1. Who we are
Refresh Debt Services Ltd (“Refresh”, “we”, “us”) is the data controller for the personal information described in this policy. We are registered in Northern Ireland under company number NI055582, authorised and regulated by the Financial Conduct Authority (FRN 674160), and registered with the Information Commissioner’s Office (ICO registration Z9114806).
Our registered office is Milltown House, Milltown Industrial Estate, Warrenpoint, Co. Down, BT34 3FN. Our Data Protection Lead can be contacted at info@refreshdebt.co.uk or at the address above.
2. What this policy covers
This policy explains how we collect, use, share and protect your personal information when you visit our website, submit a web form, contact us, or become a client. It also explains your rights and how to exercise them. We may give you additional privacy information at the point we collect specific data, for example when you sign your debt management plan documents.
3. The information we collect
Information you give us
- Identity and contact details: name, date of birth, address and previous addresses, email address, phone number and WhatsApp number.
- Financial details: your income, expenditure, creditors, balances, account references, bank details and payment card details (used to collect your plan payments).
- Identity documents where we need to verify who you are.
- Details of your circumstances that affect your debt position, including household information.
- Anything else you tell us in web forms, emails, messages or calls.
Information we collect automatically
- Device and usage information when you use our website: IP address, browser type, pages visited and how you arrived at the site.
- Cookies and similar technologies (see section 12).
- Call recordings: calls to and from us are recorded for training, quality and record-keeping purposes. We tell you at the start of a call that it is being recorded.
Information we receive from others
- From the organisation that introduced you to us, if you were referred by a debt advice or introducer firm.
- From Valid8 IP Ltd and the credit reference agencies it works with (Equifax, Experian, TransUnion), when we verify your identity and run a soft credit search with your consent. A soft search does not affect your credit score.
- From your creditors, in the course of setting up and running your plan.
- From Companies House, the electoral register and public sources where needed to verify information.
Special category information
Sometimes you may tell us about your health, or another sensitive matter, because it affects your finances or how we should support you. We only record this with your explicit consent, or where the law allows us to in order to support you appropriately and meet our regulatory obligations to treat customers fairly. We keep it only for as long as it is relevant.
4. How we use your information and why we are allowed to
Data protection law requires us to have a lawful basis for each use of your personal information. The table below sets out what we do and the basis we rely on.
| What we use it for | Lawful basis |
|---|---|
| Responding to your enquiry and assessing whether a debt solution is suitable for you | Taking steps at your request before entering a contract; our legitimate interest in running our business |
| Verifying your identity and running a soft credit search through Valid8 IP Ltd | Your consent, given before the search is run |
| Setting up and administering your debt management plan, including contacting creditors, collecting and distributing payments, and reviewing your plan | Performance of our contract with you |
| Meeting our obligations as an FCA-regulated firm, including record-keeping, complaints handling, financial crime checks and reporting to regulators | Legal obligation |
| Communicating with you about your plan by phone, email, SMS, post and WhatsApp | Performance of our contract; your consent for WhatsApp |
| Recording calls | Our legitimate interest in training staff, resolving disputes and evidencing advice given |
| Monitoring accounts to identify clients whose plans may be at risk, so we can offer support early | Our legitimate interest in maintaining plans and our regulatory duty to deliver good outcomes for customers |
| Improving our website and services, and understanding how visitors use the site | Our legitimate interest; your consent for non-essential cookies |
| Sending you marketing about our services | Your consent, or the “soft opt-in” for existing clients; you can opt out at any time |
| Protecting our business, systems and clients from fraud and misuse | Our legitimate interest; legal obligation |
Where we rely on legitimate interests, we have assessed that our use of your data is necessary and does not override your rights. You can ask us for details of that assessment.
Automated decisions. We use analysis of account data to flag plans that may need attention. These flags are reviewed by a member of our team; we do not make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.
5. Marketing
We will only send you marketing by email, SMS or WhatsApp if you have agreed to it, or if you are an existing client and the message is about services similar to those you already use. Every message includes a way to opt out, and you can also opt out at any time by emailing info@refreshdebt.co.uk. We do not share your details with other organisations for their marketing.
6. WhatsApp
If you give us your WhatsApp number and agree to it, we may message you on WhatsApp with service updates, reminders and requests for information. Our WhatsApp messaging is delivered through the WhatsApp Business Platform via 360dialog, a service provider acting on our instructions. You can withdraw consent to WhatsApp contact at any time by replying STOP or emailing info@refreshdebt.co.uk, and we will contact you by another method instead.
7. Who we share your information with
We do not sell your personal information. We share it only where needed to provide our services, meet our obligations, or run our business, and only with organisations that are contractually bound to protect it.
Your creditors and their agents. To set up and run your plan we share your details, your financial statement and your offer of repayment with the organisations you owe money to, and with debt collection agencies or solicitors acting for them.
Identity verification and credit reference agencies. We will disclose personal data to our partner Valid8 IP Ltd for the provision of credit report and identity information, which may include Equifax Ltd, Experian Ltd, and TransUnion. To understand how the credit reference agencies use and share personal data, please see the CRAIN notice:
- TransUnion – www.transunion.co.uk/crain
- Equifax – www.equifax.co.uk/crain
- Experian – www.experian.co.uk/legal/crain
The firm that introduced you. If you were referred to us by another debt advice or introducer firm, we may confirm to them the progress of your enquiry and plan so that they can meet their own regulatory obligations and manage their relationship with us.
Service providers and business partners acting on our instructions. These include the providers of our case management, CRM and payment systems, our IT and cloud hosting providers (including Microsoft), our telephony and call recording provider (Zoom), our WhatsApp messaging provider (360dialog), our card payment processor, and organisations that provide finance or insurance to our business. They may only use your data for the purpose we share it.
Regulators, ombudsmen and authorities. The Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, HMRC, the courts, law enforcement and fraud prevention agencies, where we are required or permitted to do so.
Professional advisers. Our auditors, accountants, lawyers and insurers, where necessary.
A buyer or successor. If we sell, merge or restructure our business, your information may be transferred to the new owner, who will be bound by this policy.
8. Transfers outside the UK
Most of your information is stored and processed in the UK or the European Economic Area. Some of our service providers operate in the United States. Where information is transferred outside the UK we make sure it is protected by an adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another safeguard recognised in UK law. You can ask us for details of the safeguards used.
9. How long we keep your information
We keep your information for as long as we provide services to you and for six years after your relationship with us ends, so that we can respond to complaints, meet the record-keeping requirements of the FCA and other regulators, and defend legal claims. If you make an enquiry but do not become a client, we keep your details for 12 months so that we can respond if you come back to us, and then delete them. Call recordings are kept for the same period as your case file. When we no longer need your information we delete or anonymise it securely.
10. Your rights
You have the following rights over your personal information. To use any of them, email info@refreshdebt.co.uk or write to the Data Protection Lead at the address in section 1. We will respond within one month, and we may ask you to confirm your identity first. There is normally no charge.
- Access – ask for a copy of the information we hold about you.
- Rectification – ask us to correct information that is inaccurate or incomplete.
- Erasure – ask us to delete your information. We may need to keep some records to meet our regulatory obligations, and we will tell you if so.
- Restriction – ask us to limit how we use your information while a query about it is resolved.
- Portability – ask for the information you gave us in a format you can reuse, or have it sent to another organisation.
- Objection – object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent – where we rely on your consent (WhatsApp, marketing, soft credit searches), you can withdraw it at any time. This does not affect anything done before you withdrew it.
- Automated decisions – ask for human review of any decision made about you solely by automated means.
11. Complaints about how we use your information
If you are unhappy with how we have handled your personal information, please tell us. You can complain by emailing info@refreshdebt.co.uk, by writing to the Data Protection Lead at the address in section 1, or by telling any member of our team, who will pass it on. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaints about the debt advice or service you have received are handled under our separate complaints procedure, and may be referred to the Financial Ombudsman Service.
12. Cookies
Cookies are small files placed on your device by websites you visit. Our website uses the cookies and similar technologies listed below. Essential cookies make the site work and are always on. Advertising and analytics cookies are only set if you accept them through the cookie banner, and you can change your choice at any time using the cookie settings link in the site footer or through your browser settings. Blocking cookies in your browser may affect how the site works.
| Provider | Purpose | Cookies | Type |
|---|---|---|---|
| Refresh Debt Services (WordPress) | Making the site work, remembering your cookie choice | Session and consent cookies | Essential |
| Google Tag Manager / Google Analytics | Understanding how visitors use the site | _ga, _gid | Analytics |
| Google Ads | Measuring whether our advertising brought you to the site | _gcl_au | Advertising |
| Meta (Facebook) Pixel | Measuring our advertising on Facebook and Instagram | _fbp | Advertising |
| Microsoft Advertising (Bing) | Measuring our advertising on Bing | _uetsid, _uetvid, MUID | Advertising |
The advertising providers above may also use the information for their own purposes as independent controllers; their privacy notices explain how. We do not use cookies to identify you personally or to link your browsing to your case.
13. How we protect your information
We hold your information on secure systems with access limited to staff who need it to do their jobs. We use encryption in transit and at rest, multi-factor authentication, endpoint protection and monitoring, and we review our security arrangements regularly. Our staff receive data protection training. If a breach of security affects your information and puts your rights at risk, we will tell you and the ICO as the law requires.
14. Changes to this policy
We review this policy at least once a year and whenever our processing, our partners or the law changes. The version number and date at the top show when it was last updated. If we make a significant change to how we use your information, we will tell existing clients by email or through their plan communications before the change takes effect.
15. Contact us
Data Protection Lead
Refresh Debt Services Ltd
Milltown House, Milltown Industrial Estate
Warrenpoint, Co. Down, BT34 3FN
Email: info@refreshdebt.co.uk