Agree2Act - Privacy Notice

1. Who we are

Agree2Act Ltd is a debt collection business providing debt recovery and related account administration services to businesses and organisations. Agree2Act Ltd is registered in England and Wales under company number 12359467. Our registered office is:19–21 Swan Street, West Malling, Kent, ME19 6JU. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA708801. For the processing described in this Privacy Notice, Agree2Act Ltd is the data controller. This Privacy Notice explains how we collect, use, share and protect personal information in connection with our debt collection and related account administration activities, including information provided through the Agree2Act HelpHub.

  1. Personal information we may process

Depending on the circumstances, we may process:

  • your name, address and contact details;
  • date of birth and information used to verify your identity;
  • information about the account or amount referred to us for collection;
  • employment, payroll or overpayment information where relevant;
  • correspondence and records of communications;
  • payment and repayment arrangement information;
  • financial or affordability information;
  • information obtained for tracing or contact verification;
  • information relating to disputes, complaints or data protection requests;
  • information and documents you provide through HelpHub or otherwise in connection with your account; and
  • limited information concerning vulnerability, health or other personal circumstances where relevant.

We only seek to process personal information that is relevant and necessary for the purpose for which it is required.

  1. Where we obtain your information

In most cases, we initially receive your personal information from the organisation that has instructed us to recover or administer an outstanding account.

We may also obtain information:

  • directly from you, including information submitted through HelpHub;
  • from an authorised representative acting on your behalf;
  • from lawful tracing and verification sources;
  • from publicly available or official sources;
  • from payment service providers where necessary to identify or reconcile a payment; and
  • from other lawful sources where relevant to the administration of the account.

  1. Why we use your information

We may use your personal information to:

  • administer and recover outstanding accounts on behalf of our clients;
  • communicate with you about an account;
  • verify your identity and contact information;
  • manage payments and repayment arrangements;
  • consider financial circumstances where relevant;
  • respond to information or requests submitted through HelpHub;
  • investigate disputes, queries and complaints;
  • maintain accurate records;
  • establish, exercise or defend legal rights; and
  • comply with legal, regulatory and data protection obligations.

  1. Our basis for processing your information

Our principal lawful basis for processing personal information for debt collection and associated account administration is legitimate interests under Article 6(1)(f) UK GDPR.

Our legitimate interests, and those of our clients, include administering and recovering amounts considered to be due, communicating with the correct individual, maintaining accurate account records, managing payments and repayment arrangements, resolving disputes and complaints, and establishing, exercising or defending legal rights.

We consider whether the processing is necessary for these purposes and balance these interests against your interests, rights and freedoms.

We may also process personal information where necessary to comply with a legal obligation under Article 6(1)(c) UK GDPR.

  1. Vulnerability and special category information

You do not need to provide detailed medical information to discuss your account with us.

Where you provide information about a health condition or other special category information so that we can take your circumstances into account, we will seek your explicit consent before recording or using that information for that purpose.

Our Article 6 lawful basis for the underlying account administration remains legitimate interests. Where we rely on explicit consent to process special category information, the additional condition is Article 9(2)(a) UK GDPR.

We aim to record only the minimum information necessary to understand your circumstances and any assistance or adjustment that may be appropriate.

You may withdraw your consent to the processing of special category information at any time. Withdrawal does not affect processing carried out lawfully before withdrawal and does not prevent us from continuing to administer the underlying account where another lawful basis applies.

  1. Using HelpHub

HelpHub provides information and facilities that may assist you in communicating with us and managing matters relating to your account.

Where you provide personal information through HelpHub, we use that information for the purpose for which it was submitted and, where appropriate, as part of the administration of your account.

Information submitted through HelpHub may form part of your account record where it is relevant to the administration of your account.

  1. Who we may share your information with

We only share personal information where it is necessary and lawful to do so.

Depending on the circumstances, this may include:

  • the client that instructed us;
  • service providers supporting our business and debt collection activities;
  • tracing and verification providers;
  • approved debt collection partners;
  • professional and legal advisers;
  • courts, regulators, law enforcement bodies or public authorities where required or permitted by law; and
  • an authorised representative acting on your behalf.

Where another organisation processes personal information on our behalf, we require appropriate data protection arrangements to be in place.

  1. International transfers

Where collection activity is required outside the United Kingdom, it may be necessary to share relevant personal information with an approved debt collection partner in another country.

Where personal information is transferred outside the UK, we ensure that an appropriate legal basis and safeguards are in place as required by UK data protection law.

  1. How long we keep your information

We retain personal information only for as long as necessary for the purposes for which it was collected and to meet applicable legal, regulatory and business requirements.

Debt collection records will normally be retained for six years from the date the case is closed or the date of the last relevant contact or activity on the account, whichever is later.

Information may also be retained for longer where reasonably required in connection with legal proceedings, complaints, regulatory investigations, data protection matters or other legal obligations.

When personal information is no longer required, it will be securely deleted or anonymised in accordance with our retention procedures.

  1. How we protect your information

We maintain appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.

Access to personal information is restricted to authorised persons who require it for legitimate business purposes.

  1. Automated decision-making

We do not use automated decision-making in our debt collection activities where the decision produces legal or similarly significant effects on individuals.

  1. Your data protection rights

Depending on the circumstances, you may have the right to:

  • request access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • request erasure where the legal requirements are met;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • request data portability where applicable; and
  • withdraw consent where we rely on your consent.

These rights are not absolute and may be subject to exemptions or limitations under data protection law.

  1. Your right to object

Because our core debt collection processing is based on legitimate interests, you have the right to object to that processing on grounds relating to your particular situation.

This right is not absolute. We may continue processing where we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.

If you object, we will consider the circumstances of your objection and explain the outcome to you.

An objection to the processing of your personal information is separate from a dispute about whether an amount is due.

  1. Cookies and HelpHub

HelpHub may use cookies and similar technologies necessary for the operation and security of the website and, where applicable, for other purposes.

Further information about the cookies used, and the choices available to you, is provided in our Cookie Policy.

  1. Contacting us

If you have a question about this Privacy Notice, wish to exercise a data protection right, object to processing, withdraw consent for the processing of special category information, or have concerns about how we have handled your personal information, please contact:

Compliance / Data Protection
Agree2Act Ltd
Riverside House

River Lawn Road

Tonbridge

TN9 1EP

Email: compliance@agree2act.co.uk

We may need to verify your identity or authority before responding to a request.

  1. Complaints

If you are dissatisfied with how we have handled your personal information, please contact us so that we have an opportunity to investigate your concerns.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Further information about your data protection rights and how to make a complaint is available at www.ico.org.uk.

  1. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our activities, legal requirements or the way we process personal information.

The current version and effective date will be published on HelpHub. PNV040226