Data privacy

How we protect your data

What are my rights in relation to my personal data?

You have a number of rights in respect of your information, including the right to make a Subject Access Request (SAR). For more information about your rights and how to make a request, please see the 'What Rights Do You Have?' section of our Customer Privacy Notice.

How can I make a data protection request? (Exercise my rights)

You can make a request to Lowell by phone, email ( or in writing. Make sure to include as much detail as possible, so our Privacy Team can respond to your request as quickly as possible.

Can I make a request for more than one account?

If you have more than one account with Lowell (including Overdales), you only need to submit one request, but make sure to let us know which accounts you’d like to include.

Do you need my consent to process my information?

We must have a valid reason (or lawful basis) under the data protection laws to use your personal data. Consent is one of those reasons, but we don't need it if we have another reason for using your data. Other valid reasons include legitimate interests and complying with the law. The ICO's guidance confirms that we have a legitimate interest in managing customer debt and this is the lawful basis we rely on for using your information. We also use your personal data to comply with our legal and regulatory obligations. Please see the 'Why do we need your information?' section of our Customer Privacy Notice for more details.

Can I make a request on behalf of another person?

Yes, as long as you can provide evidence that you're authorised to act on their behalf. This could be either written consent from them or a general power of attorney for example. If you make a request for someone else but aren’t authorised, we will send our response to them.

How quickly will my request be resolved?

The more detail you provide in your request, the quicker we'll be able to respond. In most cases, we'll be able to complete your request within one month. If you make more than one request, or your request is complex, we might write to you to extend this time period by two months.

How do you calculate the one month time period for responding to my request?

We have one calendar month from the date we receive your request. For example, if we receive your request on the 3rd of September, we’ll respond by the 3rd of October. If the 3rd of October falls on a weekend or public holiday, we'll respond on the next working day. Some months are shorter than others - if we receive your request on the 31st of March, we will respond no later than the 30th of April.

What information do Lowell provide in a Subject Access Request (SAR)?

When you submit a Subject Access Request, we'll review the information we process about you and:

  • confirm whether we process your personal information
  • provide a copy of any personal information we do process
  • explain how we use your personal information - which you can find in our Customer Privacy Notice

Our response will cover the information which Lowell Portfolio I Ltd, Lowell Financial Ltd and Overdales Legal Limited (if you have an account with them) process about you.

What information am I entitled to?

You're entitled to:

  • a copy of your own personal information

You're not entitled to:

  • any information about other people, unless you are authorised to act on behalf of another person
  • information we don't process
  • information the data protection laws say we don't have to provide – for example where there are ongoing court proceedings

Why didn't I receive a copy of my Deed of Assignment/Contract of Novation?

The deed of assignment/contract of novation doesn’t contain any personal information about you or your account. It is therefore not part of the information which you are entitled to. It does refer to a separate document known as a sale file which contains the details of your debt which Lowell has purchased. Information from the sale file is contained in the “originating creditor information” section of your SAR response.

Why didn't I receive the price Lowell paid for my debt?

You're only entitled to a copy of your own personal information. The pricing information we hold doesn't contain any personal data that could identify you. This means it’s not part of the information you're entitled to.

Why didn't I receive a copy of the original agreement?

A Subject Access Request only entitles you to a copy of the personal information that we hold about you. If we don’t have a copy of the original agreement, we won’t be able to provide it in response to a Subject Access Request.

Why didn't I receive copies of letters you sent me?

If we hold a copy of the letters we have sent you, these will be included in the response we send you. You’re only entitled to the personal information that we hold about you. So if we don’t hold copies of your letters, we won’t be able to provide them in response to a Subject Access Request.  

Why don't the letters in my Subject Access Request look like the letters I originally received?

Sometimes, we only hold a template copy of the letter we sent you. This means that the parts of the letter which are specifically about you and your accounts aren’t fully completed. Our response will include a copy of what's stored on our system so it may not contain all of the information that was in the original letter that you received.

Can I ask for my information to be erased?

Yes, you can ask for your personal data to be erased at any time. We'll review the information we hold about you and erase anything we no longer need. We'll only keep the information we need to manage your account and to meet legal and regulatory requirements.

Is there any information you won't erase?

We won't delete information:

  • that we are legally required to keep, for example to meet anti-money laundering requirements
  • that our regulators require us to keep, for example in relation to customer complaints
  • that we need to manage your account
  • that we need for ongoing court proceedings

What happens to the information that isn't erased?

We'll only keep this information for as long as we need it, and for no more than seven years after the date your accounts with us are closed and we've had no further contact with you.