How your personal data will be used
Your personal data will be stored and used for the purposes of collecting the outstanding balance from you. It may also be combined with other data relating to you and which we may obtain from third parties, where it is deemed necessary for verifying the accuracy of the data and/or for the purposes of collecting the outstanding balance. In this respect, we may access third party data sources and combine and process data from those sources with your personal data. Such third party data sources may include the Land Registry, registers of court judgments and bankruptcies, postcode lookup databases, telephone number verification databases and credit reference agencies (CRAs). We may access and analyse personal data relating to you provided to us by the CRAs. This may include details of your current and future indebtedness to other creditors and/or your payments against those debts. Our investigations may leave a “soft footprint” on your records at the CRAs. This “soft footprint” will indicate that we have made a search but will normally be visible only to you but not to any current or future creditor.
We will endeavour to keep your personal data accurate and up to date and not keep it for longer than is necessary. We will normally keep your data for 6 years from the date no further monies are owed to us.
We may pass your personal data onto the agencies that provide services to us including debt collection agencies, solicitors and tracing agents. These agencies are obliged to keep your details securely and use them only to fulfil instructions provided by us.
We may also pass to and share your personal data with CRAs. This data normally remains on the CRAs’ files for 6 years after the account shows as “defaulted”. Please note:
- If this account is currently reported to any CRA, then we may continue to report this account with the relevant CRA;
- We may report this account with any CRA, to which it may not have previously been reported.
- If you pay your account in full, then we will update all existing reports of this account as “settled” or “satisfied”; and
- You should be aware that the existence of this default information, particularly defaults which are not marked as “settled” or “satisfied” may adversely affect your ability to obtain credit in the
Subject to our obligations under the Data Protection Act 1998, we may share your personal data with others where: we have your permission; we have to do so or are allowed to do so by law; we have a duty to reveal the information; or where our legitimate interests mean we can share the information. We may also process your personal data, for the purposes set out above, outside the European Economic Area, provided that appropriate security measures are in place.
What is Personal Data? Under the Data Protection Act 1998, Personal Data is defined as data that relates to a living individual who can be identified:
- from those data, or
- from those data and other information which is in the possession of, or likely to come into the possession of, the data controller, and includes any expression of opinion about the individual, and any indication of the intentions of the data controller or any other person in respect of the
Personal data will therefore cover at least basic details such as name, address, telephone number, and date of birth.
What is Sensitive Personal Data? Certain data are classified under the Data Protection Act 1998 as ‘sensitive personal data’, for example:
- Racial or ethnic origin
- Religious or other beliefs of a similar nature
- Physical or mental health or condition
- Sexual life
- Offences (including alleged offences)
It is unlikely that JCIA will process any sensitive personal data relating to you. The exceptions may be where you (or someone acting on your behalf) provide us with information on your physical or mental health or offences in the course of our dealings with you. We will not pass your sensitive personal data onto a third party (other than agencies instructed to assist in collecting the outstanding balance as set out above) unless we have your consent to do so or unless we are legally required to do so.
Inaccurate Data and Subject Access Requests – Your rights
You have the right to know what personal data about you we may process (this is called a “Data Subject Access Request”). You may also, where the personal data is inaccurate or incomplete, request that we update your personal data accordingly. Should you wish to make a Data Subject Access Request please write to: Data Protection Officer, JCIA, Midpoint, 5ht Floor, Alencon Link, Basingstoke, Hampshire. RG21 7PP. You should enclose payment of the fee (currently £10.00). Please note: As stated above, we may appoint agencies that provide services to us including debt collection agencies, solicitors and tracing agents and who may contact you directly. Please do not send Data Subject Access Requests to these organisations if you wish to know what personal data about you we may process. These organisations are merely acting on our behalf and you should continue to submit such Data Subject Access Requests to us. If you send a Data Subject Access Request to these other organisations, then there may be a significant delay in our responding to you.