Arrow Global Massey
Complaints Policy

Arrow Global Massey Limited ("we/us/our") is committed to protecting and respecting your privacy and protecting your personal data. This notice sets out the basis on which any personal data we hold about you will be processed by us.

WHO WE ARE

Arrow Global Massey Limited is a firm of solicitors specialising in debt recovery. We act for various clients ("our clients") to recover outstanding debts, predominantly including pre-legal collections and litigation.

Our full details are below:

We comply with the Data Protection Act (DPA) 2018 and the General Data Protection Regulation (GDPR) and treat your data lawfully and transparently. This is for specific, explicit and legitimate purposes of both ours and our clients operations. In the course of our business, we will be provided with, obtain, share and store personal data. For the purposes of the Data Protection Act 2018 and the General Data Protection Regulation, in some circumstances we are the data controller (the company that controls the processing of the data) and in some circumstances, we are the data processor (the company that processes data on behalf of a data controller).

In the circumstances where we are the data processor, our client will usually be the data controller. Each of our clients will have their own privacy notice which will set out how they use your personal data. These can usually be found on their websites. Any correspondence that you receive from us will include the name of our client. As a data controller and data processor, we take all necessary steps to comply with our obligations under the data protection laws when handling any personal data.

If you would like further information about how we use your personal data (other than that which is detailed below), please address your query to the Data Protection Officer at the above address.

WHAT PERSONAL DATA DO WE USE AND COLLECT ABOUT YOU AND WHERE DO WE GET IT FROM?

We will collect and use the following information about you:

• Your name
• Your date of birth
• Your gender
• Contact details such as your address (and previous addresses), your telephone numbers
• Details about accounts held by you with our client, including balances, account numbers, payment history, dates when notices were sent to you and any other relevant information in respect of your accounts
• Details about your finances, including information about your regular income and expenditure, details of other debts that you hold, details of assets that you own, details available from Credit Reference Agencies and any other relevant information about your finances
• Details about your domestic life, including your family and dependants, where this is relevant to the matter that we are dealing with
• Your bank details, where you have provided these to us to allow payments to be taken
• Details about your employment
• Your National Insurance Number
• Recordings of telephone calls that we have with you
• Details of claims made by or against you
• Certain publicly available information, such as details of property that you own, details of business interests and details of criminal convictions
• Video images recorded on CCTV at our offices
• Certain special category data, where you have provided specific consent for this to be collected and processed - this will normally relate to health conditions that may affect your ability to communicate with us, or to repay a debt. Special category data can also include details in respect of ethnic origin, politics, religion, trade union membership, biometrics, health, sex life and sexual orientation

Where do we get your Personal Data from?

Personal data will have been / will be obtained from the following sources:

• Our clients will provide personal data to us (where data is provided to us by our clients, their name will be set out in any correspondence that you receive from us)
• Some data will be collected directly from you - this will usually be information which you provide to us when we speak to you on the telephone or correspond with you via email, or post
• Information may be obtained from you when you use our website
• Tracing agents and credit reference agencies
• Court Advocates
• Information provided during the litigation process, including information provided as part of the disclosure process, in witness statements, during mediation, or in hearings
• Public sources, such as information which is available on the internet, at the Land Registry and at Companies House
• Calls to and from our business may be recorded for quality and training purposes
• Our office operates CCTV, so visitors to our office may be recorded on CCTV

HOW DO WE USE PERSONAL DATA?

We will use personal data that we hold in the following ways:

• To perform our contractual obligations with our clients
• To communicate with you
• To administer accounts on behalf of our clients, predominantly for the purposes of arrears management and debt recovery
• To consider relevant circumstances when making decisions about progression of cases
• For the purposes of data matching (where the data is compared to other data sources to check its accuracy and to assist in decision making) and data combining (where the data is combined with other data already held about you)
• To provide debt collection and legal services to our clients and to prospective clients
• To serve legal proceedings and notices on behalf of our client
• To deal with complaints, queries and claims
• To locate you and confirm your identity
• To review the accuracy of the data that we holdv
• To monitor quality and improve our services through review/audit of cases
• To comply with our legal and regulatory obligations
• To comply with our obligations under anti-money laundering legislation
• For other purposes required by law, such as where we are required to provide data to law enforcement agencies
• To establish, exercise and defend our legal rights

WHO DO WE SHARE PERSONAL DATA WITH?

In the course of our business, we will sometimes need to share personal data with other organisations including the following:

• Our clients and (where applicable) their predecessors
• Tracing agents
• The Court
• Mediators
• Court advocates
• Process servers
• Credit reference agencies
• Other parties in legal proceedings
• Carefully selected suppliers who provide services to us such as IT and mailing
• Debt management agencies and legal advisers who are instructed by you
• Third parties that you have authorised to deal with matters on your behalf
• Other parties that have an interest in a property that you have an interest in
• The police and/or other law enforcement agencies
• Our professional advisors, insurers, auditors, service providers, regulators, governmental; and law enforcement agencies

WHO DO WE SHARE PERSONAL DATA WITH?

In the course of our business, we will sometimes need to share personal data with other organisations including the following:

• Our clients and (where applicable) their predecessors
• Tracing agents
• The Court
• Mediators
• Court advocates
• Process servers
• Credit reference agencies
• Other parties in legal proceedings
• Carefully selected suppliers who provide services to us such as IT and mailing
• Debt management agencies and legal advisers who are instructed by you
• Third parties that you have authorised to deal with matters on your behalf
• Other parties that have an interest in a property that you have an interest in
• The police and/or other law enforcement agencies
• Our professional advisors, insurers, auditors, service providers, regulators, governmental; and law enforcement agencies

WHAT ARE OUR GROUNDS FOR PROCESSING PERSONAL DATA?

Use of personal data as outlined in this notice is subject to different legal bases for processing;

• The processing is necessary for the purposes of legitimate interests as set out below:
  • It is in our clients' commercial interest for debts to be collected on their behalf
  • It is in our clients' customers' interest that they are contacted about repayment of their debt
  • It is in the public interest for outstanding debts to be repaid as this helps to keep down the cost of borrowing
• Some processing is necessary to comply with legal and regulatory obligations to which our clients and ourselves are liable - this can include the following:
  • Where we are required to process certain data to ensure that we comply with regulatory requirements, such as considering details in respect of affordability and vulnerability in order to comply with our obligations to the Financial Conduct Authority
  • Where we are required to disclose details in order to comply with legal obligations such as anti-money laundering and counter-terrorism legislation and where we are required to provide information to law enforcement agencies
• The processing is necessary for the performance of a contract - this can include the following:
  • Where we are processing data about our clients or their staff in respect of a contract or a prospective contract
  • Where we are processing data about our staff
• Where we have obtained consent from the data subject

CALL RECORDING

Calls are recorded for regulatory compliance, training and quality purposes and may be shared with our clients, regulators and professional advisors.

HOW DO WE STORE PERSONAL DATA?

Arrow Global Massey is a member of the Arrow Global Group ("AGG" and / or "Arrow"), headquartered in the UK. As a result of Brexit, with effect from 1 January 2021, the UK stopped being treated as part of the European Union and the European Economic Area ("EEA") and, as a result, your personal data will be protected by UK privacy laws from that date. Looking after your data is very important to us, and Brexit will not change that.

We will only share personal data with others outside the EEA (before 1 January 2021) or outside the UK (from and after 1 January 2021) when we are legally permitted to do so, namely where:

• the EU Commission or UK government (as relevant) has decided that the relevant country has adequate protective rules in relation to data protection in place (an "adequacy decision");
• we have entered into the relevant "standard contractual clauses" with the recipient of your personal data (these are a set of obligations about how your data is protected and used); or
• we can rely on another basis under the law such as that we have to share the personal data because this is necessary for the purpose of a court case, investigation or to protect our legal rights.

YOUR RIGHTS

You have various rights in respect of your personal data, which are set out below:

• Right to be informed - you have a right to be informed how we obtain and use your data - such information is contained in this notice
• Right of access - you can ask for a copy of the data that we hold about you
• Right of erasure - you may ask us to delete information we hold about you in certain circumstances
• Right to request that the processing of data is restricted - you have a right to request that what we use the data for is restricted
• Rights relating to automated decision making - unless authorised by law, we are not able to use your data to make significant decisions based solely on automated processing - if you believe that we have made a significant decision in this manner you are able to request that we reconsider the decision or make a new decision not based solely on automated processing
• Right of rectification - you have a right to have inaccurate information that we hold about you corrected, or incomplete information which we hold about you completed
• Right to object - you have a right to object to the processing of your personal data
• Right to data portability - in certain circumstances, you have the right to obtain your data so that it can be used for different purposes

If you wish to exercise any of the above rights, you should contact using the contact details at the head of this notice. Please address any correspondence to the Data Protection Officer. Some of the above rights are only available in certain circumstances. If you request to exercise one of the above rights and we do not believe that you are entitled to do this, we will tell you why.

COMPLAINTS

In the event that you are unhappy with how we are using your personal data, or with how we have dealt with any request that you have made in respect of your data, you may make a complaint. Please submit any complaints using the following contact details and address it as follows;

Once we have responded to your complaint, if you are unhappy with the outcome, you have the right to refer your complaint to the Information Commissioner's Office - their details are below:

CHANGES TO THIS NOTICE

This Privacy Notice will be reviewed regularly and where necessary will be updated to ensure that the information contained in it is up to date and accurate.

Version 1 05/2024