Data protection

We have a range of Privacy Notices available on our website’s Our Privacy Promise webpage so you can choose the one that reflects the relationship you have with Lowell.

The Privacy Notice will explain:

• Who we are
• What personal data we collect about you
• Where we get your personal data from
• Why we need your personal data
• Who we share your personal data with
• Where we store your personal data
• How long we keep your personal data for
• Your rights in relation to your personal data

Under UK GDPR, we must have a valid reason (or lawful basis to use your personal data. Consent is one of those reasons, however we do not need consent from a customer to manage their account. if we are relying on another lawful basis.

Lowell has a legitimate interest to hold and process customers’ personal data in order to administer and manage their accounts and potentially to deal with any issues or concerns which you have raised with us.

The ICO’s guidance on legitimate interests confirms that we have a legitimate interest in recovering the outstanding balance on a customer’s account.

As we process your personal data on the basis of legitimate interests, we do not need your consent to do so.

We also use your personal data to comply with our legal and regulatory obligations. Please see the 'Why do we need your information?' section of our Customer Privacy Notice for more details.

You can make a request to Lowell by phone, email (DPO@lowellgroup.co.uk) or in writing. Make sure to include as much detail as possible, so our Privacy Team can respond to your request as quickly as possible.

If you have more than one account with Lowell (including Overdales), you only need to submit one request. Our Privacy Team handles requests for all of our UK companies so please tell us in your request which companies and accounts you’d like us to include.

Yes, you can make a request on behalf of another person. To do this, you will need to provide evidence that you are entitled to act on that person’s behalf, such as a written authority to make the request or a general power of attorney. If you can’t provide appropriate evidence, we will send our response directly to our customer. 

We’ll do our best to fulfil your request within one month. For example, if we receive your request on the 3rd of September, we’ll respond by the 3rd of October. If the 3rd of October falls on a weekend or public holiday, we'll respond on the next working day. Some months are shorter than others - if we receive your request on the 31st of March, we will respond no later than the 30th of April.

In some circumstances we may write to you extending this time period by an additional two months. This could happen if your request is complex or if you have made a number of requests.

We are allowed to extend the timescale for responding to you in this way under Article 12(3) of the UK GDPR. If your request is for access to information and there is anything specific that you require, please let us know what this is, and we may be able to respond more quickly.

When you submit a Subject Access Request, we'll review the information we process about you and:

• confirm whether we process your personal information
• provide a copy of any personal information we do process
• details of where to find any additional information you are entitled to about how we use your personal information. Our response will cover the information which Lowell Portfolio I Ltd, Lowell Financial Ltd and Overdales Legal Limited (if you have an account with them) process about you.

You're entitled to:

• a copy of your own personal information

You're not entitled to:

• any information about other people, unless you are authorised to act on behalf of another person
• information we don't process
• information the data protection laws say we don't have to provide – for example, where there are ongoing court proceedings

There is no requirement that an assignment of debt is effected by deed or in any particular form so long as it is in writing. Sometimes the agreement that Lowell Portfolio I Ltd enters into to purchase debts will be a deed of assignment, sometimes it will be a simple contract known as a debt sale agreement.

Whichever type of agreement, Lowell Portfolio I Ltd enters into to take legal assignment it does not contain any details about you or your debt.

It is therefore not part of the information which you are entitled to as part of a SAR. The agreement does refer to a separate document known as a sale file which contains the details of your debt which Lowell has purchased. Information from the sale file is contained in the “originating creditor information” section of your SAR response.

You're only entitled to a copy of your own personal information. The pricing information we hold doesn't contain any personal data that could identify you. This means it’s not part of the information you're entitled to.

If we hold a copy of the letters we have sent you, these will be included in the response we send you. You’re only entitled to the personal information that we hold about you. So if we don’t hold copies of your letters, we won’t be able to provide them in response to a Subject Access Request. 

Sometimes, we only hold a template copy of the letter we sent you. This means that the parts of the letter which are specifically about you and your accounts aren’t fully completed. Our response will include a copy of what's stored on our system so it may not contain all of the information that was in the original letter that you received.

Yes, you can ask for your personal data to be erased at any time.

In order to process our customers’ personal data, we must have a lawful reason for doing so. There are six lawful reasons for using personal data under the data protection legislation; these include:

• performing a contract with our customer;
• complying with our legal obligations; and,
• legitimate interests.

Lowell has a legitimate interest to hold and process customers’ personal data in order to administer and manage their accounts and potentially to deal with any issues or concerns which you have raised with us. The ICO’s guidance on ‘legitimate interests’ confirms that we have a legitimate interest in recovering the outstanding balance on a customer’s account.

As we process your personal data on the basis of legitimate interests, we do not need your consent to do so. This also means that the right to have your data deleted from our systems only applies when:

• we no longer need your information; or,
• you object to the use of our customer’s data and your interests outweigh our interests.

When we receive your erasure request, we will review the information we hold about you. We will erase any information that we no longer need and any other information that we are legally obliged to erase.

We won't erase information:

• that we are legally required to keep, for example to meet anti-money laundering requirements
• that our regulators require us to keep, for example in relation to customer complaints
• that we need to manage your account
• that we need for ongoing court proceedings

We'll only keep this information for as long as we need it, and for no more than seven years after the date your accounts with us are closed and we've had no further contact with you.