Customer privacy notice

Information that you give us

You may give us information about yourself and your circumstances:

•  in any communications with us by telephone, email, post, app, social media or otherwise, whether this is in connection with your account or to report an issue, ask questions or make a complaint and
• by visiting our website, setting up an online account through our website or app and filling in forms on our website.

 If you use our websites, please see our Website User Privacy Notice and our Cookie Notice for details of the information we collect through our websites. 

Information that we collect about you

We may collect information about you that is publicly accessible where we have been unable to locate you using the contact details that we hold for you, for example:

• through a media search
• news and social media reports
• entries in online directories
• information which is available at Companies House
• where we have been unable to locate you using the contact details that we hold for you.

We may also collect limited information, such as media reports, about any current criminal convictions you have if we have reason to believe that you may be in prison. We will use this for the purposes of updating the information we hold about you and managing your debt. We may also use this information for the purposes of crime and fraud prevention and for complying with our obligations under the anti-money laundering and counter-terrorist financing other legislation. Please see the section 'Information relating to criminal convictions' below.

When you visit our website, we collect information about you and the way you use our website.  If you use our websites, please see our Website User Privacy Notice and our Cookie Notice for details of the information we collect through our websites. 

Information that we obtain from the previous owner(s) of your account

We receive information from the previous owner of your debt in order to manage your account and collect payments.  This includes:

• your name and contact details (including your current and previous addresses, telephone numbers and email addresses)
• your gender
• your date of birth
• information about your debt including the outstanding balance, your payment history and details of any defaults or missed payments and
• any other information the previous owner provides us with.

Information that we obtain from credit reference agencies

Credit reference agencies (or CRAs) hold personal information about individuals.  Most of the personal information they hold relates to how you have maintained your credit accounts.  They also hold address details and information taken from public sources, such as the electoral roll, public records including CCJs and bankruptcy and insolvency information. If you are financially associated with another person (which means that you have a joint credit account or mortgage with them), we will receive financial information relating to that association.

When we buy your debt, we obtain information about you from one or more of the following credit reference agencies:

• Experian
• Equifax
• Transunion

We collect this information to confirm the details provided by the previous owner of your account, verify your identity and confirm the accuracy of the information that we hold about you, locate you if we don’t have a current address for you and to check your credit history.

The 3 CRAs listed above have put together an information notice which explains in more detail, how they each use and share personal information they receive about you, which is available at www.experian.co.uk/crain, www.equifax.co.uk/crain and https://www.transunion.com.

We will regularly check your credit file to ensure the information that we hold about you on our systems is accurate, complete and up to date. This check is called a ‘soft search’ and may leave what is known as a “soft footprint”. This means that it is not visible to any other organisations and will not affect your credit score. It can only be seen by you, us and the credit reference agency and may show as “account administration” or “affordability” on your credit file.

For details about how we share information with the CRAs, please see 'Who do we share your information with?' and our credit file FAQs.

Information that we obtain from third party data providers

We may also obtain information about you from third party data providers, such as GBG, which are not credit reference agencies.  We use this third party information to identify customers who have become bankrupt or insolvent or are deceased. We also use it to confirm your contact details. GBG have put together a privacy policy which explains in more detail how they use and share your personal data at  
https://www.gbgplc.com/products-services-privacy-policy.

For details of the information that we share with third party providers, please see the section 'Who do we share your information with?' below.

Information that we may obtain from Cifas and other fraud prevention agencies

We may become a member of a fraud prevention organisation, such as Cifas.

If we do, we may collect information from that organisation about individuals (both customers and employees) who have committed fraud or other financial crimes for the purposes of preventing fraud and money laundering and to verify your identity. 

The checks we carry out require us to process your personal information including, for example, name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, a record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

For details about how we share information with fraud prevention agencies, please see 'Who do we share your information with?'

Information that we obtain from our clients

If we provide credit management solutions to other companies to help them manage the accounts that you have with them, they may provide information about you for us to provide those solutions including to confirm and verify that it is accurate, complete and up to date.

Information that we receive from other companies in the Lowell group

We may receive information about you from other members of the Lowell group of companies: 

• if we instruct them to act on our behalf in connection with your account
• if your account is transferred to another member of the Lowell group of companies as part of a group reorganisation or otherwise
• if we provide credit management solutions to them to help them manage the accounts that you have with them and
• for our internal administrative purposes. 
  
  

Information that we collect from other third parties

We may receive information about you from other third parties including: 

• debt management companies who you have authorised to act on your behalf
• any other person who has authority to act on your behalf, including someone who is acting under a power of attorney
• debt collection agencies who we instruct to collect payments from you or conduct a field visit on our behalf 
• law firms who we instruct to act on our behalf to recover amounts that you owe and to enforce any judgments that we may have against you
• the Court if we issue legal proceedings against you
• law enforcement and other government authorities and agencies if they make enquiries about you
• our regulatory authorities if you make a complaint to them; these are the Financial Conduct Authority, the Information Commissioner’s Office, the Financial Ombudsman Service, the Consumer Ombudsman Services
• the Insolvency Service if you apply for statutory breathing space or mental health breathing space
• our trade association body, the Credit Services Association, if you make a complaint to them and
• the Insolvency Service to let us know that you have applied for “breathing space” or respite from your debts.
• TrustPilot and social media where you leave comments or contact us via those platforms
• We may also obtain your data from posts you've made about Lowell on public forums online

Call recording

We may monitor and/or record calls and field visits for the purposes of resolving issues on your account, training and to improve our quality and service standards.

For details of when we may share call recordings with third parties, please see 'Who do we share your information with?' below.

CCTV images

We operate CCTV at all of our premises. If you visit any of our offices, you may be recorded by our CCTV system. 

For details of when we may share CCTV images with third parties, please see 'Who do we share your information with?' below.

What are the legitimate interests?

• As we have bought your debt, it is in our commercial interests to collect the amounts that you owe under the agreements that you have entered into.
• We will always deal with your debt in the way we believe is in your best interests.  This includes agreeing a payment plan which is tailored to your individual circumstances to help you reduce the amount you owe.
• We provide additional support to those individuals who may be vulnerable.
• It is also in the public interest for debts which are properly owed to be repaid. This is important for the economy as it helps to keep the cost of borrowing down and means that people continue to have access to credit. 

Why is it necessary?

If we don’t process your information, we can’t:

• make sure we are dealing with the correct person
• make sure that the information we hold about you is correct
• collect the amounts that you owe
• manage your debt in the way that we believe is in your best interests
• agree a payment plan with you which is tailored to your individual circumstances
• provide you with additional support when you need it and
• provide the credit reference agencies with accurate and up to date information about the amounts that you owe. 

What is the impact on you?

We collect, use and share your information as set out in this privacy notice, which means that we and the third parties we’ve told you about have access to your information. 

We are authorised by the Financial Conduct Authority which means that we are required to act fairly, ethically and lawfully in addition to complying with our own high standards. 

We also minimise the impact on your data protection rights, interests and freedoms by:

• making sure we comply with the data protection rules including the UK Data Protection Act  2018 and UK GDPR
• only collecting the minimum amount of information we need to carry out our debt collection activities
• having a retention policy to make sure that we don’t keep your information for any longer than we need it
• carrying out data protection impact assessments to make sure that we identify any potential privacy risks and put appropriate measures in place to protect you from those risks
• carrying out due diligence on the third parties we work with and making sure that we have contracts in place with those third parties to protect your personal information
• providing you with this privacy notice which explains how we use your information, what your rights are and how to exercise them and
• putting in place appropriate security measures to protect your information including have an ISO27001 certificate, which means that we meet the internationally recognised standards for managing risks to the security of the information we hold.

Information that we share with other companies in the Lowell group

We may share your information with other companies in the Lowell group:

• if we instruct them to act on our behalf in connection with your debt
• for our internal administrative purposes
• if we provide credit management solutions to help them manage the relationship you have with them and
• including any company associated or otherwise connected with the Lowell group if we transfer your debt to them whether as part of a group reorganisation or otherwise.  If we transfer your debt to another member of the Lowell group, Lowell Financial Ltd will continue to manage your account on behalf of the new owner of your debt and your personal data will continue to be used and shared as set out in this privacy notice. 

For details of the UK companies in the Lowell group, please see the section 'Who are the Lowell group?' below.

Information that we share with third party debt collection agencies and law firms

If we instruct third party debt collection agencies and third party law firms to act on our behalf to recover the debt you owe, conduct a field visit if we have not heard from you for an extended period or take legal action and enforce any judgments that we may have against you, we may share:

• your name
• your contact details (including your current and previous addresses, email addresses and telephone numbers)
• your date of birth
• details of your debt with us and
• financial information about you including your credit score, credit history and payment history, credit reference information, income and expenditure and any other details relating to your debt with us and your ability to pay the debt you owe 
  
  

Information that we share with credit reference agencies

We share the following information with the credit reference agencies,  Experian, Equifax and Transunion:

• your name
• your contact details (including your current and previous addresses, email addresses and telephone numbers)
• your date of birth
• financial information that we hold about you and
• details of your debt with us.

We also report to the credit reference agencies on a monthly basis about the payments you make, whether your outstanding balance is reducing and the remaining balance, any payments you miss and details of any defaults. 

When you pay your debt in full, any default will show as “satisfied”. If we agree to accept a discounted amount as settlement, any default will show as “partially satisfied”, when paid. If we decide to close a debt without having recovered the full outstanding balance, this will also be marked as “partially satisfied”.

The 3 CRAs listed above have put together an information notice which explains in more detail, how they each use and share personal information they receive about you, which is available at www.experian.co.uk/crain, www.equifax.co.uk/crain and www.transunion.com.

For more details about how we share information with the CRAs, please see our credit file FAQs.

Information that we share with third party data providers

We may also share information about you with third party data providers which are not credit reference agencies. 

We share:

• your name
• your contact details (including your current and previous addresses, email addresses and telephone numbers)
• your gender and
• your date of birth. 

to identify customers who have become bankrupt or insolvent or who are deceased and to confirm your contact details. 

Information that we may share with  fraud prevention agencies

We may become a member of a fraud prevention agency. If we do, we may share information with that organisation and other fraud prevention agencies for crime and fraud prevention and the apprehension and prosecution of offenders.

If we identify evidence of fraud or any other financial crimes in relation to your account, including where you have been the victim of identity theft, we will share those details with the fraud prevention agencies to assist their other members and law enforcement to prevent, detect and disrupt fraud, money laundering and other types of financial crime.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, a record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

Information that we may share with Debt Management Companies

We may share your information and discuss your debt with debt management companies such as StepChange, Pay Plan, or Money Wellness, where you have asked them to support you with your debt.

From time to time, we may also share anonymised statistical information with debt management companies to enable them to better support their customers with their debt.

Information that we share with law enforcement and emergency services

If we identify evidence of fraud, money laundering or any other financial crimes in relation to your debt, including where you have been the victim of identity theft, we will share those details with the police, the National Crime Agency and other law enforcement agencies.  We may also share information with HM Revenue and Customs where appropriate.

If we believe you may be in immediate danger, we may share your information including details of your physical and mental health conditions with the police and other emergency services.

Information that we share with regulatory authorities and Ombudsman Services

Lowell Financial Ltd is authorised by the Financial Conduct Authority. This means that it is required to report certain things to the Financial Conduct Authority which may mean sharing information about you if there is an issue or complaint in respect of your account.

We are registered with the Information Commissioner’s Office and if you make a complaint to them, we may have to share information about you and your account.

We also deal with the Financial Ombudsman Service and the Consumer Ombudsman Service and we may share information with them about you and your account in order to resolve your complaint. 

Information that we share with the Court

Where we take legal action and issue proceedings against you, we will share information about you, including your name, address, date of birth and details of your debt with us with the Court for the purposes of the legal proceedings.

Information that we share with your original creditor

We may share some limited information with the previous owner of your account if we need to verify any of the information that they have provided us or if there is an issue with your account.

We may also share call recordings and information about your account with our clients and prospective clients for quality assurance purposes.

If we provide credit management solutions to companies to help them manage the relationship that you have with them, we will confirm and verify the information that they provide to us is accurate, complete and up to date. We may also share information such as your contact details and information about how you manage your account with us in order to help our clients manage the accounts you have with them.

Information that we share with our third party suppliers

We use a number of carefully selected third parties to supply us with other products and services, such as IT and mailing services.

The information that we share with our suppliers will depend on the nature of the products and services that they provide to us but we will only share the minimum amount of your information which is necessary for them to provide us with the products and services we need. 

We may also share your information (including your contact details) with third parties who carry out market research on our behalf to help us improve our customer service.

If you agree to our marketing cookies, we share the information they collect about you and your use of our site with our trusted social media, advertising and analytics partners - particularly Facebook and Instagram. This helps us to customise our social media ads and analyse traffic driven to our site from advertising and the effectiveness of our ads.  You can find more details about our marketing cookies in our Cookie Notice.

We may also share your information with Facebook and Google for the purpose of communicating with you.

Information that we share with other third parties

If we or any member of the Lowell group of companies merges, transfers or sells part or all of its business or assets or any of the share capital of Lowell Portfolio I Ltd or Lowell Financial Ltd to a third party, your personal information may be disclosed to that third party and its advisers for the purposes of negotiating and completing the merger, transfer or sale.  If the merger, transfer or sale does complete, that third party may use or disclose your information as set out in this privacy notice.

We may also share your information with our insurers, lenders, legal and other professional advisers where necessary.

We may share your name and your TrustPilot review with other customers in our letters.

Standard contract clauses

These are a set of standard clauses which have been recognised by the European Commission and the Information Commissioner’s Office as providing adequate protection to personal information transferred outside the EU or UK

When we include these clauses in a contract with one of the companies we work with, it means that if they transfer your information outside the EU or UK they must make sure that your information is just as safe as it is in the EU or UK.

As part of this, a transfer impact assessment is also completed to identify any risks with the information sharing. This enables us to put extra protections in place before we decide whether to transfer your information.

International Data Transfer Agreement (IDTA) 

This is a transfer mechanism that has been created by the Information Commissioners Office which provides sufficient protection to personal information transferred outside the UK to restricted countries outside the EU.

Binding corporate rules

These are a way for large groups of companies which are based in lots of countries around the world to transfer personal information to companies in their group in a way that complies with the EU data protection rules. The binding corporate rules must be approved by the European data protection authorities before the group of companies can adopt them. 

When one of the companies we work with uses binding corporate rules, it means that if they transfer your information outside the EU or UK they have procedures in place to make sure that your information is handled in a way that makes sure that your information is just as safe as it is in the EU or UK.

What are the legitimate interests?

• As we have bought your account, it is in our commercial interests to collect the amounts that you owe under the agreements that you have entered into and to understand the best way to do to this.
• We will always deal with your account in the way we believe is in your best interests.  This includes agreeing a payment plan which is tailored to your individual circumstances to help you reduce the amount you owe. The profiling we carry out means that we understand more about your personal circumstances so we are better equipped to offer you suitable and affordable repayment plans.
• It is also in the public interest for debts which are properly owed to be repaid. This is important for the economy as it helps to keep the cost of borrowing down and means that people continue to have access to credit. 
  
  

Why is it necessary?

If we don’t use your information, we can't: 

• decide how best to manage your account
• conduct our research activities, serving both public and commercial needs
• tailor our approach to your individual needs
• improve our products and services
• improve our customer service or
• provide credit management solutions to your original creditor to help them manage the relationship that you have with them

What is the impact on you?

We collect, use and share your information as set out in this privacy notice, which means that we and the third parties we’ve told you about have access to your information.

However, we are authorised by the Financial Conduct Authority which means that we are required to act fairly, ethically and lawfully in addition to our own high standards.

We also minimise the impact on your data protection rights, interests and freedoms by:

• making sure we comply with the data protection rules including the UK Data Protection Act 2018 and GDPR
• only collecting the minimum amount of information we need to carry out our debt collection activities
• having a retention policy to make sure that we don’t keep you information for any longer than we need it
• carrying out data protection impact assessments to make sure that we identify any potential privacy risks and put appropriate measures in place to protect you from those risks
• carrying out due diligence on the third parties we work with and making sure that we have contracts in place with those third parties to protect your personal information
• providing you with this privacy notice which explains how we use your information, what your rights are and how to exercise them and
• putting in place appropriate security measures to protect your information including have an ISO27001 certificate, which means that we meet the internationally recognised standards for managing risks to the security of the information we hold.

You have the right to

What does this mean?

How does this apply to the way we use your information? 

Access your information

You can ask for:

• confirmation that we process your personal information
• a copy of your personal information that we hold and
• other information about how we process your information.

We will provide you with a copy of your personal information which we hold unless the data protection rules provide an exception that decide to rely on, for example where there are ongoing court proceedings. We may also edit out the names of any other individuals to protect their privacy.

Wherever possible, we will provide you with a copy of your personal information in the same manner you make your request unless we agree otherwise with you.

This privacy notice also includes the other information you can ask for about how we process your information. 

Have your information rectified

You can ask us to rectify your information if it is not accurate, complete or up to date.

We will update or correct your information, although sometimes we may need to ask you to provide evidence to confirm the changes, for example a copy of your marriage certificate if you are changing your name because you have got married. 

Have your information erased

This is also known as the right to be forgotten.

You can ask us to delete your information where:

• we no longer need it
• we rely on your consent to use your information and you withdraw it
• you object to our processing it and we have no overriding legitimate grounds to continue processing it or
• we are legally required to delete it.

This right does not apply where: 

• we are legally required to keep your information, for example under the anti-money laundering laws
• we have a compelling legitimate ground for using your personal information or
• we need your information to establish, exercise or defend legal claims, for example where there are ongoing court proceedings.

As we rely on legitimate interests for most processing of your personal information, we will only be able to delete your personal information:

• if you object to our processing your personal information and to carry out your request we have to erase your information and
• where we no longer need your information. Although our retention policy means that we will delete your information once we no longer need it. Please see 'How long do we keep your information?' for more details.

Restrict our processing of your information

You may ask us to restrict our processing of your personal information where:

• you believe the information we hold about you is inaccurate while we check whether it is accurate
• we no longer need your information but you need it to establish, exercise or defend a legal claim or
• you object to our processing your personal information while we reconsider our legitimate interests assessment.

We will not process your personal information whilst we consider your request. However, we will still be able to process your personal information for the purposes of any ongoing court or other legal proceedings.

We will inform you if we begin processing your personal information again and explain why.

Have your information transferred to you and/or a third party

This is also known as the right to data portability.

You can ask us to provide you with a copy of the information which you have provided to us and which we hold electronically.

This right only applies to the information about your physical and mental health and criminal convictions which you provided to us by telephone and which we use with your consent.

We will provide this information to you in a commonly-used and machine readable format. 

Object to our processing of your information, including profiling

You can object to our use of your information, including profiling unless:

• we have compelling legitimate grounds for using your information or
• we need to use your information to establish, exercise or defend a legal claim, for example where there are ongoing court proceedings. 

You can also object to us using your information for marketing purposes.

We use profiling to make sure that we manage your account in the way that is in your best interests.

If we were to stop using your information for profiling, we may not be able to provide you with the same level of customer service or tailor our approach to your personal circumstances in the same way.

Not to be subject to an automated decision

You can ask us to review any automated decision which has a legal or significant effect for you. You can provide us with your point of view and any additional information that you think we need and ask for a human to reconsider our decision.

You can ask us to reconsider any automated decision we have made about whether to take legal action against you or about the type of action we are taking to enforce our legal rights to collect the amounts you owe.