1. Introduction

Newlyn PLC is registered with the Information Commissioners Office (ICO) as the data controller under registration number Z7559829 and have held this licence since 16 January 2003. Our registered address is Century House, Wargrave Road, Henley-On-Thames, Oxfordshire, RG9 2LT.

Newlyn PLC are committed to safeguarding the privacy of all data obtained for the collection of outstanding debts such as Council Tax, Non-Domestic Rates and Parking contraventions.

2. About this Notice

This Privacy Notice explains what personal data we collect and how it is used. This notice also explains what rights you have over your personal data and how you can use those rights.

This notice applies where Newlyn PLC are acting as the ‘data controller’ with respect to the personal data of its employees; where Newlyn PLC determines the purposes and means of the processing of that personal data.

This notice also applies where Newlyn PLC act as either the ‘data processor’ and/or ‘data controller’ with respect to the personal data of ‘data subjects’; where the Data Controller determines the purposes and means of the processing of that personal data.

3. Personal data we obtain from others or collect from you

We obtain or collect your personal information through various means, such as from:

• Local authorities (data controller)
• You; through our interactions with you (data subject)
• Appointed representatives i.e. not the data subject (data processor)
• Enforcement Agents (data controller and processor)
• Our products and services (sub processors) used to assist with the collection of outstanding debts

Other data is collected through email or other electronic correspondence, by telephone, by direct contact, or if you voluntarily submit it. We only collect information that is relevant to our services and necessary to identify you.

The information we collect is listed below:

• Contact information such as Full name, home address, address history, email address, home and mobile telephone numbers.
• Date of birth
• Financial Details e.g. income and expenditure details to establish circumstances for repayment options
• Information from Credit Reference Agencies, electoral roll, court records of judgments and bankruptcies and other publicly available sources.
• Family, lifestyle, or social circumstances (normally obtained during the income and expenditure procedure to help ascertain your circumstances, namely your financial circumstances)
• Employment details, status (normally obtained during the income and expenditure procedure to help ascertain your circumstances, namely your financial circumstances)
• Personal data of any appointed representative acting on your behalf to verify who they are; name, address, relationship to you.
• Visual and audio images of you through our use of Body Worn Video and audio recording equipment
• Personal data collected arising from debt collection and enforcement processes, some of which may include sensitive personal data relating to physical or mental health and incidents which may occur during a debt enforcement visit.
• IP Address
• LinkedIn or Facebook
• Complainants and other individual’s information in relation to a judicial service complaint or enquiry
• HPI (Hire Purchase Insurance) Check
• Vehicle registration keeper details
• Information you provide for a job application e.g. name and contact details, curriculum vitae, covering letter, references etc.

Newlyn also obtain additional personal or ‘sensitive’ personal data throughout the processes and procedures for collecting outstanding debts. Additional ‘sensitive’ personal data which has not already been supplied by the data controller but obtained by Newlyn PLC as the data processor such as; Physical or Mental Health Conditions, Criminal Proceedings, outcomes and sentences.

We are required to understand whether the people that we deal with could be regarded as vulnerable and this may involve collecting and using sensitive personal data. We will ask you for some sensitive details or you may voluntarily give such personal data to us and we will only use this information for debt collection purposes. We will obtain your consent to process this data and on occasions will be required to share the sensitive personal data with the client (local authority) to ensure your case is managed appropriately.

Any such data will be obtained for regulatory compliance, self-regulatory practices, crime prevention and detection, for quality control and staff training justified by our legitimate interests or legal obligations.

4. Personal information collected via online forms (from you, the Data Subject)

Our policy is to respect and protect the privacy of anyone who visits the Newlyn website. Where we ask you for personal information via an online form, this information will only be used for the purpose indicated and will be held in a secure manner. It will not be used for any other purpose without your permission and will not be kept for longer than necessary (see section 10).

5. How we use your personal data

All personal information is stored securely and in accordance with the principles of the Data Protection Act 2018 and the EU General Data Protection Regulation.

Newlyn PLC use your data to provide the best possible services to you and to fulfil their legal obligation to staff and enforcement agents acting on their behalf. This includes:

1. Supplying services to you on behalf of our clients
2. Personalising and tailoring services for you
3. Responding to communications from you, including any complaints
4. Enabling payments to be made by debtors on behalf of the clients
5. Sharing information about incidents occurring at the doorstep to protect the health and safety of the individuals involved with debt enforcement visits
6. Collecting information (where appropriate) on the vulnerability of individual customers who they are collecting or enforcing debts against, to ensure that they are treated fairly.
7. Research and statistical projects in which we are involved from time to time.

6. Purposes for processing your personal data

We will process your data as necessary to manage and maintain your account until the outstanding debt has been paid.

• We will maintain and keep up-to-date accurate records of you and to verify your identity
• We will use credit reference agencies to trace your whereabouts so that we can obtain contact regarding your account(s) to recover the debts.

The credit reference agencies (CRAs), in conjunction with the ICO and major financial services trade associations, developed a common form of privacy notice. The aim of this notice (known as CRAIN) was to ensure that the data sharing and the CRAs’ processing activities are transparent to consumers, in line with the GDPR’s requirements.

Each CRA has produced its own version of this notice.

The notice developed by TransUnion is available at the following URL https://www.transunion.co.uk/legal/consumer-centre

• We will enforce Liability Orders or Warrant of Control orders via certificated Enforcement Agents
• Enforcement Agents will maintain a log and audit of all visits made to your property via the use of and storage of Body Worn Video cameras
• We will process payments in line with PCI DSS guidelines and allocate these to your account(s)
• We will use Automatic Number Plate Recognition (ANPR) technology for automatically reading vehicle number plates.
• Calls are recorded for training purposes and for the analysis and management of internal staff performance. Call recordings may be reviewed also as part of a Complaint investigation. The use of this information assists with the improvement of our efficiency and effectiveness.
• We will store all correspondence (letters, emails, text messages, documentary evidence etc.) in relation to any dealings with you for effective file management and for use in any necessary legal proceedings.
• Research and statistics, where we partner with a research body/trade industry body such as the Enforcement Conduct Board (“ECB”), to assist the body in carrying out research into the industry, this may involve us sharing anonymised and/or pseudonymised BWV footage with a research company for them to analyse.

7. Legal basis for Processing your personal data

We will process your personal information as necessary to manage and perform a contract with local authorities:

1. To update your records
2. To trace your whereabouts to contact you about your account and recover the debt
3. To enforce a Liability Order or Warrant of Control
4. To recover outstanding monies owed

We will process your personal information for legitimate interests, a legitimate interest is when we have a business or commercial reason to use your data, such as:

1. We will monitor emails, calls, other communications and activities on your account(s)
2. For analysis and developing statistics
3. Data profiling – automated decision-making involving processing your personal data without human intervention to develop and improve upon our processes
4. For good governance, accounting, managing and auditing business operations
5. For compliance and regulatory requirements and related disclosures.

We will process your personal information based on legal obligation:

1. When you exercise your rights under data protection law and make subject access requests.
   For compliance with legal and regulatory requirements and related disclosures
2. For establishment and defence of legal rights
3. For activities relating to the prevention, detection and investigation of crime
4. To verify your identity and make anti-money laundering checks

We will process your personal information based on consent:

1. When you make a request to disclose your personal data to other people or organisations such as a company handling my account on my behalf or a discuss with (family member)
2. When we process any special category of personal data about you at your request (such as race, ethnic origin, political opinions, religious beliefs)

You are free to change your mind and withdraw your consent to points K and l above at any time.

8. Data Sharing

Newlyn PLC will share your personal data with your consent or as necessary to recover the outstanding debt;

1. We will sometimes contract with third parties to supply services to you on our behalf. These include payment processing, correspondence management and mailing, tracing agents. In some cases, the third parties will require access to some or all your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely and in accordance with your rights, our obligations and the obligations of the third party under the law.
2. We will also sometimes contract legal and other professional advisors such as Solicitors or legal representatives or auditors. In some cases, the third parties may require access to some or all your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely and in accordance with your rights, our obligations and the obligation of the third party under the law.
3. In certain circumstances we will be legally required to share certain data held by us, which will include your personal information, for example, where we are involved in legal proceedings, where we are complying with the requirements of legislation, a court order, or a governmental authority. We do not require any further consent from you to share your data in such circumstances and will comply, as required, with any legally binding request that is made of us.
4. When we investigate a complaint, we may be required to share personal information with the organisation you have an outstanding debt with and with other relevant government bodies e.g. the Civil Enforcement Association (CIVEA) or the Information Commissioners Office (ICO).
5. We will share personal information with our enforcement agents to deliver the liability order or warrant of control.
6. We will only transfer data outside the European Economic Area (EEA), to third countries or international organisations where the organisation receiving the data has provided adequate safeguards.
7. For some activities Newlyn uses third party service providers, such as CCTV system provision and maintenance, IT development, support, maintenance and hosting, including the provision of applications and website hosting.

If our business is to be integrated with another business or sold, your details would be shared with our advisors and any prospective purchaser’s advisers. Your information will be passed to the new owners and you would be notified.

9. Cookies and IP addresses

We collect IP addresses only for the purposes of system administration and to audit the use of our site. We do not link IP addresses to anything personally identifiable, which means that while your user session will be logged you will remain anonymous to us.

We use cookies to audit the use of our website and help us to customise the website for your visit. We do not store or transmit any personally identifiable data on these cookies. You can change your cookie policy at any time in the security settings in the browser you use to access the internet. Please note however, that rejecting all cookies may impact your use of this website.

Please note, where we use BWV footage for research purposes, some of your rights stated above may not apply in relation to such uses – in particular, where we rely on the research and statistics exemption under the Data Protection Act 2018, as this disapplies such rights.

10. Data Retention

We keep your data to enable us to fulfil our contract with the UK local authorities, where required by law or to protect legal rights. For example, we will keep your personal data for a minimum of 6 years from the date of account closure for legal purposes and will keep financial records for a minimum of 7 years for accounting and tax purposes.

11. Your rights under the GDPR

Under the Data Protection legislation, data subjects have the following rights with regards to their personal information:

• the right to be informed about the collection and the use of their personal data
• the right to access personal data and supplementary information
• the right to have inaccurate personal data rectified, or completed if it is incomplete
• the right to erasure (to be forgotten) in certain circumstances
• the right to restrict processing in certain circumstances
• the right to data portability, which allows the data subject to obtain and reuse their personal data for their own purposes across different services
• the right to object to processing in certain circumstances
• rights in relation to automated decision making and profiling
• the right to withdraw consent at any time (where relevant)
• the right to complain to the Information Commissioner

Some rights however, may be limited. We may be obliged by law or regulation to keep information. We must also respect other people’s privacy which means we may need to redact or remove information where it includes personal information about someone else, even if it is connected to you and your information. On occasion there may be a compelling legitimate reason to keep processing data.

If you have any queries regarding your rights, wish to object to how we use your data, or ask us to delete or restrict how we use your information, please contact the DPO as detailed in section 12.

If you wish to make a request for a copy of the personal information we hold about you, please send your ‘Subject Access Request’ to Newlyn PLC, PO BOX 933, Northampton, NN1 9DX or email contact@newlynplc.co.uk.

To process a request from you, we may need to confirm your identity to ensure we are accessing the right data.

12. How to complain if you are unhappy about the use of your personal data

Should you have any queries relating to this privacy notice, please contact the Data Protection Officer (DPO) via email: dataprotectionofficer@newlynplc.co.uk or in writing to: DPO, Newlyn PLC, PO Box 933, Northampton, NN1 9DX.

Should you remain not satisfied with our data processing purposes and procedures, you have the right to complain to the data protection Supervisory Authority of the UK who is the Information Commissioners Office (ICO). You can contact them at the details below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 111313

13. Changes to this Notice

We will update, change or add to this privacy notice in the future so please ensure you check back from time to time so that you remain happy with the changes and the way in which we process your personal data.

This notice was last updated and published on 11.03.2024.