Question 1

Who are we?

Accepted Answer

This app is operated by Lowell Financial Ltd:

to provide you with information about being a Lowell customer and what it means for you and
so that you can use it to manage your debt(s) with us and make payments.

Where we use “we”, “our” or “us” in this privacy notice, we mean Lowell Financial Ltd unless we say otherwise. Where we use “this app”, we mean the Lowell mobile app.

Lowell Financial Ltd is part of the Lowell group of companies. We manage customer debts on behalf of Lowell Portfolio I Ltd which is another company in the Lowell group. For details of the UK companies in the Lowell group, please see the section 'Who are the Lowell Group?' in our Customer Privacy Notice.

Lowell Portfolio I Ltd buys customer debt where there is an outstanding balance (also known as a debt) from a wide range of organisations including banks, retailers and credit card, mobile phone, home shopping and utility (gas, electricity and water) companies.

If you are a Lowell customer, this means that Lowell has bought your debt or the right to collect the amount that you owe on your debt. We refer to this as “your debt” in this privacy notice and we will work with you to arrange repayment of the outstanding balance.

Lowell Financial Ltd manages the debt(s), which means that if we write or speak to you or if you use this app, it will usually be Lowell Financial Ltd that you are dealing with.

We also provide credit management solutions to your original creditor to help them manage the relationship that you have with them.

Company	Lowell Financial Ltd
Company number	04558936
ICO registration number	Z7273861
Country	Incorporated in England and Wales
Registered office	No.1 The Square, Thorpe Park View, Thorpe Park, Leeds, LS15 8GH

Question 2

Where do we get your information from?

Accepted Answer

below for more details.

Question 3

What information do we collect about you?

Accepted Answer

When you download this app, to set up your online account we collect your:

date of birth
your Lowell reference number
postcode
landline and/or mobile telephone number
email address
login information (including a password)

We use this information to identify you and match you to the account(s) we hold so that you can register for and use the app. We also collect information that you provide through the app, including updates to your contact details and information relating to payments or payment plans.

If you use our Budget Calculator, we will collect information about your income and expenditure and your ability to pay the debt(s) you owe.

We also collect information about you and the device you are using, including:

which feature of this app you use, such as 'set up a payment' or 'Snoop'
your internet protocol address known as your IP address which is used to connect your device to the internet
your device’s operating system and platform
browser plug-in types and versions
MAC addresses (device unique identifier)
traffic data, which is aggregated information about the number of visitors, sessions, users and visits to this app
location data
time zone setting
weblogs (these enable us to track which features you use, this does not collect your personal data)

When you start to make a payment through this app, the app will check whether you have enabled Google Pay or Apple Pay on your device so we can present appropriate payment options to you.

We may also combine the information you give us and the information we collect about you with information that we receive from other sources, such as the original creditor of your account.

Question 4

What information don't we collect about you?

Accepted Answer

App reporting and performance data We use technology similar to cookies to collect information to help make using our app even easier and better. We use Google and Firebase Analytics to collect information about how our customers use this app, as well as anonymous data that you enter into this app. We use the information to understand how our customers use this app (including behaviour patterns and the tracking of visits across multiple devices). Google and Firebase Analytics don’t collect information that identifies a user of our app. All the information that is collected is anonymous and is only used to improve how this app works. We do not allow Google to make any attempt to establish the identities of any users of this app. You choose whether or not to share this data with Google and Firebase Analytics and you can change your mind at any time by changing your settings here. We also use Dynatrace to help us monitor the performance of our app to ensure you get the possible service. Dynatrace also provide us with notifications when your app crashes or doesn’t work as expected. This allows us to resolve any technical problems quickly and with minimal disruption. Dynatrace does not receive any data that can be used to identify you. You choose whether or not to share this data with Dynatrace and you can change your mind at any time by changing your settings here. Biometric data If you use biometric data, such as your fingerprint or face to verify your identity and access this app, this data will be stored on your device. We will not collect or access this data. Incomplete forms If you start to fill in a form, such as our budget calculator, but don’t get all the way through, the details you input will be stored on your device for up to 60 days to give you time to finish it. Your information will not be shared with Lowell until you complete the form.

Question 5

Why do we need your information?

Accepted Answer

We need the information we collect automatically about your use of this app to: operate this app improve our app to ensure that content is presented in the most effective manner allow you to use the interactive features of this app when you choose to do so analyse how users use this app (including behaviour patterns and the tracking of visits across multiple devices) improve your user experience. We have a legitimate interest in providing this app to you to manage your account and in understanding how you use it and how we can improve it for you. We need the information you provide directly to us including by filling in any of the forms to: allow you to use this app to manage your online account help you and us understand your ability to pay the debt(s) you owe allow you to make payments through this app. If you consent to receive push notifications, be aware that if you share your phone, the other people you share your phone with may see the notification. As we have bought your debt, we have a legitimate interest in collecting the amounts that you owe under the agreements that you have entered into. You do not have to give us any information or confirm that the information we have obtained from other sources is correct. If you don’t provide us with your information, you may not be able to use this app to manage your online account. We may also not be able to manage your debt in the way that is best for you or agree a payment plan which is tailored to your needs. The more we understand about your personal circumstances, the better equipped we are to offer suitable and affordable repayment plans and to provide you with any additional support you may need. For more details about why we need the information you provide directly to us in this app and how we use it, please see our Customer Privacy Notice.

Question 6

Who do we share your information with?

Accepted Answer

We sometimes need to share some of your information with other organisations. We use Worldpay to securely process payments to your debt. We will share the details about your payment, including your bank account information or debit card details, the amount and frequency of your payment and your Lowell reference number with Worldpay so that Worldpay can collect your payment and we can apply it to the correct debt. Worldpay’s privacy notice is available at www.fisglobal.com/en-gb/privacy. We use Google and Firebase Analytics to collect information about how our customers use this app, as well as anonymous data that you enter into our forms. We use the information to understand how our customers use this app (including behaviour patterns and the tracking of visits across multiple devices). Google and Firebase Analytics don’t collect information that identifies a user of our app. All the information that is collected is anonymous and is only used to improve how this app works. We do not allow Google to make any attempt to establish the identities of any users of this app. We use Dynatrace to help us monitor the performance of our app to ensure you get the possible service. We also use Dynatrace to provide us with notifications when your app crashes or doesn’t work as expected. This allows us to resolve any technical problems quickly and with minimal disruption. Dynatrace does not receive any data that can be used to identify you. You can choose whether or not to share this data with Dynatrace and you can change your mind at any time by changing your settings in the app. We also use a number of carefully selected third parties to supply us with IT products and services. We will only share your information with our suppliers where it is necessary for them to provide us with the services we need. If you use this app to manage your account, we share: information about the payments you make, any payments you miss and details of any defaults with credit reference agencies. For more details about the information that we share with credit reference agencies, please see our Customer Privacy Notice and experian.co.uk/crain, www.equifax.co.uk/crain and www.TransUnion.co.uk/crain if you agree to our use of marketing tags, we share the information they collect about you and your use of this app with our trusted social media, advertising and analytics partners - particularly Facebook and Instagram. This helps us to customise our social media messages and analyse use of this app and the effectiveness of our messages. information with third party data providers to check that the information we hold about you is accurate and up to date information with the police and other law enforcement agencies, if fraud, money laundering or any other crime is detected if we provide credit management solutions to companies to help them manage the relationship that you have with them. We will confirm and verify the information that they provide to us is accurate, complete and up to date. We may also share information such as your contact details and information about how you manage your debt with us in order to help our clients manage the relationship you have with them. If we become a member of a fraud prevention agency, we will share information with that agency to prevent fraud and money laundering and to verify your identity. If fraud is detected, you may be refused certain services, finance or employment. For more details about who we share the information you provide directly to us in this app with, please see our Customer Privacy Notice.

Question 7

Where is your information stored?

Accepted Answer

The following information is stored on your device: biometric data, such as your fingerprint or face if you use it to verify your identity and access this app log-in tokens which verify your identity the content of forms you’ve started to fill out but haven’t yet completed (this will be deleted after 60 days) We will not collect or access this data. The information that we do collect about you is generally stored on servers and filing systems in the UK but from time to time it may be stored in or accessed from countries outside the UK. Where this may happen, we always make sure that there are appropriate safeguards in place, such as the Standard Contractual Clauses or binding corporate rules, to guarantee that your information – and your rights – are protected to the same high standard as under UK law. Adequacy Decision Where a county has been granted adequate by the European Commission, this means they have been found to offer the same level of safeguarding as the UK and therefore are safe countries to transfer information to and no extra contractual obligations are required in order to transfer your information. A list of countries with adequacy is linked here. Standard Contractual Clauses These are a set of standard clauses which have been recognised by the European Commission and the Information Commissioner’s Office as providing adequate protection to personal information transferred outside the EU or UK. When we include these clauses in a contract with one of the companies we work with, it means that if they transfer your information outside the EU or UK, they must make sure that your information is just as safe as it is in the EU or UK. As part of this, a transfer impact assessment is also completed to identify any risks with the information sharing. This enables us to put extra protections in place before we decide whether to transfer your information. International Data Transfer Agreement (DTA) This is a transfer mechanism that has been created by the Information Commissioners Office which provides sufficient protection to personal information transferred outside the UK to restricted countries outside of the EU. Binding corporate rules These are a way for large groups of companies which are based in lots of countries around the world to transfer personal information to companies in their group in a way that complies with the EU data protection rules. The binding corporate rules must be approved by the European data protection authorities before the group of companies can adopt them. When one of the companies we work with uses binding corporate rules, it means that if they transfer your information outside the EU or UK, they have procedures in place to make sure that your information is handled in a way that makes sure that your information is just as safe as it is in the EU or UK.

Question 8

How long do we keep your information for?

Accepted Answer

We only keep your information for as long as we need it. If you use this app, we will keep the information we collect for no more than 7 years from the date you cease to have any active debt(s) with us. We keep your information for this long so that we can: deal with any issues or concerns that you may have about how we handled your account to answer any questions HM Revenue and Customs may have bring or defend any legal claims and comply with our professional, legal and regulatory obligations. Our retention schedule considers the different types of information that we hold about you, why we need it and how long we need it for. We agree not to keep it for any longer than we need it as set out in that retention schedule.

Question 9

Do we carry out profiling and automated decision making?

Accepted Answer

We use Google and Firebase Analytics to collect information about how our customers use this app, as well as anonymous data that you enter into our forms. We use the information to understand how our customers use this app (including behaviour patterns and the tracking of visits across multiple devices). Google and Firebase Analytics don’t collect information that identifies a user of our app. All the information that is collected is anonymous and is only used to improve how this app works. We do not allow Google to make any attempt to establish the identities of any users of this app. We do not carry out any other profiling or automated decision-making in respect of the information we automatically collect about you when you use this app. For more details about the profiling and automated decision-making we carry out in respect of the information we hold about you and your account, please see our Customer Privacy Notice.

Question 10

What rights do you have?

Accepted Answer

Under the data protection laws, you have a number of rights in respect of your information, which include the right to:

access the information which we hold about you
ask us to make changes to the information we hold about you to make sure that it is accurate and up to date
delete or erase your information (sometimes called the right to be forgotten)
stop or restrict our processing of your information
object to our processing your information
not be subject to automated decision-making and
request the transfer of some of the information we hold about you (known as data portability).

Some of these rights only apply in certain situations. For more details about how these rights apply to the way we use the information we hold about you, please see our Customer Privacy Notice.

If you would like to exercise any of your rights, please contact our Data Protection Officer by:

by email at dpo@lowellgroup.co.uk
by writing to Data Protection Officer, Lowell Financial Ltd, PO Box 13079, Harlow, CM20 9TE.

Question 11

What happens if you delete the app?

Accepted Answer

for more details.

Question 12

What if you have a complaint?

Accepted Answer

If you have any questions, concerns or complaints about the way we process your personal information, please contact our Data Protection Officer in the first instance by

by email at dpo@lowellgroup.co.uk
by writing to Data Protection Officer, Lowell Financial Ltd, PO Box 13079, Harlow, CM20 9TE and they will do their very best to help you.

If you are not happy with the way we have handled your complaint or are still concerned about our handling of your personal information, you have a right to take your complaint to the Information Commission's Office at www.ico.org.uk.

Question 13

Who are the Lowell group?

Accepted Answer

The Lowell group is made up of the following companies incorporated in the UK.

Lowell Portfolio I Ltd	Company number 04857418
Lowell Financial Ltd	Company number 04558936
Lowell Legal Limited	Company number 08647091
Overdales Legal Limited	Company number 07407310
Lowell UK Shared Services Limited	Company number 08336897
Lowell Group Shared Services Limited	Company number 08647094
Lowell Receivables Financing 1 Limited	Company number 11344999
Lowell Receivables Financing 2 Limited	Company number 13403235
Lowell Receivables Financing 3 Limited	Company number 13849615
Lowell Portfolio IV Limited	Company number 08654105
Simon Bidco Limited	Company number 09709443
Metis Bidco Limited	Company number 07652466
Wolf Receivables Financing plc	Company number 13949210
Wolf Receivables Financing 3 plc	Company number 15073494

Name	How long it lasts	What is the purpose?
OIDC access token	Until you sign out, the token expires (approximately 1 hour), or you uninstall the app	Stored in the device's secure store (iOS Keychain / Android Keystore-backed Encrypted Shared Preferences). Authenticates each request to Lowell's backend after you log in.
OIDC refresh token	Until you sign out or the session is revoked	Stored in the device's secure store. Lets the app silently refresh your session so you do not have to log in every hour.
OIDC ID token	Same lifetime as the access token	Stored in the device's secure store. Carries your verified identity claims (subject ID, name) from Lowell's Identity Server.
App passcode (hashed) and biometric flag	Until you reset it from the app or uninstall	Stored in the device's secure store. Lets you re-enter the app using a passcode or Face ID / Touch ID / fingerprint instead of typing your full credentials again.
Customer reference	Until you sign out or uninstall	Stored in encrypted local storage. Identifies which customer record to load. It is an internal reference, not your name or address.
Anti-forgery session token	End of app session	Stored in app memory and encrypted local storage. Protects against request forgery attacks during your session.
App configuration cache	Until the next configuration refresh	Stored in encrypted local storage. Caches feature-flag and configuration values so the app can render correctly when offline or on a slow network.
Account and journey data cache	Cleared when you sign out or the app is closed	Stored in app memory and a short-lived disk cache. Holds account data the app has already loaded so screens open quickly when you navigate around.
.AspNetCore.	End of browser session	This cookie name is associated with the Netscaler load balancing service from Citrix. This is a pattern type cookie with the root being NSC_and the rest of the name being a unique encrypted alpha numeric identifier for the virtual server it originated from. The cookie is used to ensure traffic and user data is routed to the correct locations where a site is hosted on multiple servers, so that the end user has a consistent experience.
NSC xxxxxxxxxxxxxxx	End of browser session
.AspNetCore.Antiforgery	1 year

Third party	Name	How long it lasts	What is the purpose?
Worldpay (Worldpay Inc.)	Encrypted card session token	A few minutes, until the payment authorises	Captures your card details safely. Your card number, expiry and CVC are entered into Worldpay's own secure input fields and are never read by the Lowell app, which keeps Lowell at the lowest level of PCI DSS scope (SAQ-A).
Cardinal Commerce 3-D Secure (a Visa company)	Device data payload	Sent only at the moment of payment; nothing persistent is stored on the device	Contains non-personal device characteristics (model, OS version, locale, screen size, app metadata) so your card issuer can decide whether your payment can be approved frictionlessly or needs an authentication challenge. Required by the card schemes for Strong Customer Authentication under PSD2.
TransUnion TruValidate Device Risk (formerly iovation FraudForce)	Device 'blackbox' fingerprint	Generated on demand, sent to Lowell's servers, not persisted on the device	An encoded fingerprint built from non-personal device characteristics. Helps Lowell detect fraudulent account access and protect your account.
Apple Pay (Apple Inc.)	One-time encrypted payment token	Sent at payment time only	Lets you pay with a card stored in Apple Wallet. The app never sees your card number — Apple supplies a one-time encrypted token to the payment processor.
Google Pay (Google LLC)	One-time encrypted payment token	Sent at payment time only	Lets you pay with a card stored in Google Wallet. The app never sees your card number — Google supplies a one-time encrypted token to the payment processor.
Firebase Cloud Messaging (Google LLC)	FCM registration token	Until you uninstall the app, sign out, or revoke notifications in system settings	Lets Google's servers deliver a push notification to your specific app install. Used to send you payment reminders, plan updates and security alerts.
Firebase Remote Config (Google LLC)	Anonymous app instance ID, app version, OS version, language	Refreshed periodically by the app	Lets Lowell roll out feature changes and regional configuration without forcing you to download a new app version. No account data is sent.
Google reCAPTCHA (Google LLC)	reCAPTCHA token	Up to 2 years	Used inside in-app identity verification screens to verify that you are a person, not a robot.
Apple App Store / Google Play (in-app updates)	App version, device class	Sent at app launch when an update check runs	Tells you when a new mandatory or recommended app version is available.
identityservice.lowellgroup.co.uk	.IdentityServer.Session	1 year	This cookie allows us to make sure that you are a person not a robot.
identityservice.lowellgroup.co.uk	.AspNetCore.Antiforgery	1 year	This cookie helps make sure requests coming from a user are genuine and not being secretly sent by a malicious website.
identityservice.lowellgroup.co.uk	NSC_xxxxxxxxxxxxxxx	End of browser session	This cookie name is associated with the Netscaler load balancing service from Citrix. This is a pattern type cookie with the root being NSC_ and the rest of the name being a unique encrypted alpha numeric identifier for the virtual server it originated from. The cookie is used to ensure traffic and user data is routed to the correct locations where a site is hosted on multiple servers, so that the end user has a consistent experience.
Dynatrace	Usage data	Until you uninstall the app or sign out.	Anonymous app performance data — tap and scroll responsiveness, API call durations and success / failure rates, and anonymised milestones through key journeys (entering card details, confirming a payment, completing registration). No personal data, no card number, no balance. The Dynatrace SDK does not use Apple's advertising identifier (IDFA).
Dynatrace	Crash reports	Until you uninstall the app or sign out.	When the app encounters an unhandled error: a crash log and stack trace, plus the device context (OS version, device model, app state at the time of the crash). Lets Lowell proactively detect and diagnose crashes.

Name	How long it lasts	What is the purpose?
App Tracking Transparency status	Set once by iOS the first time the app launches; can be changed at any time in iOS Settings	iOS only. Records your response (Allow or Ask App Not to Track) to Apple's system tracking prompt. The app reads this value on every launch to decide whether the Share usage data toggle is allowed to enable Firebase Analytics.
NOTIFICATION_ENABLED, PERMISSION_REQUEST_FIRST_TIME	Until you change them in app settings or uninstall the app	Stored in encrypted local storage. Remember whether you have enabled push notifications and whether the operating system permission prompt has already been shown.
Biometric login preference	Until you turn it off or uninstall the app	Stored in the device's secure store. Remembers whether you have Face ID / Touch ID / fingerprint sign-in turned on.
Onboarding completion flags	Until you uninstall the app	Stored in encrypted local storage. Stops the welcome and setup screens from being shown every time you launch the app.
Last-viewed account and screen state	Cleared when you sign out	Stored in encrypted local storage. Lets the app re-open in the place you left it.
Calendar event entries	Controlled by you in the system Calendar app	Written to your device's local calendar only if you grant calendar permission and choose to add a payment date. Lowell does not read your other calendar entries.

Third party	Name	How long it lasts	What is the purpose?
Firebase Analytics (Google LLC)	Performance data	On until you opt out.	Anonymous screen views (which screens you visit — login, credit score, payments, settings, etc.) and feature-usage events (payment initiated, credit onboarding completed, Google Pay button tapped, discount offer viewed). Used to understand how customers use the app and where they drop off in key journeys. Firebase Ad features are not enabled.

Cookies

Mobile App Privacy Notice