Privacy Policy

Privacy policy

This privacy statement explains how we process your information to provide you with our services in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read the following sections carefully, as they explain what personal information we collect about you and how we use this information. Debt Support Service is committed to respecting and preserving your privacy and personal data.

This privacy policy applies to you if you provide your personal information to us, even if you subsequently decide not to proceed with using our service.

Data Controller

Debt Support Service Limited is the data controller and is responsible for your personal data. If you have any questions or queries in relation to this privacy notice, or how we process your personal information, you can contact us. This includes any requests to exercise your legal rights, such as a subject access request (SAR), or to update your preferences.

Contact details:

The Data Controller
Debt Support Service Ltd
8 Exchange Quay
Manchester
M5 3EJ

Tel: 0161 375 3328
Email: info@debtsupportservice.co.uk

When you contact us, please include your DSS reference number, name, address, telephone number, and email address.

Why and how we process your personal data (lawful bases)

We will only collect, use, and share your personal data where the law allows us to do so and where it is necessary to provide the product or service you have chosen, to meet our legal or regulatory obligations, or where we have another lawful basis.

In some circumstances, we may need to share your personal information with your creditors or other third parties. Without sharing information in these circumstances, we (or the relevant third party) may be unable to carry out a legal duty or deliver the requested service. We only share information that is relevant and necessary for the specific purpose and ensure appropriate safeguards are in place to protect your data.

Under UK data protection law, we rely on one or more of the following lawful bases when processing your personal data:

• • Contract – where processing is necessary to enter into, or perform, a contract with you
  • Legal obligation – where we are required to process your data to comply with legal or regulatory requirements
  • Legitimate interests – where processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms
  • Vital interests – where processing is necessary to protect your vital interests or those of another person
  • Public task – where processing is necessary to carry out a task in the public interest or under official authority
  • Consent – where you have given us clear consent to process your personal data for a specific purpose

We will always identify and rely on the most appropriate lawful basis for each type of processing and ensure that your personal data is handled fairly, lawfully, and transparently.

How we collect your personal data

We may obtain personal data from you in several ways:

• • When you make an enquiry or application to us by phone, email, via our website, by a third party, or by any other means
  • When we need to obtain updated information about you to meet our regulatory and legal obligations (such as an annual review)
  • When you participate in market research or interact with us on social media
  • By leaving reviews relating to us
  • Where you have given permission for your information to be provided to us
  • Information received via a third party, for example a creditor providing information about an account you hold with them, such as an outstanding balance
  • Where you have previously agreed for your information to be shared with us by another company

Initial enquiry

Where you make an enquiry or apply for one of our services, we will use your information to provide you with appropriate information to recommend a suitable debt solution in line with our FCA regulatory requirements. If you’re unable to provide this information, we may not be able to progress with your application or enquiry. We may also use this information to contact you about, and process, your enquiry or application by phone, SMS, or email.

After you have made your initial enquiry, if you then decide to go ahead with any of the services that we offer, the sections below explain how we will also process your data when we provide that service.

Debt solution information

Where we give you information on a debt solution, we will process your personal information to administer the service we provide. This may include contacting you where we may need further information or sending you updates on the progress of the service we provide to you. We may also share your data with one of our third parties where we’re unable to provide a particular service. We will only do this with your prior consent.

What data do we collect about you?

Personal data / information means any details about an individual whereby that person can be identified and does not include anonymous data, where the identity has been removed.

The types of data we may collect, store, use, or transfer include some or all of the following:

• • Your personal details, such as name, address, and date of birth
  • Contact details, such as your phone number and email address
  • Special category data / special personal information, such as your health, including mental and physical health
  • Details relating to your household / family and limited information about them
  • Financial information, such as your income, expenditure, assets, and liabilities
  • Employment information
  • Information regarding your creditors
  • Information on how you use our website and products/services
  • Your preferences in receiving marketing from us and any associated third parties, including your communication preferences (SMS, email, phone)
  • Aggregated data, such as statistical or demographic data

Aggregated data

This data may not be considered personal data by law, as it does not directly or indirectly reveal your identity. Where any aggregated data is combined with personal data in a way which identifies an individual, then the combined data will be treated as personal data and will be used in accordance with this privacy policy.

Special category data / information

Data protection law defines some personal information as “special categories of data”. This includes information about physical or mental health, sexual orientation, religious beliefs, race or ethnic origin, political opinions, trade union membership, or biometric data.

In some cases, you may choose to share this type of information with us as part of your communications, for example by explaining personal circumstances that have affected your financial position. Where this information is provided voluntarily, it may be incidentally recorded within correspondence or case notes as part of our normal record-keeping.

We do not actively record, categorise, or rely on special category data (for example, by marking vulnerability indicators or sharing the information with third parties) unless this is necessary and either:

• • You have provided your explicit consent, or
  • We are required or permitted to do so by law

Any personal data relating to criminal convictions or offences will only be processed where authorised by law.

Information about other people

If you provide personal information about someone else, for example where a joint application is made or you provide details about a member of your family unit, you must do so with the permission of the other person. Your personal information and any information about the service provided to you will be shared with the other person. We will use the personal information about the other person in the ways described in this policy.

Who will data be shared with?

Organisations we may share your details with and why:

• • Creditors – Any organisations to whom you owe money
  • 9 Knots Business Solutions Ltd – Case management software provider
  • Aryza – Case management software provider
  • Signable Ltd – Electronic signature services
  • Avoira (Microsoft) – Provision and management of Microsoft Office 365 cloud services
  • 3CX – Telephony services
  • Valid8 IP Ltd – Soft credit searches (via Experian) and identity checks
  • DocuWare – Document management platform
  • CallCabinet – Call recording platform
  • Evaluagent – Compliance and quality assurance platform
  • Total Processing Ltd – Payment processing platform
  • Global Payments – Payment processing platform
  • London & Zurich – Payment processing platform
  • Convene IT – IT support and managed services
  • Convene Cyber – Cyber security monitoring and information security services
  • Astute Finance Limited – Debt advice and solution provider
  • Money Wellness – Debt advice and solution provider
  • Financial Wellness Group – Debt advice and solution provider
  • JT Maxwell – Licensed insolvency practitioner
  • Peak Insolvency – Licensed insolvency practitioner
  • Omni Group LLC – Customer service and administrative support
  • Financial Conduct Authority – Regulator
  • Information Commissioner’s Office – Regulator
  • HM Revenue & Customs – Regulator and authority
  • Other government, law enforcement, or regulatory bodies – Regulators and authorities
  • Financial Ombudsman Service – Complaint resolution
  • Advertisers and social media companies – Marketing and advertising activities

Credit Reference and Identity Verification

With your permission, we will disclose personal data to our partner Valid8 IP Ltd for the provision of credit report and identity information, which may include Equifax Ltd, Experian Ltd, and TransUnion. To understand how the credit reference agencies use and share personal data, please see the CRAIN notice:

TransUnion – http://www.transunion.co.uk/crain

Equifax – https://www.equifax.co.uk/crain/

Experian – https://www.experian.co.uk/legal/crain

Transfer of information outside of the UK

From time to time, we also use external consultants, legal specialists, and outsourcing partners to support aspects of our operations, such as record keeping, scanning, printing, IT support, and compliance oversight. Some of these providers may be located outside the UK or the European Economic Area (EEA). All such providers are subject to due diligence and contractual obligations to safeguard your information.

Storing your data

All information you provide to us is stored on our secure, UK-based servers. We will store the information we collect about you in accordance with legal requirements and our data retention policy. Data will be deleted in line with that policy.

If you continue to be our customer and we provide advice, we will keep a record of your personal information to ensure that we provide you with the best service possible and where we are required to keep your data to meet our legal and regulatory obligations. This will normally be retained for at least six years, starting from the date we are no longer providing you with a service.

Telephone calls and web chats will be retained for at least six years from the date the call was made. If you do not go ahead with any product or service offered by us, your personal information will normally be deleted after two years (except for any recorded telephone calls), unless we have another reason to retain your personal information, for example where you have given your consent to receive marketing or promotional messages from us. After this time, we will delete the information or anonymise it so that it can no longer be linked back to you.

Other purposes for processing your personal data

Websites and marketing

To help us understand you better and provide you with information about other products which may be suitable and relevant, we may use your personal information to create a profile of you and your circumstances. This allows us to provide more relevant, accurate, and tailored services to you. For example, we may assess your income and expenditure to determine whether you would be eligible for a debt solution through us.

We believe we have a legitimate interest in doing this and that it does not override your rights. However, if you do not want us to profile your personal information in this way to tailor marketing communications to you, you can contact us to let us know that you wish for your personal data not to be used in this way.

Reviews and market research

Where we hold your personal information, we may contact you to ask you to provide a review about the services you have received, or where we are carrying out market research to help us design future products and services or improve our current services. Although this information would be helpful, you are not required to provide it unless you are happy to do so.

We consider it to be within our legitimate interests to contact you in this way for market research purposes. You will normally be asked to leave a review via Feefo or Google.

Cookies

What are cookies?

Cookies are small text files that are placed on your computer or mobile device when you visit a website. They facilitate the processing of your data and enable us to analyse how the website is being used.

There are two types of cookies:

• • Temporary cookies – These cookies form part of the security process and expire when you close your web browser.
  • Permanent cookies – These cookies stay on your device for a longer period or until you manually delete them.

Regarding the entity that sets the cookies, there are two forms of cookies:

• • First-party cookies – These are cookies set by the website you are visiting, either by us or by a third party at our request.
  • Third-party cookies – These are cookies set by a third party rather than the provider of the website you are visiting.

Why are cookies used?

Cookies help visitors to a website by allowing sites to provide personalised content and remember log-in details and settings. You can turn cookies off at any time. This will not stop a website from working, but it may mean it does not work as effectively, or that you must repeat certain actions.

Cookies also help website owners by providing information such as which search engine a visitor used to find the website, how often they have visited, how long they have spent on it, and similar information.

Cookies are retained for varying periods depending on their purpose, but are generally kept for no longer than 12 months, unless a longer period is strictly necessary.

Disabling/enabling cookies

You can accept or decline cookies by modifying the settings on your browser. Please note that disabling certain cookies may affect the functionality of our website. Further information on the use and management of cookies can be found at allaboutcookies.org.

Aggregate visitor information

Our web servers collect certain information about all visitors to our website, including:

• • IP address
  • Host names
  • Domain names
  • Time and date information requested
  • Browser version and platform when information is requested
  • A record of which pages have been requested

We use this information to produce aggregate visitor statistics relating to which pages are being accessed. We may also use it to monitor usage patterns on this website to improve navigation and design features to help you find information more easily. These statistics do not include information that can be used to identify any individual.

Legal or regulatory obligation

We are required to process your personal information where we have a legal or regulatory obligation to do so, for example to comply with anti-money laundering requirements or other regulatory obligations.

Responding to complaints or enquiries

If you make an enquiry or complaint with us, we will use your personal information to investigate and respond appropriately. We have legal and regulatory obligations to handle complaints properly.

We may also be required to share your data with the Financial Ombudsman Service if your complaint is escalated and they request this information from us.

Internal analysis

As part of our legitimate interest in developing our business and products, we may use your personal information to assess our performance and for statistical analysis. We will use as little personal data as possible to achieve this.

Fraud prevention and law enforcement agencies

The personal information we collect may be shared with law enforcement and fraud prevention agencies to prevent fraud, money laundering, and terrorist financing, and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

Social media

We use publicly available social media platforms to promote our services, provide updates, and share news and promotional information. We may collect personal information from these platforms, for example if you post a message on our Facebook page.

By providing information to us through these platforms, you should be aware that:

• • Social media pages are publicly available, and you should not provide personal or sensitive information on public-facing pages, such as account details.
  • We may ask for account information via private message to identify you and respond to any request you make.
  • Each social media platform processes personal information in accordance with its own privacy policy, which can be viewed on the relevant platform.

Security

We take the protection of personal information very seriously and maintain appropriate measures to ensure the confidentiality, integrity, and availability of the information you provide.

These measures include:

• • Company security policies and standards
  • Staff security awareness
  • Access controls to prevent unauthorised access
  • Encryption and anonymisation technologies
  • Anti-malware technologies
  • Security monitoring
  • Security testing
  • Secure archiving and deletion
  • Compliance with industry regulation and legislation

Please note that we are not responsible for the content or privacy practices of any other website to which our website may link.

Recording calls

We may record telephone calls you make to us, or that we make to you or third parties. This is for training, monitoring, quality assurance, and to meet legal and regulatory obligations. Some calls may be observed by staff for training and development purposes.

Call recordings may be retained for up to six years from the date the call was made.

Your rights

Access to your personal information

You have the right to request a copy of the personal information we hold about you. This is often referred to as a “data subject access request” or “DSAR”. You can make a request by contacting us, and we will not charge a fee.

Before providing information, we may request proof of identity or ask questions to locate the data and ensure it is disclosed appropriately.

Right to have your personal information corrected

If the personal information we hold about you is inaccurate, you have the right to request that it is corrected.

Right to stop or limit the processing of your data

You may request that your personal information is deleted or that we stop processing it where we are no longer entitled to do so. There may be circumstances where we cannot delete data due to legal or regulatory obligations, but we will discuss this with you if applicable.

Data portability

In some cases, you may request that your personal information is provided to you or another organisation in a commonly used electronic format. To request this, please contact us.

Information Commissioner’s Office (ICO)

If you have concerns about how we collect, process, or store your personal data, please contact the Data Controller using the details provided above. You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

Updates to this privacy policy

Any changes we make to this privacy policy will be posted on this page and, where appropriate, notified to you by email. Please check back regularly for updates.