Commercial Debt Privacy Notice

Overdales Legal Limited is a specialist debt recovery law firm which is part of the Lowell group of companies.

Where we act on behalf of our clients to recover outstanding debts through court and other legal proceedings, we are a controller of your information which means that we are responsible for looking after it. We explain how we use your personal information in this privacy notice.

Where we act on behalf of our clients to recover outstanding sums as a debt collection agency, we are a processor of your information. This means that our client is responsible for providing you with the details of how your personal information will be used.

For details of the UK companies in the Lowell Group, please see the section Who is the Lowell Group? below.

We collect:

• name
• business contact details (work email address, work telephone number, work address)
• job title
• any information you provide to us

We will obtain your information from one or more of the following:

• you (e.g. via the phone or in correspondence)
• our client (including information our client obtains from third party data sources such as Dun & Bradstreet, a company which provide credit information about businesses
• the company which the debt was originally owed to
• publicly available sources such as Companies House, your employer’s website, LinkedIn

We need your information in order to provide our legal services to our client.  This includes working with you to:

• manage your employer’s account
• agree payment plans which are tailored to your employer’s circumstances
• process any payments your employer makes
• take legal action against your employer
• take action to enforce any judgment obtained against your employer.

As we have been instructed by our client to provide them with services to recover the outstanding amounts that your employer owes through court and other legal proceedings, both we and our client have a legitimate interest in using your information for these purposes.

We sometimes need to share some of your information with other organisations. 

Information that we share with our client

In order to provide our services to our client, we may share with our client any information that you provide us, including call recordings.

Information that we share with other companies in the Lowell group

We may share your information, including call recordings, with other companies in the Lowell group for our internal administrative purposes and to comply with our professional, legal and regulatory and other corporate governance obligations. For details of the UK companies in the Lowell Group, please see the section Who is the Lowell Group? below.

Information that we share with other companies in the Lowell group

We may share your information, including call recordings, with other companies in the Lowell group for our internal administrative purposes and to comply with our professional, legal and regulatory and other corporate governance obligations. For details of the UK companies in the Lowell Group, please see the section Who is the Lowell Group? below.

Information that we share with third parties

We may share information about you, including call recordings, with third parties including:

• tracing agents and process servers who we instruct to act on behalf of our client to locate your employer or serve your employer with court documents
• court advocates and barristers who we instruct to represent our client at court hearings
• the company which the debt was originally owed to, and this may include sharing call recordings for the purposes of resolving issues, training and to improve our quality and service standards
• debt management companies who your employer has authorised to act on their behalf
• any other person who has authority to act on your employer’s behalf, including someone who is acting under a power of attorney and
• any law firm who your employer instructs to act on their behalf in respect of any court or other legal proceedings in relation to your employer’s account.

Information that we share with the Court

Where we take legal action and issue proceedings against your employer, we may share information about you with the court for the purposes of the legal proceedings. This may include your name, work contact details, job title, details of our communications with you and call recordings. 

Information that we share with law enforcement, public authorities and emergency services

If we identify evidence of fraud, money laundering or any other crimes in relation to your employer’s account, we may share those details with the police, the National Crime Agency and other law enforcement agencies. We may also share information with HM Revenue and Customs where appropriate.

If we believe you may be in immediate danger, we may share your information including details of your physical and mental health conditions with the police and other emergency services.

We may also share information with law enforcement agencies and public authorities in response to requests for information.

We may share call recordings with any of the above agencies.

Information that we share with regulatory authorities and Ombudsman Services

We are authorised by the Financial Conduct Authority and by the Solicitors Regulation Authority. This means that we are required to report certain things to the Financial Conduct Authority and the Solicitors Regulation Authority which may mean sharing information about you, including call recordings, if there is an issue or complaint in respect of our dealings with you or your employer.

We are registered with the Information Commissioner’s Office and if you make a complaint to them, we may have to share information about you and your employer’s account, including call recordings.

We also deal with the Financial Ombudsman Service, the Consumer Ombudsman Service, the Legal Ombudsman Service and the Credit Services Association (known as the CSA). If you make a complaint to them, we may share information with them about you and your employer’s account, including call recordings, in order to resolve your complaint.

Information that we share with our third party suppliers

We use carefully selected third parties to supply us with products and services, such as IT and mailing services. The information that we share with our suppliers will depend on the nature of the products and services that they provide to us but we will only share the minimum amount of your information which is necessary for them to provide us with the products and services we need.

Information that we share with other third parties

If we or any member of the Lowell group of companies merges, transfers or sells part or all of its business or assets or all or part of its share capital to a third party, your personal information may be disclosed to that third party and its advisers for the purposes of negotiating and completing the merger, transfer or sale.  If the merger, transfer or sale does complete, that third party may use or disclose your information as set out in this privacy notice.

We may also share your information, including call recordings, with our investors, insurers, insurance brokers, lenders, legal and other professional advisers where necessary.

Your information is generally stored on servers and filing systems in the UK but from time to time it may be stored in or accessed from countries outside the UK. Where this may happen, we always make sure that there are appropriate safeguards in place, such as the standard contractual clauses or binding corporate rules, to guarantee that your information – and your rights – are protected to the same high standard as under UK law.

Model contract clauses

These are a set of standard clauses which have been recognised by the European Commission and the Information Commissioner’s Office as providing adequate protection to personal information transferred outside the EU or UK.

When we include these clauses in a contract with one of the companies we work with, it means that if they transfer your information outside the EU or UK, they must make sure that your information is just as safe as it is in the EU and UK.

International Data Transfer Agreement

This is a standard agreement which has been recognised by the Information Commissioner’s Office as providing adequate protection to personal information transferred outside the EU or UK.

When we enter into this agreement with one of the companies we work with, it means that if they transfer your information outside the EU or UK, they must make sure that your information is just as safe as it is in the EU and UK.

We only keep your information for as long as we need it and we will keep your information for no more than 7 years from the date you cease to have any active accounts with us.  We keep your information for this long so that we can:

• deal with any issues or concerns that you may have about how we handled your employer’s account
• to answer any questions HM Revenue and Customs may have
• bring or defend any legal claims

However, we won’t keep all of your information for so long, and we will delete some information much sooner.

We have a retention policy which we have written considering all the different types of information that we hold about you, understanding how long we need to keep it for and agreeing not to keep it for any longer.

Under the data protection rules, you have a number of rights in respect of your information and the way we use it. Some of these rights only apply in certain situations. We explain below what rights you have, what these mean and how they apply to the way we use your information.

You have the right to:

Access your information

You can ask for:

• confirmation that we process your personal information
• a copy of your personal information that we hold and
• other information about how we process your information.

We will provide you with a copy of your personal information which we hold unless the data protection rules provide an exception that we decide to rely on, for example, where there are ongoing court proceedings. We may also edit out the names of any other individuals to protect their privacy.

Wherever possible, we will provide you with a copy of your personal information in the same manner you make your request unless we agree otherwise with you.

This privacy notice also includes the other information you can ask for about how we process your information.

Have your information rectified

You can ask us to rectify your information if it is not accurate, complete or up to date.

We will update or correct your information, although sometimes we may need to ask you to provide evidence to confirm the changes, for example a copy of your marriage certificate if you are changing your name because you have got married.

Have your information erased

This is also known as the right to be forgotten.

You can ask us to delete your information where:

• we no longer need it
• we rely on your consent to use your information and you withdraw it
• you object to our processing it and we have no overriding legitimate grounds to continue processing it or
• we are legally required to delete it.

This right does not apply where:

• we are legally required to keep your information, for example under the anti-money laundering laws
• we have a compelling legitimate ground for using your personal information or
• we need your information to establish, exercise or defend legal claims, for example where there are ongoing court proceedings.

As we use your information for the purposes of establishing and exercising our client’s legal claims to recover the outstanding amounts your employer owes, we will only be able to delete your personal information when we no longer need it.

Our retention policy means that we will delete your information once we no longer need it. Please see the 'How long do we keep your information?' section for more details.

Restrict our processing of your information

You may ask us to restrict our processing of your personal information where:

• you believe the information we hold about you is inaccurate while we check whether it is accurate
• we no longer need your information but you need it to establish, exercise or defend a legal claim or
• you object to our processing your personal information while we reconsider our legitimate interests assessment.

We will not process your personal information whilst we consider your request. However, we will still be able to process your personal information for the purposes of any ongoing court or other legal proceedings.

We will inform you of the outcome of our review.

Have your information transferred to you and/or a third party

This is also known as the right to data portability.

You can ask us to provide you with a copy of the information which you have provided to us and which we hold electronically.

This right is unlikely to apply as we process your information on the basis of our legitimate interests. If this right does apply, we will provide the relevant information to you in a commonly-used and machine readable format.

Object to our processing of your information, including profiling

You can object to our use of your information, including profiling unless:

• we have compelling legitimate grounds for using your information or
• we need to use your information to establish, exercise or defend a legal claim, for example where there are ongoing court proceedings.

You can also object to us using your information for marketing purposes.

As we process your information for the purposes of recovering the outstanding amounts that your employer owes, including through court or other legal proceedings, this right will not apply in most cases, as we will need to use your information for the purposes of those proceedings.

We do not carry out any profiling in respect of you or your employer or their account.

We do not use your information for direct marketing purposes.

Not to be subject to an automated decision

You can ask us to review any automated decision which has a legal or similarly significant effect for you. You can provide us with your point of view and any additional information that you think we need and ask for a human to reconsider our decision.

We do not make any automated decisions about you or your account which have a legal or similarly significant effect for you.

We will always do our best to respond to your request within one month of receiving it and any additional information we need to confirm your identity and understand your request.

However, sometimes we may need some more time to deal with your request, particularly if it is complicated.  Where this happens, we will write to you within one month and let you know why we need some more time and when we will provide you with our response.

If we are unable to carry out your request, we will send you a response explaining why.

If you would like to exercise any of your rights, please contact our Data Protection Officer

• by email at dpo@overdales.com
• in writing to Data Protection Officer, Overdales Legal Limited, PO Box 1399, Bradford, BD5 5GA

If you have any questions, concerns or complaints about the way Overdales Legal Limited processes your personal information, please contact our Data Protection Officer in the first instance

• by email at dpo@overdales.com
• in writing to Data Protection Officer, Overdales Legal Limited, PO Box 1399, Bradford, BD5 5GA

Our Data Protection Officer deals with data protection for all our UK companies, so whichever Lowell company your question, concern or complaint relates to, please contact our Data Protection Officer using these contact details.

If you are not happy with the way we have handled your complaint or are still concerned about our handling of your personal information, you have a right to take your complaint to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF and www.ico.org.uk.

The Lowell group is made up of the following companies incorporated in the UK.

We will regularly review this notice and keep it updated to make sure that the information we provide you with is accurate and up to date.

This notice was last reviewed and updated in July 2022.