as accounts previously issued to us);
- Scoring to ensure compliance with good debt collection practices and;
- Searching public registers.
We will verify that the personal data we hold on you is correct and we will share your data with approved third parties such as Credit Reference Agencies, solicitors, Appointed Representatives and Certificated Enforcement Agents. Your data will be held securely in compliance with data protection legislation.
Information we obtain, process and/or store
We hold the necessary categories of personal data for the efficient management of each account, and this applies whether you have engaged us to provided services for you or whether your personal information has been issued to us for the processing of debt collection or enforcement activities. The personal information that we collect about you will vary depending on our relationship with you.
To diligently assess your ability to enter into any repayment arrangement we process financial information about you such as; your repayment history, account default details, credit history, account notes/history, other debts, income and expenditure (means), your assets, other credit agreements, loans and your credit rating. This information is processed to enable us to determine your repayment affordability by assessing your current circumstances. We may also need to process the reasons for your non-payment and this may be subject to information you provide to us, such as family or personal circumstances, changes to your job/employment and/or any health conditions (see special categories of data) that may affect your ability to repay a debt.
To be able to effectively communicate with you, efficiently manage your account and to ensure correctly identification, we will process your name, date of birth and contact details such as address history, telephone number(s) and e-mail address. Other information that we may process to enable us to efficiently manage your account and ensure correct identification will include:
- Full name (including title, forename, middle name and surname);
- Date of birth;
- Residential address(es) including former address(es);
- Email address(es);
- Mobile and landline telephone numbers;
- Vehicle registration;
- Vehicle registered keeper details;
- National Insurance Number;
- Driving Licence Number;
- Deceased date (for deceased customers);
- Trading name, business name or company name;
- Employment status;
- Employment details (including job title, employer name, address and contact details);
- Credit reference data;
- The location of your address or vehicle;
- Information and expenditure information;
- Visual and audio images obtained through use of Body Worn Video recording equipment;
- Financial information such as bank details provided for the collection of Direct Debits;
- Bank details that you have permitted us to use on your behalf;
- Information relating to your financial status or personal solvency;
- Information relating to your debt;
- Information held by our Client (claimant or creditor) relating to your account;
- Details about the property associated with a visit;
- Personal information collected pursuant to the debt collection and enforcement process;
- Information obtained from credit and tracing checks;
- Information obtained from public sources such as social media profile names;
- Caller line identification;
- Lifestyle information such as whether you are ex-directory;
- Telephone call recordings;
- Technical information about any visit that you make to our website including IP address.
Special categories of information we collect
Sometimes we will ask or collect information about your mental and physical health and in particular any information about disabilities you may have, any medical conditions, illnesses or whether you are pregnant. This type of information is known as 'special categories of information'. When we are carrying out debt collection or enforcement activities, we are required to determine whether individuals who are the subject of debt collection or enforcement action could be regarded as vulnerable. In order to make such a determination we may ask you for, or you may volunteer to give us, information about your vulnerability.
Withdrawal of consent
You have the right to withdraw your consent where we are processing your data using consent as the legal basis. In the context of administering your account, this legal basis is only likely to apply, where you have disclosed ‘special categories’ of personal data to us. We will (where our legitimate interest does not override this) consequently stop processing the data.
We reserve the right to continue processing the data, where we believe that it would not be in your ‘vital interests’. This may, for example, be in cases where we believe that to stop processing the data could result in significant harm to your well-being.
Do I have to provide you with my personal data?
Most of the personal data that we process about you will have come from another source than yourself, such as our Client, Credit Reference Agencies or our approved data suppliers.
You may choose to provide us with additional personal data or special categories of personal data. Such information helps us to manage your account with the appropriate diligence and due care for your benefit.
How we collect your personal information
We will collect your personal information from sources including:
- Information provided from our Clients (the original claimant or creditor);
- Credit Reference Agencies;
- Third party tracing agencies;
- Public sources (such as search engines or information available on the internet);
- Driver and Vehicle Licensing Agency (DVLA);
- Motor Insurance Database (MID);
- Information obtained when address visits are made on our behalf;
- Information provided by parties present when address visits are made on our behalf;
- From Body Worn Video recording equipment used on our behalf;
- From information you provide to us;
What we use your personal information for
We may process your information for a number of different purposes. For each purpose we must have a legal ground for such processing and we will rely on the following legal grounds.
When it is in our legitimate interest
When we have a legitimate business need to use your personal information. We will in most circumstances process your data under its legitimate interest to do so. Such need will cover all activities required to carry out everyday business activities and will include:
- Using your personal information to carry out debt collection and enforcement services;
- Keeping business records;
- Ensuring that we have up to date records;
- Statistical analysis;
- Analysing our business;
- Management information;
- Improving the services we offer;
- Carrying out strategic reviews of our business model;
- Developing and testing our systems.
When relying on this legal ground, we are under a duty to assess your rights to ensure that we do not use your personal information unless we can demonstrate a legitimate business need.
When it is our legal duty
When it is necessary to comply with a legal obligation such as our obligations under the law to protect vulnerable people.
When we use your ‘special categories of personal information’ (such as information about your health), we need to have an additional ‘legal ground’ and we will rely on the ‘legal grounds’ that it is in the substantive public interest. Such as where it is necessary under the law in order to protect the interests of vulnerable people.
Who will we share your personal information with?
We may share your personal information within our group and with the following organisations:
- Our Clients (the original claimant or creditor);
- Appointed Representatives and/or Certificated Enforcement Agents to assist us in carrying out the debt collection or enforcement activities;
- Third party agents and approved advisers who we use to administer your account, such as debt collection agencies, tracing agents, process servers and solicitors;
- Our Regulators, the Financial Services Ombudsman and/or other authorities. This includes local and Government agencies, law enforcement agencies or social/welfare organisations;
- Fraud prevention agencies;
- Our independent financial or professional advisors;
- Approved parties or consultants;
- Executors of an Estate;
- HM Land Registry;
- Driver and Vehicle Licensing Agency (DVLA);
- Motor Insurance Database (MID);
- The Insolvency Service;
- Insolvency practitioners, legal advisors and HM Courts & Tribunals Service (where we pursue legal actions or defend legal actions relating to your account);
- Debt Management Company or a third party nominated by you to act on your behalf;
- Approved subcontractors (suppliers who provide goods and services to us). Where this is necessary we will take all appropriate steps to safeguard your data and relevant rights and freedoms under the General Data Protection Regulation (GDPR);
- Credit Reference Agencies (refer to the Credit Reference Agencies Information Notices):
Our own employed company personnel are extensively vetted in accordance with our Pre-Employment Screening (PES) Policy and will have access to your personal data. Access to your personal data will only be granted to appropriate screened personnel and only if necessary for the purposes described. Any such employee will always be bound by an obligation of confidentiality.
Change to Corporate Structure
We may also share your personal information if the structure of our company changes in the future. We may choose to sell, transfer, or merge parts of our business or our assets. We may seek to acquire other businesses or merge with them.
During any such change to our corporate structure, it may be necessary that we share your data with other parties. We will only do this if they agree to keep your data safe and private.
If any such change to our group or company structure happens, then other parties may use your data in the same way as set out in this notice.
How do we protect your personal information when sending it abroad?
We do not send your personal information outside of the UK.
In the event that this situation changes, we will notify you.
What marketing activities do we carry out?
We do not perform any marketing activities that use your personal information.
How long do we keep personal information for?
We will retain your data for as long as is required for the lawful purpose for which it was obtained, so long as we have a legitimate interest to keep it (such as to ensure good debt collection practices and to be able to defend ourselves against legal claims). We are also legally obliged to keep your personal data for a period of time to prevent and detect fraud, detect and evidence money laundering and for financial audits. For statistical purposes we may also keep anonymised data.
In cases where a debt is due and remains payable, data will be retained until such time the debt is either extinguished (Scotland), paid (settled) or closed.
Data will be maintained in accordance with the following retention timescales:
- Customer data (including all correspondence) will be retained for six years following closure of the account (to allow for the defence of legal claims);
- Customer telephone call recordings will be retained for a period of one year from the date of the call (this period may be extended where a complaint or legal case necessitates the holding of the call recording for a longer timeframe);
- Body Worn Video recordings will be retained for a period of three years after the year in which the recording was made unless the case is subject to investigation or complaint at this point. In such circumstances recordings will then be deleted one year after the year in which the complaint/investigation is closed.
- We will also delete your data in our backups, but only according to our backup policy. Data on backups will be retained for a period of six years.
Right to be informed
Right to access
You may request information on how we process your personal data, including information on:
- Why we process your personal data;
- What categories of personal data we process;
- Who we share your personal data with;
- How long we store your personal data or the criteria for determining this period;
- What rights you have;
- From where we have received your personal data (if we have not received it from you);
- If the processing includes automatic decision making (also known as profiling);
- If your personal data has been transferred to a country outside of the EEA, how we ensure the protection of your personal data.
You may also request a copy of the personal data we process about you. This is known as your Right to Access. Additional copies where considered manifestly unfounded may be combined with a fee or rejected where deemed appropriate.
Right to erasure (to be forgotten)
If we process your personal data in an unlawful manner, you may ask us to delete this information. It is however unlikely that we will delete your data unless you have settled the account or it is closed.
Right to rectification
It is important that we have the right information about you and that we encourage you to let us know if any of your personal data is incorrect (for example if you have changed your name or your address).
Right to object
If you believe that we do not have the right to process your personal data, you may object to our processing. In such cases, we may continue processing only if we can show our overriding legal grounds for processing outweigh your rights and freedoms under the General Data Protection Regulations (GDPR).
However, we will process your personal data if it is required for the determination, exercise or defence of legal claims (although this right only provides you with the ability to raise your objections, not a blanket right to have any and all processing ceased).
Right to data portability
Rights in relation to automated decision making and profiling
We do not make decisions based solely by automated means without human involvement.
Right to restrict processing
From the time you request that we correct your personal data or if you have objected to the processing of your personal data, and until we have been able to investigate the issue or confirm the accuracy of your personal data (or changed it in accordance with your instructions), you may be entitled to the restriction of processing. This means that (except for storing the personal data) we may process your personal data only in accordance with your consent, if necessary with reference to legal claims, to protect someone else's rights or if there is an important public interest in the processing.
In many circumstances, it will be necessary for us to continue processing data, to protect the rights of another (natural or legal) person, or because it is an important public interest.
Please note that once we believe that we have resolved the dispute or validated the accuracy of the personal data that we hold, we will continue to process your data in accordance with our overriding legitimate interest.
How to complain about the use of your data
You have a right to complain to the Information Commissioner's Office if you believe that any use of your personal information by us is in breach of applicable data protection laws and/or regulations. More information can be found on the Information Commissioner’s Office website: https://ico.org.uk. This will not affect any other legal rights or remedies that you have.
We are committed to ensuring that your information is secure. In order to prevent unauthorised access to personal data or disclosure thereof, we have put in place appropriate electronic, physical and managerial procedures to safeguard and secure the information we collect.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to our customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
How do I disable cookies?
If you want to disable cookies you need to change your website browser settings to reject cookies. How to do this will depend on the browser you use.
In general our site may not operate properly if cookies are switched off. If you only disable third party cookies you will not be prevented from properly using this site. If you disable all cookies you may not be unable to use dynamic areas of this site.
Links to other websites
Accessing your personal information
You may request details of personal information which we hold about you under the General Data Protection Regulation (GDPR). Whilst we will not charge you to access the information you have requested, we reserve the right, where additional copies are requested and are considered manifestly unfounded, to charge a fee or reject the request where deemed appropriate.
If you believe that any information we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any information found to be incorrect.
If you would like to request a copy of the information held on you please contact us.
Chartsbridge Group Limited, The Lightbox, Willoughby Road, Bracknell RG12 8FB
Review and Risk Assessment
This policy must be reviewed at annual intervals from 1 July 2019, or as required by any regulatory change or as otherwise necessary.