Privacy

v1.3 – 25 January 2024 

This Privacy Notice explains how TBI Financial Services Limited (TBI) uses your personal data and how we ensure that it is protected. This is part of our commitment to being transparent in our data processing activities.

For information regarding the use of data relating to accounts owned by Go Debt Limited, please refer to the separate Go Debt Privacy Notice.

This Privacy Notice may be changed from time to time and such updates will be shown here on this page. We recommend that you check this page regularly so that you are aware of any changes which have been made and can contact us if there is anything new which you would like to discuss.

If you require further information regarding our data processing or if there is anything contained in this Privacy Notice which is not clear please contact us using one of the available methods set out below.

About TBI

We are a company specialising in the purchase and recovery of consumer debt. We are authorised and regulated by the Financial Conduct Authority (FCA).  We are the Data Controller of your data and we are registered on the Register of Data Controllers maintained by the Information Commissioner’s Office (ICO).  

We have come into possession of your data following the assignment of your credit agreement to us. The company which you entered into your credit agreement with holds data from when you applied for the credit and when your account was opened. They will also have collected data while they were administering your account before the assignment to TBI.  

When your account was assigned to TBI, data held by the original creditor was transferred to us. Further data may also be provided to us by the original creditor at a later date. We will also process data which we receive via third parties and data which you provide to us directly.

Sources of Data

Some data will be obtained from you directly when we are in contact with you regarding your account. This will include information provided by a third party you have authorised to assist you and information provided by you or an authorised representative to a third party representative we have instructed such as a debt collection agency or firm of solicitors. Where relevant and considered to be of assistance in the effective management of your account we will record information supplied by you or your representatives on our records for your account.

We also receive personal data from third parties. We have an obligation to inform you about the sources of any data that has not been obtained from you directly: 

1. Original creditor

Most of the data we hold will have been transferred to us at the time your account was assigned to us. This will include the data you supplied to the original creditor when you made your application for credit such as your name and title, date of birth, current and previous addresses and other contact details like email addresses and telephone numbers. Further data may also be provided at a later date when requested by us to assist us with the recovery of the outstanding balance.

Not all data relating to your account will necessarily have been transferred to TBI and therefore some data will only be held by the original creditor. If you are interested in such data you will need to contact the original creditor directly. 

1. Third party sources
1. Credit Reference Agencies (CRAs) – data obtained will include:

• Name and address data from public sources such as the electoral register.
• Financial data such as information about accounts you hold with other organisations for example mortgages, bank accounts, credit cards, loans, utilities and mobile phone accounts and retail and mail order accounts. The financial data will include the date your account was opened, credit limits, repayment history including payments which were late or missed and the amount of any debt.
• Information on Judgments such as the name of the Court, the Claim Number, the amount of the Judgment and whether the Judgment has been satisfied.   
• Information on Bankruptcies, IVAs, DROs and other similar types of Orders.
• Information on credit applications where an organisation has conducted a search of CRA data before deciding whether to approve the application. This “search footprint” includes type of application and the date.
• Information on company directorships.
• Links to other addresses established by the CRA from the data above.

1. Tracing Organisations – addresses and other contact details.
2. Royal Mail – data regarding UK postal addresses.
3. Public data sources such as the Insolvency Service and Companies House may be used to obtain or confirm customer identifier data.
4. The Land Registry – data relating to property ownership, charges and other secured liabilities and purchase prices as well as pending and historical dealings with the property.
5. Media sources – where the available information is relevant to your account and your ability to pay it may assist us with determining how best to manage your account.
6. Individuals contacted while pursuing your account – information volunteered which may be relevant and appropriate to record to assist with the effective management of your account. Please note that whilst we may record information provided by such third parties we will not disclose any personal data regarding you or your account to any third party without authority from you.

We are satisfied that we have the right to receive and process data from these sources. Further information regarding our legal bases for processing is set out in the “Your Data” and “Special Categories of Data” sections below.

Purpose of Processing

When we acquired your account all rights under your agreement were assigned to us which means that the outstanding balance is due to us instead of the original creditor. In order for us to pursue our lawful business objectives of recovering the outstanding debt and managing your account appropriately in accordance with our regulatory obligations and quality standards it is necessary for us to process your personal data.

Legal Basis for Processing

In order to be able to process your data we must have a legal basis for doing so. This section explains about which legal bases we are relying on to justify our processing. There is also further information about each legal basis in the “Your Data” and “Special Categories of Data” sections below. 

Legitimate Interests – For most of the data we process we will be relying on the legal basis of legitimate interests.  These interests include TBI’s interests and interests of certain third parties. Further information about our interests is set out in the “Your Data” section below.

Consent – There are certain types of sensitive personal data which we will only process if we have received your explicit consent. “Consent” is another legal basis which entitles us to process data. For further information please see the “Special Categories of Data” section below.

Vital Interests – In limited circumstances it will be appropriate for us to rely on the legal basis of vital interests to process your data in emergency situations. For further information please see the “Special Categories of Data” section below.

Legal Obligation – There may be situations where we are required to disclose data to relevant authorities such as law enforcement agencies or regulatory bodies. Where we do so it will be on the legal basis of compliance with a legal obligation. For further information please see the “Special Categories of Data” section below.

Your Data

This section explains about the “ordinary” types of data which we process and the legitimate interests legal basis we rely on to process this data. The majority of the data we process will fall into this category, such as your name, date of birth, contact details, payment history and other financial information. Examples of the legitimate interests pursued are set out below.

1. TBI’s Interests

TBI has a legitimate interest in processing your data in order to pursue our lawful business objectives of recovering the outstanding debt and to manage your account appropriately in accordance with our regulatory obligations and quality standards. The debt along with all rights of the original creditor under your agreement were legally assigned to us. We are therefore entitled to pursue you for the debt you owe under the terms of the agreement and we have a legitimate interest in processing data which is necessary for us to achieve this objective. This includes processing data in order to be able to communicate with you, verify your identity and effectively manage your account. It also includes processing data required to evaluate your financial circumstances and determine the reasonableness and affordability of any payment offers.

We also have a legitimate interest in retaining data in case it may be required at a future date in relation to any legal claims issued against us. We will need to retain data for this purpose even where the original legitimate interest in processing to recover the debt is no longer applicable.  

1. Third Party Interests
2. Lenders selling debt – It is a legitimate interest of financial institutions to be able to assign non-performing debts to organisations like TBI and for us to be able to process customer data in order to fulfil the purpose of the assignment. Assigning such debt enables financial institutions to free up capital and focus their attention on their area of expertise of lending without having to dedicate resources to arrears recovery where they do not have the specialist experience. Accordingly our processing is fundamental to the legitimate commercial interests of financial institutions, which in turn is also in the wider public interest as explained below.
3. Wider society – It is vital to society in general that businesses like TBI can pursue and recover balances due under defaulted credit agreements in order to play their part in the efficient operation of the UK financial system. If financial institutions could not assign defaulted balances and debts remained unpaid it would compromise the ability of financial institutions to lend money on affordable terms. This would also endanger the profitability and stability of those financial institutions and in turn the financial system as a whole which would be against the wider public interest. The availability of affordable lending is also in the interests of those in society needing to borrow and ensures that public spending is maintained to the benefit of the economy and wider society in general.  

TBI discloses customer data to CRAs which they collate with data shared by other organisations and from public sources which the CRA in turn discloses to lenders seeking to verify the identity of applicants, assess the risk of future default, check for financial misconduct and ensure that they are lending suitable products to customers who can reasonably afford to repay the balance. Our processing of data is therefore necessary in order to meet the legitimate interests of wider society by supporting responsible lending, preventing over-indebtedness, fraud and money laundering.

For the legitimate interests identified we have considered whether the processing is necessary to achieve the objective. We are satisfied that there is no alternative way to achieve our objectives, or those of the third parties, without carrying out the processing. 

We have also carried out a balancing test in order to weigh our interests in processing your data and the interests of the third parties identified above against your interests. We have taken into account all relevant information, including in relation to the data, the nature of the processing and our relationship. We have concluded that our legitimate interests and those of the third parties are compelling enough to outweigh your interests, with any appropriate safeguards put in place to minimise the impact of our processing. Should you wish to obtain further information regarding the balancing test carried out in relation to our processing of “ordinary” personal data please contact us.

Objecting to our Processing

Where your data is processed on the basis of legitimate interests you have the right to object to the processing. Submitting an objection will not necessarily mean that we will ultimately have to stop the processing. Further information on the right to object is set out in the “Your Rights” section below. 

Special Categories of Data

For more sensitive types of data which require extra protection we will only process the data where we have your explicit consent or it is in your vital interests. In other circumstances there may be data which we are required to process due to a legal obligation. These legal bases are explained in more detail below. 

Consent

In order for your consent to be valid it must be explicit and you will therefore be asked specifically to provide your informed consent. You can provide your consent verbally or in writing. If you have given us your consent and you later change your mind you are entitled to withdraw your consent at any time by notifying us by telephone or in writing.  

The type of sensitive personal data which could be relevant to your account is information relating to your health. It may be to your benefit to inform us should you have a health condition, a disability or if there is other information concerning your private life which may be relevant to your ability to make payments towards your debt. We recognise that there are personal circumstances which could indicate potential vulnerability, whether just temporarily or in the long term, and we would like to make sure that we can take appropriate measures to assist you. This may include allowing you to suspend your payment arrangement or reduce your instalments until your circumstances have resolved or placing your account on hold while you seek free independent advice or undergo treatment.

Any sensitive personal data you disclose and consent to us processing will only be retained where it is relevant and will be limited to what is strictly necessary to ensure that our team is appropriately informed about your circumstances so that your account can be handled appropriately. The only other purpose for using this data will be for training and quality purposes.

Such information will be treated with the strictest confidence. It may be disclosed to the original creditor as part of information we are required to supply for periodic auditing.

Vital Interests

In the event that you or a representative you have authorised reveal information to us which suggests that your health is at serious risk, we would be obligated to pass this information to the emergency services.

This processing would be carried out because it would be necessary in order to protect your vital interests where you are physically or legally incapable of giving consent. This would also be relevant where the information revealed indicates that the health of another person is at serious risk.

Legal Obligation

Your data may be processed where disclosure to the relevant authorities is required in order to prevent crime or in accordance with a regulatory requirement. This would include disclosure to law enforcement agencies, fraud prevention agencies and regulatory authorities.

Sharing your Personal Data

We will only share your data in limited circumstances and where it is justified in order to achieve the legitimate interests of TBI or certain third parties and where we are satisfied as to the data protection measures implemented by these third parties.

Credit Reference Agencies

Following assignment of your account to us we will take over the responsibilities of the original creditor in relation to reporting to CRAs. 

We will continue to share information about you with CRAs on an ongoing basis, including about your outstanding debt because all accounts assigned to us will have not been repaid on time in accordance with the terms of the agreement. We will also share information with CRAs about accounts which have been settled after they were assigned to us. 

In addition CRAs will share your information with us, as explained in the “Sources of Data” section above. We use this data to manage your account, for tracing where it appears that you have moved address without informing us or the original creditor, to verify the accuracy of information you have provided to us, to assess your financial situation.

CRAs will also share your data with other organisations, including financial institutions who will use the information when you make applications for credit. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates and these links will be shown on your and their credit files. 

Further information about the different CRAs, the ways in which they use and share your personal information and your data protection rights with the CRAs are set out in the CRA Information Notice (CRAIN) which can be accessed by using any of the following links:

Call Credit: www.callcredit.co.uk/crain

Equifax: www.equifax.co.uk/crain

Experian: www.experian.co.uk/crain

Other organisations

• Third party agents such as debt collection agencies, providers of related panel management services and tracing agents who we use to assist with the recovery of the balance.
• External firms of solicitors, barristers, advocates, process servers and providers of enforcement related services we instruct in legal or other proceedings where necessary.
• Our independent financial advisors or other professional advisers.
• The original creditor in accordance with the assignment agreement and the obligations we must comply with.
• Other parties we may engage with in relation to any decision to sell our business or assets or to acquire a business or assets in order to pursue our legitimate commercial interests and only where the other party agrees to keep any data shared safe and confidential.
• Our IT service providers
• Providers of print and mail services.
• HM Courts and Tribunals Service in relation to legal proceedings and enforcement action.
• The Insolvency Service and Insolvency Practitioners.
• The Land Registry.
• Debit card payment processors.
• Law enforcement agencies, fraud prevention agencies, Regulators and Ombudsmen and government agencies.
• Personal Representatives dealing with the administration of an estate.
• Representatives you appoint to assist you such as debt advice bodies, debt management companies, conveyancing or litigation solicitors and other third parties.

Your Rights

The UK General Data Protection Regulation (GDPR) provides individuals with various rights. Not all of the rights will be available to you for the data we are processing and a request to exercise a particular right will not always result in your request being automatically granted. 

It is free of charge to make a request to exercise the rights set out below. For certain rights we will be entitled to impose a reasonable fee in limited circumstances. We may also be entitled to refuse to comply with your request although this will be unusual. Where either of these scenarios applies to a request you make we will write to you and provide an explanation.

Right to be informed

We are required to inform you of certain key pieces of information about the processing of your data. The purpose of this Privacy Notice is to communicate this information to you.

This Privacy Notice may be changed from time to time and such updates will be shown here on this page.  We recommend that you check this page regularly so that you are aware of any changes which have been made and can contact us if there is anything new which you would like to discuss. Where major changes are made we will draw the amended Privacy Notice to your attention.

Right of access

You have the right of access to your personal data.  Exercising this right is known as making a “subject access request.” You can submit your request using any of the methods available for contacting us.

Before we can respond to your request it will be necessary for us to verify your identity. We will do this by asking you to provide copies of specific official identification documents. We will need to take this step even if we have discussed your account with you previously by phone or in writing. It is an expectation of the Information Commissioner’s Office (ICO) that sufficient steps are taken to ensure that a full record of the personal data we hold is not disclosed to anyone other than the correct individual. Please be assured that our request for confirmation of your identity is for your own protection and is only made because we take the protection of your data so seriously.

At this time you may also be asked to provide further information to assist us with identifying the specific data you are looking for or so that we can properly understand the nature of your query. We are always eager to help our customers and we want to be able to provide you with the data which will be of real assistance to you and will answer your query. Where this is not clear from your request we will take steps to clarify your requirements and expectations with you further.

Once we have received the documents required to confirm your identity and any additional information required to establish the data you require, we will provide our response to your request within one month.

Where it is necessary, we are permitted to extend the deadline by up to two further months. Where we have decided that an extension is needed we will write to you and explain the reasons for the delay.

We are required to provide you with information regarding our processing and your rights in relation to your data along with access to the data itself.

Right to rectification

If you become aware that any of your personal data which we are processing is inaccurate or out of date you have the right to have the data corrected. You can submit your request using any of the methods available for contacting us. Please provide your reasons for why you consider that the data should be amended and any evidence you have to support your request. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Once we have considered your request we will contact you to confirm whether or not we agree that the data is inaccurate and what changes, if any, have been made to the data.  

Where your request is to change your contact details we will still need to retain the previous record in case we later discover that the updated information is not correct. In such instances we reserve the right to revert to using the previous contact details to attempt to contact you.

Right to object 

This right applies to processing which takes places on the basis of legitimate interests. You can submit your request using any of the methods available for contacting us. Please ensure that you set out as fully as possible your reasons for objecting to our processing.  

If we receive an objection we will have to review the balancing test we previously carried out. We will consider our legitimate grounds for continuing to process your data and determine whether these grounds are still compelling enough to override your interests. We will be entitled to continue our processing where we conclude that your interests are outweighed by our grounds for processing. Where your data is being processed for the establishment, exercise or defence of legal claims we will also be able to continue our processing despite your objection.

If we conclude that we do not have an overriding legitimate interest to continue we will need to stop processing the data, which may mean that the data should be erased. More information on the right to erasure is set out below.

Right to erasure

This right allows you to request that your personal data which we are processing be removed from our records. This is sometimes referred to as the “right to be forgotten.” The right to request erasure does not apply in all circumstances and your request will not be granted automatically.

You can submit your request using any of the methods available for contacting us. Please provide your reasons for why you consider that the data should be erased. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Once we have considered your request we will contact you to confirm whether or not we agree that the data should be deleted. If we do not think that the data can be erased we will confirm to you the reasons why this is the case.

Right to restrict processing

This right allows you to request that we limit the way we use your data. The right only applies in certain circumstances, such as where you have challenged the accuracy of the data we are processing or where you have objected to our processing. In such cases you have the right to request that we restrict our processing while we are considering your request.

You can submit your request using any of the methods available for contacting us. You will need to confirm your reason why you consider that the processing of your data should be restricted. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Where we agree to restrict your data we must not process it in any way except for storing it unless we have your consent, the processing is necessary either in relation to legal claims or to protect the rights of another person or for reasons of important public interest.  

Even where you have made a request to restrict processing, it will usually be necessary for us to continue sharing your data with CRAs, to protect the interests of another natural or legal person or because it is in an important public interest. CRA data is relied upon to ensure responsible lending and therefore it is likely to be appropriate for their processing to continue while your request is considered.

If our processing has been restricted while we consider your request for rectification or where you have objected to our processing, the restriction will only be temporary while we are considering your request. Where we have determined that the data held is valid or concluded that our grounds for processing are still compelling enough to override your interests, we will lift the restriction and continue to process your data.  We will notify you before the restriction is lifted.

Right to data portability 

This right allows you to have certain personal data provided to you in a portable format. The right only applies where processing is carried out by automated means. TBI does not carry out any processing solely by automated means. Whether this right is available also depends on the legal basis relied upon. The only relevant legal basis which allows for this right to be exercised is consent.

Taking into account these factors we do not consider that this right is relevant in the context of our processing of your data. If you however feel that this right could apply to your data please contact us and we will consider your request.

Rights related to automated decision making and profiling

It is important that you are aware of any automated decision making which takes place using your personal data. Where a decision is made solely on automated processing, including profiling, and the decision would have a legal or other similarly significant effect on you, there would be certain rights available to you. 

TBI does not carry out any processing solely by automated means because there is human involvement at every stage of the processing. Accordingly no decisions which we make about your account are made based on automated processing. The rights and protections associated with this type of processing are therefore not relevant in relation to your account.

Transferring your Data Outside the UK 

There may be instances where we need to transfer data outside the UK. Where this is necessary we will ordinarily only transfer data within the European Economic Area (EEA) or where it has been officially determined that the country in question has an adequate level of protection for data.

Data would only be transferred outside the EEA where appropriate safeguards are in place or in certain limited circumstances. This would include cases where you relocate to another country and ask us to communicate with you in your country of residence. In such instances we would require you to provide your informed consent. In rare cases involving a relocation to a country outside the EEA it may occasionally be necessary for us to engage the services of tracing and/or debt collection organisations in that country in order to pursue our compelling legitimate interests. In these cases we would only consider pursuing this action after giving full consideration to all of the relevant circumstances and complying with all legal and regulatory requirements.

Storing your Data

We will keep your personal data for as long as necessary for our legitimate purpose of recovering the balance on your account. This means we will retain your personal data for as long as your balance remains outstanding and your account is active. 

Following payment of your balance and closure of your account we will retain your personal data for a period of usually six years from the date of the last transaction. This is to allow for the defence of legal claims until the limitation period expires. There may be some exceptions to this six year period including where we have a legitimate commercial reason to retain customer data for longer.

Recordings of telephone calls will be retained for three years from the date of the call. Call recordings may be held for a longer period where necessary including as a result of an ongoing legal case or complaint.

We also retain records in order to comply with our legal obligations such as in relation to legislation which specifies requirements for the management and retention of data. This includes legislation relating to money laundering, fraud and financial audits. 

Raising a Complaint

If you wish to make a complaint about the way we are handling your personal data please contact us in writing so that we can ensure that we have a full and accurate understanding of your complaint. We will take your concerns seriously and will always try to work with you to resolve the issues you have raised.

If you are not satisfied with our response or if you consider that our processing of your personal data may infringe the UK GDPR you have the right to lodge a complaint with a data protection supervisory authority. The relevant supervisory authority in relation to our processing of your data is most likely to be the Information Commissioner’s Office (ICO). The process for raising a complaint with the ICO and their contact details are set out on their website https://ico.org.uk/

Contact Us

You are welcome to contact us should you have any queries regarding the information contained in this Privacy Notice or if you wish to exercise your rights as set out in the sections above. You may contact us using whichever method works best for you. If you are contacting us to raise a complaint please write to us by post, email or fax.

Our contact details are as follows:

• Postal address: 1st Floor, The Robert Cort Building, Elgar Road South, Reading RG2 0DL
• Email address: This email address is being protected from spambots. You need JavaScript enabled to view it.
• Telephone Number: 0118 931 3800
• Fax Number: 0118 975 2296

Go Debt Privacy Notice

v1.3 – 25 January 2024

This Privacy Notice explains how Go Debt Limited (Go Debt) uses your personal data and how we ensure that it is protected. This is part of our commitment to being transparent in our data processing activities.

For information regarding the use of data relating to accounts owned by TBI Financial Services Limited, please refer to the separate TBI Privacy Notice.

This Privacy Notice may be changed from time to time and such updates will be shown here on this page. We recommend that you check this page regularly so that you are aware of any changes which have been made and can contact us if there is anything new which you would like to discuss.

If you require further information regarding our data processing or if there is anything contained in this Privacy Notice which is not clear please contact us using one of the available methods set out below.

About Go Debt

We are a company specialising in the purchase and recovery of consumer debt. We are authorised and regulated by the Financial Conduct Authority (FCA). We are the Data Controller of your data and we are registered on the Register of Data Controllers maintained by the Information Commissioner’s Office (ICO).  

We have come into possession of your data following the assignment of your credit agreement to us. The company which you entered into your credit agreement with holds data from when you applied for the credit and when your account was opened. They will also have collected data while they were administering your account before the assignment to Go Debt.  

When your account was assigned to Go Debt, data held by the original creditor was transferred to us.  Further data may also be provided to us by the original creditor at a later date. We will also process data which we receive via third parties and data which you provide to us directly.

Sources of Data

Some data will be obtained from you directly when we are in contact with you regarding your account. This will include information provided by a third party you have authorised to assist you and information provided by you or an authorised representative to a third party representative we have instructed such as a debt collection agency or firm of solicitors. Where relevant and considered to be of assistance in the effective management of your account we will record information supplied by you or your representatives on our records for your account.

We also receive personal data from third parties. We have an obligation to inform you about the sources of any data that has not been obtained from you directly: 

1. Original creditor

Most of the data we hold will have been transferred to us at the time your account was assigned to us. This will include the data you supplied to the original creditor when you made your application for credit such as your name and title, date of birth, current and previous addresses and other contact details like email addresses and telephone numbers. Further data may also be provided at a later date when requested by us to assist us with the recovery of the outstanding balance.

Not all data relating to your account will necessarily have been transferred to Go Debt and therefore some data will only be held by the original creditor. If you are interested in such data you will need to contact the original creditor directly. 

1. Third party sources
1. Credit Reference Agencies (CRAs) – data obtained will include:

• Name and address data from public sources such as the electoral register.
• Financial data such as information about accounts you hold with other organisations for example mortgages, bank accounts, credit cards, loans, utilities and mobile phone accounts and retail and mail order accounts. The financial data will include the date your account was opened, credit limits, repayment history including payments which were late or missed and the amount of any debt.
• Information on Judgments such as the name of the Court, the Claim Number, the amount of the Judgment and whether the Judgment has been satisfied.   
• Information on Bankruptcies, IVAs, DROs and other similar types of Orders.
• Information on credit applications where an organisation has conducted a search of CRA data before deciding whether to approve the application. This “search footprint” includes type of application and the date.
• Information on company directorships.
• Links to other addresses established by the CRA from the data above.

1. Tracing Organisations – addresses and other contact details.
2. Royal Mail – data regarding UK postal addresses.
3. Public data sources such as the Insolvency Service and Companies House may be used to obtain or confirm customer identifier data.
4. The Land Registry – data relating to property ownership, charges and other secured liabilities and purchase prices as well as pending and historical dealings with the property.
5. Media sources – where the available information is relevant to your account and your ability to pay it may assist us with determining how best to manage your account.
6. Individuals contacted while pursuing your account – information volunteered which may be relevant and appropriate to record to assist with the effective management of your account. Please note that whilst we may record information provided by such third parties we will not disclose any personal data regarding you or your account to any third party without authority from you.

We are satisfied that we have the right to receive and process data from these sources. Further information regarding our legal bases for processing is set out in the “Your Data” and “Special Categories of Data” sections below.

Purpose of Processing

When we acquired your account all rights under your agreement were assigned to us which means that the outstanding balance is due to us instead of the original creditor. In order for us to pursue our lawful business objectives of recovering the outstanding debt and managing your account appropriately in accordance with our regulatory obligations and quality standards it is necessary for us to process your personal data.

Legal Basis for Processing

In order to be able to process your data we must have a legal basis for doing so. This section explains about which legal bases we are relying on to justify our processing. There is also further information about each legal basis in the “Your Data” and “Special Categories of Data” sections below.

Legitimate Interests – For most of the data we process we will be relying on the legal basis of legitimate interests. These interests include our interests and interests of certain third parties. Further information about our interests is set out in the “Your Data” section below.

Consent – There are certain types of sensitive personal data which we will only process if we have received your explicit consent. “Consent” is another legal basis which entitles us to process data. For further information please see the “Special Categories of Data” section below.

Vital Interests – In limited circumstances it will be appropriate for us to rely on the legal basis of vital interests to process your data in emergency situations. For further information please see the “Special Categories of Data” section below.

Legal Obligation – There may be situations where we are required to disclose data to relevant authorities such as law enforcement agencies or regulatory bodies. Where we do so it will be on the legal basis of compliance with a legal obligation. For further information please see the “Special Categories of Data” section below.

Your Data

This section explains about the “ordinary” types of data which we process and the legitimate interests legal basis we rely on to process this data. The majority of the data we process will fall into this category, such as your name, date of birth, contact details, payment history and other financial information. Examples of the legitimate interests pursued are set out below.

1. Go Debt’s Interests

Go Debt has a legitimate interest in processing your data in order to pursue our lawful business objectives of recovering the outstanding debt and to manage your account appropriately in accordance with our regulatory obligations and quality standards. The debt along with all rights of the original creditor under your agreement were legally assigned to us. We are therefore entitled to pursue you for the debt you owe under the terms of the agreement and we have a legitimate interest in processing data which is necessary for us to achieve this objective. This includes processing data in order to be able to communicate with you, verify your identity and effectively manage your account. It also includes processing data required to evaluate your financial circumstances and determine the reasonableness and affordability of any payment offers.

We also have a legitimate interest in retaining data in case it may be required at a future date in relation to any legal claims issued against us. We will need to retain data for this purpose even where the original legitimate interest in processing to recover the debt is no longer applicable.  

1. Third Party Interests
2. Lenders selling debt – It is a legitimate interest of financial institutions to be able to assign non-performing debts to organisations like Go Debt and for us to be able to process customer data in order to fulfil the purpose of the assignment. Assigning such debt enables financial institutions to free up capital and focus their attention on their area of expertise of lending without having to dedicate resources to arrears recovery where they do not have the specialist experience. Accordingly our processing is fundamental to the legitimate commercial interests of financial institutions, which in turn is also in the wider public interest as explained below.
3. Wider society – It is vital to society in general that businesses like Go Debt can pursue and recover balances due under defaulted credit agreements in order to play their part in the efficient operation of the UK financial system. If financial institutions could not assign defaulted balances and debts remained unpaid it would compromise the ability of financial institutions to lend money on affordable terms. This would also endanger the profitability and stability of those financial institutions and in turn the financial system as a whole which would be against the wider public interest. The availability of affordable lending is also in the interests of those in society needing to borrow and ensures that public spending is maintained to the benefit of the economy and wider society in general.

Go Debt discloses customer data to CRAs which they collate with data shared by other organisations and from public sources which the CRA in turn discloses to lenders seeking to verify the identity of applicants, assess the risk of future default, check for financial misconduct and ensure that they are lending suitable products to customers who can reasonably afford to repay the balance. Our processing of data is therefore necessary in order to meet the legitimate interests of wider society by supporting responsible lending, preventing over-indebtedness, fraud and money laundering.

For the legitimate interests identified we have considered whether the processing is necessary to achieve the objective. We are satisfied that there is no alternative way to achieve our objectives, or those of the third parties, without carrying out the processing. 

We have also carried out a balancing test in order to weigh our interests in processing your data and the interests of the third parties identified above against your interests. We have taken into account all relevant information, including in relation to the data, the nature of the processing and our relationship. We have concluded that our legitimate interests and those of the third parties are compelling enough to outweigh your interests, with any appropriate safeguards put in place to minimise the impact of our processing. Should you wish to obtain further information regarding the balancing test carried out in relation to our processing of “ordinary” personal data please contact us.

Objecting to our Processing

Where your data is processed on the basis of legitimate interests you have the right to object to the processing. Submitting an objection will not necessarily mean that we will ultimately have to stop the processing. Further information on the right to object is set out in the “Your Rights” section below. 

Special Categories of Data

For more sensitive types of data which require extra protection we will only process the data where we have your explicit consent or it is in your vital interests. In other circumstances there may be data which we are required to process due to a legal obligation. These legal bases are explained in more detail below. 

Consent

In order for your consent to be valid it must be explicit and you will therefore be asked specifically to provide your informed consent. You can provide your consent verbally or in writing. If you have given us your consent and you later change your mind you are entitled to withdraw your consent at any time by notifying us by telephone or in writing.  

The type of sensitive personal data which could be relevant to your account is information relating to your health. It may be to your benefit to inform us should you have a health condition, a disability or if there is other information concerning your private life which may be relevant to your ability to make payments towards your debt. We recognise that there are personal circumstances which could indicate potential vulnerability, whether just temporarily or in the long term, and we would like to make sure that we can take appropriate measures to assist you. This may include allowing you to suspend your payment arrangement or reduce your instalments until your circumstances have resolved or placing your account on hold while you seek free independent advice or undergo treatment.

Any sensitive personal data you disclose and consent to us processing will only be retained where it is relevant and will be limited to what is strictly necessary to ensure that our team is appropriately informed about your circumstances so that your account can be handled appropriately. The only other purpose for using this data will be for training and quality purposes.

Such information will be treated with the strictest confidence. It may be disclosed to the original creditor as part of information we are required to supply for periodic auditing.

Vital Interests

In the event that you or a representative you have authorised reveal information to us which suggests that your health is at serious risk, we would be obligated to pass this information to the emergency services.

This processing would be carried out because it would be necessary in order to protect your vital interests where you are physically or legally incapable of giving consent. This would also be relevant where the information revealed indicates that the health of another person is at serious risk.

Legal Obligation

Your data may be processed where disclosure to the relevant authorities is required in order to prevent crime or in accordance with a regulatory requirement. This would include disclosure to law enforcement agencies, fraud prevention agencies and regulatory authorities.

Sharing your Personal Data

We will only share your data in limited circumstances and where it is justified in order to achieve the legitimate interests of Go Debt or certain third parties and where we are satisfied as to the data protection measures implemented by these third parties.

Credit Reference Agencies

Following assignment of your account to us we will take over the responsibilities of the original creditor in relation to reporting to CRAs. 

We will continue to share information about you with CRAs on an ongoing basis, including about your outstanding debt because all accounts assigned to us will have not been repaid on time in accordance with the terms of the agreement. We will also share information with CRAs about accounts which have been settled after they were assigned to us. 

In addition CRAs will share your information with us, as explained in the “Sources of Data” section above. We use this data to manage your account, for tracing where it appears that you have moved address without informing us or the original creditor, to verify the accuracy of information you have provided to us, to assess your financial situation.

CRAs will also share your data with other organisations, including financial institutions who will use the information when you make applications for credit. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates and these links will be shown on your and their credit files. 

Further information about the different CRAs, the ways in which they use and share your personal information and your data protection rights with the CRAs are set out in the CRA Information Notice (CRAIN) which can be accessed by using any of the following links:

Call Credit: www.callcredit.co.uk/crain

Equifax: www.equifax.co.uk/crain

Experian: www.experian.co.uk/crain

Other organisations

• Third party agents such as debt collection agencies, providers of related panel management services and tracing agents who we use to assist with the recovery of the balance.
• External firms of solicitors, barristers, advocates, process servers and providers of enforcement related services we instruct in legal or other proceedings where necessary.
• Our independent financial advisors or other professional advisers.
• The original creditor in accordance with the assignment agreement and the obligations we must comply with.
• Other parties we may engage with in relation to any decision to sell our business or assets or to acquire a business or assets in order to pursue our legitimate commercial interests and only where the other party agrees to keep any data shared safe and confidential.
• Our IT service providers
• Providers of print and mail services.
• HM Courts and Tribunals Service in relation to legal proceedings and enforcement action.
• The Insolvency Service and Insolvency Practitioners.
• The Land Registry.
• Debit card payment processors.
• Law enforcement agencies, fraud prevention agencies, Regulators and Ombudsmen and government agencies.
• Personal Representatives dealing with the administration of an estate.
• Representatives you appoint to assist you such as debt advice bodies, debt management companies, conveyancing or litigation solicitors and other third parties.

Your Rights

The UK General Data Protection Regulation (GDPR) provides individuals with various rights. Not all of the rights will be available to you for the data we are processing and a request to exercise a particular right will not always result in your request being automatically granted. 

It is free of charge to make a request to exercise the rights set out below.  For certain rights we will be entitled to impose a reasonable fee in limited circumstances. We may also be entitled to refuse to comply with your request although this will be unusual. Where either of these scenarios applies to a request you make we will write to you and provide an explanation.

Right to be informed

We are required to inform you of certain key pieces of information about the processing of your data. The purpose of this Privacy Notice is to communicate this information to you.

This Privacy Notice may be changed from time to time and such updates will be shown here on this page.  We recommend that you check this page regularly so that you are aware of any changes which have been made and can contact us if there is anything new which you would like to discuss. Where major changes are made we will draw the amended Privacy Notice to your attention.

Right of access

You have the right of access to your personal data. Exercising this right is known as making a “subject access request.” You can submit your request using any of the methods available for contacting us.

Before we can respond to your request it will be necessary for us to verify your identity. We will do this by asking you to provide copies of specific official identification documents. We will need to take this step even if we have discussed your account with you previously by phone or in writing. It is an expectation of the Information Commissioner’s Office (ICO) that sufficient steps are taken to ensure that a full record of the personal data we hold is not disclosed to anyone other than the correct individual. Please be assured that our request for confirmation of your identity is for your own protection and is only made because we take the protection of your data so seriously.

At this time you may also be asked to provide further information to assist us with identifying the specific data you are looking for or so that we can properly understand the nature of your query. We are always eager to help our customers and we want to be able to provide you with the data which will be of real assistance to you and will answer your query. Where this is not clear from your request we will take steps to clarify your requirements and expectations with you further.

Once we have received the documents required to confirm your identity and any additional information required to establish the data you require, we will provide our response to your request within one month.

Where it is necessary, we are permitted to extend the deadline by up to two further months. Where we have decided that an extension is needed we will write to you and explain the reasons for the delay.

We are required to provide you with information regarding our processing and your rights in relation to your data along with access to the data itself.

Right to rectification 

If you become aware that any of your personal data which we are processing is inaccurate or out of date you have the right to have the data corrected. You can submit your request using any of the methods available for contacting us. Please provide your reasons for why you consider that the data should be amended and any evidence you have to support your request. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Once we have considered your request we will contact you to confirm whether or not we agree that the data is inaccurate and what changes, if any, have been made to the data.  

Where your request is to change your contact details we will still need to retain the previous record in case we later discover that the updated information is not correct. In such instances we reserve the right to revert to using the previous contact details to attempt to contact you.

Right to object 

This right applies to processing which takes places on the basis of legitimate interests.  You can submit your request using any of the methods available for contacting us. Please ensure that you set out as fully as possible your reasons for objecting to our processing.  

If we receive an objection we will have to review the balancing test we previously carried out.  We will consider our legitimate grounds for continuing to process your data and determine whether these grounds are still compelling enough to override your interests. We will be entitled to continue our processing where we conclude that your interests are outweighed by our grounds for processing. Where your data is being processed for the establishment, exercise or defence of legal claims we will also be able to continue our processing despite your objection.

If we conclude that we do not have an overriding legitimate interest to continue we will need to stop processing the data, which may mean that the data should be erased.  Further information on the right to erasure is set out below.

Right to erasure

This right allows you to request that your personal data which we are processing be removed from our records. This is sometimes referred to as the “right to be forgotten.”  The right to request erasure does not apply in all circumstances and your request will not be granted automatically.

You can submit your request using any of the methods available for contacting us. Please provide your reasons for why you consider that the data should be erased. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Once we have considered your request we will contact you to confirm whether or not we agree that the data should be deleted. If we do not think that the data can be erased we will confirm to you the reasons why this is the case.

Right to restrict processing

This right allows you to request that we limit the way we use your data. The right only applies in certain circumstances, such as where you have challenged the accuracy of the data we are processing or where you have objected to our processing. In such cases you have the right to request that we restrict our processing while we are considering your request.

You can submit your request using any of the methods available for contacting us. You will need to confirm your reason why you consider that the processing of your data should be restricted. Please note that it may be necessary for us to ask you to provide specific evidence of your identity before we can respond to your request.

Where we agree to restrict your data we must not process it in any way except for storing it unless we have your consent, the processing is necessary either in relation to legal claims or to protect the rights of another person or for reasons of important public interest.  

Even where you have made a request to restrict processing, it will usually be necessary for us to continue sharing your data with CRAs, to protect the interests of another natural or legal person or because it is in an important public interest. CRA data is relied upon to ensure responsible lending and therefore it is likely to be appropriate for their processing to continue while your request is considered.

If our processing has been restricted while we consider your request for rectification or where you have objected to our processing, the restriction will only be temporary while we are considering your request. Where we have determined that the data held is valid or concluded that our grounds for processing are still compelling enough to override your interests, we will lift the restriction and continue to process your data.  We will notify you before the restriction is lifted.

Right to data portability 

This right allows you to have certain personal data provided to you in a portable format. The right only applies where processing is carried out by automated means. Go Debt does not carry out any processing solely by automated means. Whether this right is available also depends on the legal basis relied upon.  The only relevant legal basis which allows for this right to be exercised is consent.

Taking into account these factors we do not consider that this right is relevant in the context of our processing of your data. If you however feel that this right could apply to your data please contact us and we will consider your request.

Rights related to automated decision making and profiling

It is important that you are aware of any automated decision making which takes place using your personal data. Where a decision is made solely on automated processing, including profiling, and the decision would have a legal or other similarly significant effect on you, there would be certain rights available to you. 

Go Debt does not carry out any processing solely by automated means because there is human involvement at every stage of the processing. Accordingly no decisions which we make about your account are made based on automated processing. The rights and protections associated with this type of processing are therefore not relevant in relation to your account.

Transferring your Data Outside the UK 

There may be instances where we need to transfer data outside the UK. Where this is necessary we will ordinarily only transfer data within the European Economic Area (EEA) or where it has been officially determined that the country in question has an adequate level of protection for data.

Data would only be transferred outside the EEA where appropriate safeguards are in place or in certain limited circumstances. This would include cases where you relocate to another country and ask us to communicate with you in your country of residence. In such instances we would require you to provide your informed consent. In rare cases involving a relocation to a country outside the EEA it may occasionally be necessary for us to engage the services of tracing and/or debt collection organisations in that country in order to pursue our compelling legitimate interests. In these cases we would only consider pursuing this action after giving full consideration to all of the relevant circumstances and complying with all legal and regulatory requirements.

Storing your Data

We will keep your personal data for as long as necessary for our legitimate purpose of recovering the balance on your account. This means we will retain your personal data for as long as your balance remains outstanding and your account is active. 

Following payment of your balance and closure of your account we will retain your personal data for a period of usually six years from the date of the last transaction. This is to allow for the defence of legal claims until the limitation period expires. There may be some exceptions to this six year period including where we have a legitimate commercial reason to retain customer data for longer.

Recordings of telephone calls will be retained for three years from the date of the call.  Call recordings may be held for a longer period where necessary including as a result of an ongoing legal case or complaint.

We also retain records in order to comply with our legal obligations such as in relation to legislation which specifies requirements for the management and retention of data. This includes legislation relating to money laundering, fraud and financial audits. 

Raising a Complaint

If you wish to make a complaint about the way we are handling your personal data please contact us in writing so that we can ensure that we have a full and accurate understanding of your complaint. We will take your concerns seriously and will always try to work with you to resolve the issues you have raised.

If you are not satisfied with our response or if you consider that our processing of your personal data may infringe the UK GDPR you have the right to lodge a complaint with a data protection supervisory authority. The relevant supervisory authority in relation to our processing of your data is most likely to be the Information Commissioner’s Office (ICO). The process for raising a complaint with the ICO and their contact details are set out on their website https://ico.org.uk/

Contact Us

You are welcome to contact us should you have any queries regarding the information contained in this Privacy Notice or if you wish to exercise your rights as set out in the sections above. You may contact us using whichever method works best for you. If you are contacting us to raise a complaint please write to us by post, email or fax.

Our contact details are as follows:

• Postal address: 1st Floor, The Robert Cort Building, Elgar Road South, Reading RG2 0DL
• Email address: This email address is being protected from spambots. You need JavaScript enabled to view it.
• Telephone Number: 0118 931 3800
• Fax Number: 0118 975 2296