This Privacy Notice relates to the processing of personal information by TRACE Debt Recovery UK Ltd & TRACE Enforcement Services (otherwise stated as “we”, “us” or “our”) and relates to personal information belonging to debtors and people with whom The TRACE Group interacts in our debt collection and enforcement activities.
Data Protection Principles
We comply with UK Data Protection Law which states that any personal information we hold about you must be:
- Kept securely.
- Kept only as long as necessary for the purposes we have told you about.
- Accurate and kept up to date.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Collected only for valid purposes and not used in any way that is incompatible with those purposes.
- Used lawfully, fairly and in a transparent way.
Where your personal data is collected
We may collect your data from the following sources:
- Our client, the creditor, who chose to engage us for the recovery services we offer.
- Third parties such as credit reference and tracing agencies and other third parties and from the DVLA under a KADOE (Keeper of Vehicle at the Date of an Event) contract.
- You when you provide such information when contacting us by, including but not limited to, post, phone, or e-mail, when you use our automated payment website, telephone payment lines and through discussions with our agents. This information may include bank account number or numbers, payment card details and a delivery address.
- Information you provide to enable us to assess your ability to make payments or the special category information you provide if you claim to be a vulnerable person.
- Your use of our websites.
- Video recordings that may evidence a visit by one of our enforcement agents or a visit by you to one of our offices and through voice recordings made during any telephone calls you make to us.
Categories of personal information that may be processed
The personal data relating to you that we collect and receive from yourself (or an authorised representative), and from third parties may include but not be limited to any or all the following:
Your name, full postal address, date of birth, e-mail address or addresses, financial details (including bank account number or numbers, payment card details), information relating to your nationality, your health (including any vulnerabilities), residency and property ownership, vehicle registration number, details of how the debt was incurred, your comments during calls or correspondence you have provided.
We may combine personal data relating to you that we receive from third party sources with personal data you give to us and personal data we otherwise collect about you.
The lawful basis on which we may process your personal information
The information that we collect about you will only be used lawfully. The data processing, we carry out on behalf of our client is necessary for:
- the performance of a contract to which the data subject is party. (GDPR Art 6 1(b)).
- compliance with a legal obligation. (GDPR Art 6 1(c)).
- the performance of a task carried out in the public interest or in the exercise of official authority vested in us and our client. (GDPR Art 6 1(e)).
- the legitimate interests of both our client and us to recover an outstanding debt and where we record our interactions with you. (GDPR Art 6 1(f)).
- the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity. (GDPR Art 9 2(f)).
How we may use your personal information
All personal data that we receive is processed in accordance with this Privacy Notice.
We may process the personal information relating to you which we receive from the client and other sources for one or more of the following reasons, as appropriate:
- To enable us to recover debts owed by the debtors of the client including, for certain types of debts, undertaking enforcement activity using the process contained in Schedule 12 to the Tribunals, Courts and Enforcement Act 2007, processing of private parking charge appeals on client’s behalf, recovery of unpaid council tax from a debtor’s wages in accordance with an attachment of earnings process, the instruction of insolvency solicitors, the service of arrest warrants and High Court Enforcement Officers and the inspection of commercial properties, as appropriate. Where necessary, we may also disclose personal data to third party tracing agencies to assist it in locating debtors and may receive further personal data from such agencies and from the debtors themselves.
- To process contact details provided (address, email, and phone) to enable you to have access to your payment account and to verify or contact you on matters relating to this account.
- To carry out our obligations to our client, which wishes to use the service we offer in line with the terms and conditions of any original parking charge.
- To keep a record of correspondence and agreements made with the debtor, including payment plans that reflect your individual circumstances.
- To process and keep a record of all payments made by the debtor.
- To assess ability to pay and to consider a debtors’ vulnerability to ensure they are treated with an appropriate degree of sensitivity. We may also process the personal data of members of a debtor’s household as part of its assessment, if appropriate.
- To process the personal data, we collect from the use of Body Worn Video cameras (BWV) and the recording of telephone calls with debtors to:
- Ensure compliance with applicable laws and be able to respond adequately and fairly if complaints are made against such processing.
- Monitor the performance of its employees and agents.
- The use of BWV also discourages violence against our enforcement agents and may be used to provide evidence to investigate and prosecute any violence against the enforcement agent.
- To carry out our obligations to our clients who wish to use the services we offer in line with the terms and conditions of any original agreement that they had with you.
Who we may share your personal data with
We will not share your information with third parties outside of the Group except where:
- We have a legal or contractual requirement to do so – for example, meeting our statutory obligations to report to central government.
- We are required to provide additional information to a client who appointed us to collect the outstanding debt.
- It is necessary to do so with a payment processor for processing any online payments, as required.
- It is necessary to share with the Driver Vehicle Licensing Agency (DVLA).
- The Independent Appeals Service (IAS) or The Parking on Private Land Appeals (POPLA) Service or require your information for the purpose of assessing any appeals.
- It is necessary to provide your information to credit reference agencies for the purpose of ensuring that we are writing to you at your most recent correspondence address.
- It is necessary to share with solicitors for the purpose of enforcing a parking contract or responding to a legal query.
- It is required for us to provide it to any duly authorised sub-contractors with whom we are in contract.
- With print and mail service providers for the purpose of contacting you by post.
- Your information is required by email service providers for the purpose of responding to you once you have consented by email.
- We may pass your information to our third-party service providers for the purposes of completing tasks and providing services on our behalf for our clients. When we use third party service providers, we will disclose only the personal information that is necessary for them to deliver the service. We will first have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes.
- It is necessary to share your personal information with the following organisations, including but not limited to: The British Parking Association (BPA), The International Parking Community (IPC), The Civil Enforcement Association (CIVEA), The Traffic Enforcement Centre (TEC), The High Court Enforcement Officers Association (HCEOA),The Information Commissioner’s Office (ICO), The Credit Services Association (CSA) and The Local Government Ombudsman (LGO) for the purpose of complaint investigation and resolution.
We do not send or process any personal data outside of the UK and EU.
How we protect your personal information
We will not retain your information for longer than is necessary for the purposes outlined in this Privacy Notice but for up to 6 years, or more, if necessary, to protect our position in the event of any legal disputes. This may be extended if disputes are ongoing.
We always seek to protect the privacy of your information when you visit our website. If you choose to send personal information to us, the information you supply will be sent and processed in a secure manner.
In addition, we limit access to our buildings to those that we believe are entitled to be there. Access controls to our information technology are in place and appropriate procedures and technical security measures are in place to safeguard your information across all our computer systems, networks, website, mobile applications, and video cameras.
Special Category / Sensitive Personal Data
You may voluntarily give such Special Category / Sensitive personal data to us by, including but not limited to, telephone calls, letters, or emails. We will only use such personal data for debt collection purposes and process such personal data for this purpose.
We only process Special Category personal data relating to health for the sole purpose of carrying out the obligations and exercising the specific rights of our clients. In this process, we pay especial regard to safeguarding the fundamental rights and interests of customers, including equality of opportunity or treatment. As applies to all data processing, we must have a lawful basis for the processing of Special Category Personal Data.
We would only share such data with our respective clients who need to be aware of such information for debt collection purposes only.
Your data subject rights under the GDPR
Under the GDPR, data subjects have several rights – subject to certain exemptions:
The right to be informed: You have the right to be informed. We will inform you of the reason for processing your data when we first contact you.
The right of access: You have the right to access the personal information that we hold about you in many circumstances. This is sometimes called a ‘Subject Access Request’.
The right to rectification: If any of the personal information we hold about you is inaccurate or out of date, you may ask us to correct it.
The right to object: You have the right to object the processing of your personal information where we are relying on a Legitimate Interest and there is something about your situation, which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which overrides your rights and freedoms.
The right to erasure: This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your personal information to comply with the law. Please be advised that we may not always be able to comply with your erasure request for specific legal reasons.
The right to restrict processing: This enables you to ask us to suspend the processing of your personal information in the following scenarios: (i) if our use of the information is unlawful but you do not want us to erase it; (ii) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it; or (iii) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims.
For more information on your rights, please refer to the website of the Information Commissioner’s Office (ICO).
TRACE Debt Recovery UK Limited is registered with the ICO with reference ZA181609.
TRACE Enforcement Services is registered with the ICO with reference ZB110287.
To contact our appointed DPO please email [email protected]. Please note that guidance published on the Information Commissioner’s (ICO) website advises that you give us the opportunity to respond to you in writing via letter or email prior to you formally raising your concern with them.