Debtor Privacy Notice

1. Introduction

Credvanta Recovery Group Limited (“Credvanta”) is a company incorporated and registered in England and Wales under company number 17251971, with its registered office at:

5 Canon Court
Institute Street
Bolton
BL1 1PZ
England

For all operational, trading and correspondence purposes, Credvanta conducts business from:
Credvanta Recovery Group Limited
Suite 2/3
48 West George Street
Glasgow
G2 1BP

References in this Privacy Notice to “Credvanta”, “we”, “us” or “our” mean Credvanta Recovery Group Limited.

Credvanta is committed to protecting the privacy and security of personal information processed during the course of providing commercial business-to-business (B2B) debt recovery services.

This Debtor Privacy Notice explains how we collect, use, store, share and protect personal information relating to individuals connected with commercial debts, including company directors, officers, shareholders, partners, guarantors, employees and authorised representatives.

Credvanta undertakes commercial business-to-business (B2B) debt recovery activities only and does not undertake any regulated activity.

Credvanta processes your personal information as part of providing commercial debt recovery services on behalf of the Creditor that has instructed us.

2. Who We Are

Credvanta Recovery Group Limited is the data controller for the purposes of this Privacy Notice.

If you have any questions regarding this Privacy Notice or wish to exercise your data protection rights, please contact:

Legal and Compliance Team
Email: Legal@credvanta.co.uk
Telephone: 0800 975 7066

3. Types of Information We May Collect

Depending upon the circumstances, Credvanta may collect, process and store information including:

Personal Information

• Full name;
• Job title or position;
• Business contact details;
• Telephone numbers;
• Mobile numbers;
• Email addresses;
• Business and correspondence addresses;
• Date of birth where reasonably necessary;
• Director, partner or officer information.

Business & Financial Information

• Company name;
• Company registration number;
• Invoice information;
• Outstanding balances;
• Payment history;
• Communication records;
• Banking or payment details where relevant to recovery activity;
• Account references;
• Payment arrangement information.

Technical Information

• IP addresses;
• Device information;
• Browser information;
• Website usage information;
• Cookie information;
• SMS delivery records;
• Email delivery records;
• Call recordings.

Recovery Activity Information

• Recovery notes;
• Case management records;
• Trace and locate information;
• Field visit records;
• GPS or location information connected with field visits;
• Photographs where reasonably necessary;
• CCTV or body-worn camera footage where used for evidential, compliance or safety purposes.

4. How We Collect Information

We may obtain information from:

• Our Clients;
• The Debtor;
• Authorised representatives;
• Companies House;
• Credit reference agencies;
• Identity verification providers;
• Trace and locate agencies;
• Publicly available records;
• Public registers;
• Open-source intelligence;
• Publicly available online information;
• Social media where information has been made publicly available;
• Telephone calls;
• Emails;
• SMS messages;
• Letters;
• Website forms;
• Payment processors;
• Banking providers; and
• Other lawful third-party sources where reasonably necessary.

5. How We Use Your Information

Credvanta may process information for purposes including:

• Commercial debt recovery activity;
• Contacting Debtors and authorised representatives;
• Verifying identity and business information;
• Preventing fraud and misuse;
• Assessing vulnerability where appropriate;
• Managing payment arrangements;
• Receiving, administering, reconciling and allocating payments made in connection with debts recovered on behalf of our Clients;
• Compliance monitoring;
• Maintaining accounting records;
• Record keeping;
• Tracing and locate activity;
• Preparing matters for legal review or referral;
• Instructing trusted independent partner law firms where authorised by the Creditor;
• Protecting staff safety and operational security;
• Investigating complaints or disputes; and
• Complying with our legal, contractual and regulatory obligations.

Payment Information

Where you make a payment using Credvanta’s authorised payment facilities, we process payment information for the purposes of:

• Receiving and administering your payment;
• Allocating payments to the appropriate Creditor account;
• Reconciling payments received;
• Preventing fraud, financial crime and unauthorised transactions;
• Complying with legal, contractual and accounting obligations;
• Maintaining accurate accounting and reconciliation records; and
• Facilitating onward settlement to the Creditor.

Credvanta does not use payment information for marketing purposes.

6. Legal Basis for Processing

Credvanta processes personal information using one or more lawful bases under UK data protection legislation, including:

• Legitimate interests;
• Performance of a contract;
• Compliance with legal obligations; and
• Where applicable, consent.

Our legitimate interests include:

• Recovering outstanding commercial debts;
• Protecting the legitimate interests of our Clients;
• Preventing fraud and financial crime;
• Protecting our staff;
• Maintaining accurate business records;
• Tracing individuals connected with commercial debts;
• Investigating complaints;
• Conducting lawful commercial debt recovery activities.

Where reasonably necessary, Credvanta may undertake:

• Soft trace checks;
• Identity verification;
• Director verification;
• Credit-related searches where lawful;
• Fraud prevention checks;
• Sanctions screening; and
• Other compliance checks required for legitimate commercial purposes.

7. Communications & Call Recording

Credvanta may communicate with individuals by:

• Telephone;
• Mobile telephone;
• SMS;
• Email;
• Letter;
• Secure online portals; and
• In-person visits where appropriate.

Telephone calls may be recorded for:

• Training;
• Quality assurance;
• Compliance monitoring;
• Evidential purposes;
• Staff safety;
• Complaint investigation; and
• Fraud prevention.

We may also retain email correspondence, SMS records, online chat records, portal communications and communication logs.

8. Field Visits & Monitoring

Where field visits are undertaken, Credvanta representatives may:

• Create written visit notes;
• Record visit outcomes;
• Capture GPS or location information;
• Take photographs where reasonably necessary;
• Use body-worn cameras;
• Use CCTV or other recording equipment for safety, evidential or compliance purposes.

Any monitoring activity will be proportionate and undertaken only where reasonably necessary for legitimate business purposes.

9. Tracing & Locate Activity

Where reasonably necessary for the recovery of commercial debts, Credvanta may undertake trace and locate activity to obtain or verify business or contact information.

This may include the use of:

• Companies House records;
• Credit header information;
• Public registers;
• Trace and locate agencies;
• Identity verification providers;
• Open-source intelligence;
• Publicly available online information; and
• Social media where information has been made publicly available.

Credvanta undertakes tracing activity only where reasonably necessary and proportionate for the legitimate purpose of recovering commercial debts and administering instructed recovery matters.

10. Data Sharing

Credvanta may share personal information where reasonably necessary and proportionate with:

• The Creditor who instructed the recovery activity;
• Payment processors;
• Banking providers;
• Appointed independent partner law firms;
• Tracing and locate agencies;
• Identity verification providers;
• Fraud prevention agencies;
• CRM and case management software providers;
• Email, SMS and communications providers;
• Telephone system providers;
• IT hosting and cloud service providers;
• Professional advisers, including accountants and auditors;
• Insurers;
• Regulatory authorities;
• Law enforcement agencies;
• Public authorities where required by law; and
• Any other third party where disclosure is necessary to recover a commercial debt, comply with a legal obligation, or protect the legitimate interests of Credvanta or its Clients.

Credvanta will only share personal information where there is a lawful basis to do so and where appropriate contractual and security measures are in place.

Credvanta does not sell personal information to third parties.

11. Payment Processing & Client Money

Where payment is made using Credvanta’s authorised payment processing facilities, Credvanta receives and administers such payments solely in its capacity as the Creditor’s authorised commercial debt recovery and collection agent.

Payments received are processed for the purposes of:

• Allocating payments to the relevant Creditor;
• Reconciling receipts received from payment providers and banking partners;
• Maintaining accounting and reconciliation records;
• Preventing fraud and financial crime;
• Complying with legal and contractual obligations; and
• Facilitating onward settlement to the Creditor in accordance with Credvanta’s contractual arrangements.

Recovered monies are administered in accordance with Credvanta’s Service Agreement, Terms & Conditions and Client Service Acceptance & Authorisation.

Credvanta maintains appropriate accounting and reconciliation records relating to all payments received, reconciled, deducted and remitted.

Payment records are retained only for as long as reasonably necessary to comply with contractual, legal, accounting and regulatory obligations.

12. International Data Transfers

Some of Credvanta’s service providers may process or store personal information outside the United Kingdom.

This may include providers connected with:

• Microsoft 365;
• Google Workspace;
• Twilio;
• OpenAI; and
• Zoho CRM and other Zoho Eco System Products;
• Other cloud-based infrastructure or software providers used in connection with our business operations.

Where international transfers occur, Credvanta will take appropriate steps to ensure suitable safeguards are in place in accordance with applicable UK data protection legislation.

13. Website Cookies & Online Tracking

Credvanta’s websites may use cookies, analytics technologies, Google Ads, Meta Pixel, reCAPTCHA, website monitoring technologies, live chat functionality and other technologies necessary for website security, functionality and performance. These technologies may collect technical and behavioural information relating to your interaction with our websites. Further information is available in Credvanta’s Cookie Policy.

14. Data Retention

Credvanta retains personal information only for as long as reasonably necessary for the purposes for which it was collected.

Unless a longer retention period is required or permitted by law, Credvanta may retain recovery files, communication records, emails, call recordings, SMS records, payment records, accounting records, complaint files, trace information, compliance records and audit records for at least six (6) years where reasonably necessary for legal, contractual, accounting, compliance, evidential or legitimate business purposes.

Information may be retained for longer where required by ongoing legal proceedings, Court Orders, fraud investigations, regulatory investigations, enforcement activity, insurance requirements or other legal obligations.

15. Data Security

Credvanta implements appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures include, where appropriate: access controls, encryption, secure cloud storage, multi-factor authentication, staff training, system monitoring, audit logging and secure disposal procedures.

Whilst Credvanta takes reasonable steps to protect personal information, no electronic transmission or storage system can be guaranteed to be completely secure.

16. Your Rights

Subject to applicable law, individuals may have rights including:

• The right to access personal information;
• The right to request correction of inaccurate information;
• The right to request restriction of processing;
• The right to object to certain processing;
• The right to request erasure in limited circumstances;
• The right to data portability where applicable; and
• The right to withdraw consent where processing is based upon consent.

Requests should be submitted to:
Legal Department
Email: Legal@credvanta.co.uk

Credvanta may request reasonable evidence of identity before responding to any request. Credvanta reserves the right to refuse or limit requests where permitted under applicable law, including where a request is manifestly unfounded, excessive, repetitive, or where an exemption applies under UK data protection legislation.

17. Complaints

If you have any concerns about how Credvanta has processed your personal information, please contact:

Legal Department
Email: Legal@credvanta.co.uk
Telephone: 0800 975 7066

Alternatively, you may submit a complaint in accordance with Credvanta’s Complaints Handling Policy. If you remain dissatisfied, you may have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

18. Changes to This Privacy Notice

Credvanta reserves the right to amend this Debtor Privacy Notice from time to time to reflect changes in legislation, regulatory guidance, business practices or operational requirements. The most current version of this Privacy Notice will always be made available on request and, where applicable, via Credvanta’s website. Continued interaction with Credvanta following publication of an updated Privacy Notice shall constitute acknowledgement of the revised version to the extent permitted by applicable law.