MFDP Limited (“MFDP Limited”) and MFDP Services Limited ("MFDP" Services”) are committed to protecting your privacy and ensuring that your personal data is handled fairly, lawfully and securely.
This Privacy Notice explains how we collect, use, store and share your personal data, why we use it, the lawful bases on which we rely, and the rights you have in relation to your personal data.
MFDP Limited and MFDP Services Limited are separate companies within the Restons Holdings Group and have different roles in relation to the management of your account.
MFDP Limited is authorised and regulated by the Financial Conduct Authority (Firm Reference Number: 992807) and is responsible for acquiring and owning the debts to which this Privacy Notice relates.
MFDP Services Limited is approved by the Financial Conduct Authority (Firm Reference Number: 1046536) to provide the operational services required to manage and administer those accounts on behalf of MFDP Limited. This includes maintaining the systems in which account and customer information is held, communicating with customers, administering payments and arrangements, and carrying out the day-to-day management of accounts.
Because both companies have responsibilities in determining the purposes and means of processing personal data in connection with the management and recovery of these accounts, MFDP Limited and MFDP Services Limited act as joint data controllers for the relevant processing activities.
Although the companies have different operational roles, they work together to ensure that personal data is processed in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection legislation.
For the purposes of this Privacy Notice, references to "we", "us" or "our" may refer to MFDP Limited, MFDP Services Limited, or both, depending on the processing activity concerned.
MFDP Limited and MFDP Services Limited have arrangements in place which set out their respective responsibilities for complying with data protection legislation.
In general, MFDP Limited is responsible for matters relating to the ownership and acquisition of accounts and the overall purpose of managing and recovering those accounts. MFDP Services Limited is responsible for the operational management and administration of accounts, including maintaining customer and account records, managing communications and administering customer interactions.
The companies cooperate in responding to requests from individuals exercising their data protection rights and in meeting their obligations under data protection legislation.
You may exercise your data protection rights by contacting either company and we will ensure that your request is dealt with appropriately, regardless of which company you contact.
We may receive personal data about you from a number of sources.
This may include:
Where we obtain your personal data from another organisation, we may combine that information with information you provide to us or information we collect ourselves.
Depending on the circumstances, the personal data we hold about you may include:
When you use our website or customer portal, we may collect technical information about the device and connection you use. Depending on the circumstances, this may include your IP address, browser type, operating system, device information and information about how you use our website.
We use this information to help operate, maintain and secure our website and customer portal, to identify technical problems, to understand how our website is used and, where appropriate, to assist us in managing your account.
Information collected through cookies and similar technologies is explained further in our Cookies Policy.
Some personal data is considered particularly sensitive under data protection law. This is known as special category data and includes information concerning physical or mental health.
As an FCA-regulated firm, we need to understand whether customers may be vulnerable and whether their circumstances may affect their ability to manage their account. You may therefore provide information to us concerning your health, disability or other circumstances.
Further information about our processing of special category data is contained in Section D of this Privacy Notice.
We will only record and use special category data where it is necessary, relevant and lawful to do so.
We may use your personal data for the following purposes:
We will only use your personal data for purposes that are compatible with the purposes described in this Privacy Notice or where otherwise permitted or required by law.
If we intend to use your personal data for a materially different purpose, we will provide you with additional information where required by law.
We may need to share personal data with other organisations where this is necessary and lawful for the purposes described in this Privacy Notice.
Depending on the circumstances, these organisations may include:
We may share information about your account with Credit Reference Agencies, including:
Credit Reference Agencies may use information they receive from us together with information received from other organisations to maintain credit records, assess creditworthiness, prevent fraud and for other purposes explained in their own privacy information.
The Credit Reference Agencies' respective information is available through their Credit Reference Agency Information Notices.
We may share relevant information with solicitors, barristers, courts, enforcement agents and other legal or enforcement service providers where this is necessary to manage or recover an account, establish or defend legal rights or comply with legal requirements.
We may share information with the original creditor or other organisations involved in the ownership, administration or servicing of an account where this is necessary and lawful.
We may use third-party communications providers to send letters, emails, SMS messages or other communications to you on our behalf.
We may disclose personal data to regulators, government bodies, law enforcement agencies, courts and other public authorities where we are required or permitted to do so.
This may include the Financial Conduct Authority and the Information Commissioner's Office.
We may share personal data with organisations that provide IT, hosting, software, security, data storage, communications or other technology services to us.
Where an organisation processes personal data on our behalf, we will require appropriate contractual and security arrangements to protect your information.
We may use tracing, address verification and identity verification providers to help us maintain accurate contact information and manage accounts appropriately.
Where appropriate and lawful, we may communicate with debt management companies, financial advisers or other organisations involved in supporting you.
Where someone asks us to communicate with them on your behalf, we will normally require appropriate authority before disclosing your personal information.
We may disclose relevant information to a person or organisation you have authorised to act on your behalf, such as a family member, solicitor, debt adviser or other representative.
We will take appropriate steps to verify that the person or organisation has the necessary authority before disclosing information.
We may use other specialist suppliers where necessary to provide our services or operate our business.
We will only share personal data where there is a lawful basis for doing so and the information shared is appropriate and proportionate to the purpose.
We do not sell your personal data.
We have appropriate technical and organisational measures in place to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
We must have a lawful basis for processing your personal data. The lawful basis we use depends on the purpose for which we are processing your information.
We may process your personal data where this is necessary to manage and recover an outstanding debt, administer your account, communicate with you, maintain accurate account records and seek appropriate repayment arrangements.
Our lawful basis for these activities will generally be our legitimate interests under Article 6(1)(f) of the UK GDPR. Our legitimate interests include managing accounts that we own or are responsible for, recovering outstanding debts, maintaining accurate records and ensuring that accounts are managed fairly and appropriately.
Where processing is necessary for us to comply with a legal or regulatory obligation, we may rely on Article 6(1)(c) – legal obligation. Where processing is genuinely necessary for the performance of a contract with you, we may rely on Article 6(1)(b) – contractual necessity.
We will only rely on a particular lawful basis where the requirements for that basis are met.
Some information is considered particularly sensitive under data protection law. This is known as special category data and includes information concerning physical or mental health.
As an FCA-regulated firm, we are required to have appropriate policies and procedures for identifying and supporting customers who may be vulnerable. This may involve processing information concerning your health or other circumstances which may affect your ability to manage your account or repay your debt.
You may provide this information to us voluntarily, for example during a telephone conversation, by email, letter or other communication. We may also ask for information about your circumstances where this is necessary to understand your situation and provide appropriate support.
Where we process special category data, we will have both:
For processing health information where this is necessary to protect the financial well-being of an adult who is at risk because they are less able to protect their financial well-being as a result of physical or mental injury, illness or disability, we may rely on Article 9(2)(g) – substantial public interest, together with paragraph 19 of Part 2 of Schedule 1 to the Data Protection Act 2018.
This may apply where information about your health is relevant to understanding your circumstances, identifying vulnerability and providing appropriate support in relation to your account.
The fact that you voluntarily provide special category information to us does not, by itself, mean that you have given explicit consent to its processing. Where we rely on another lawful condition under Article 9, we will process the information in accordance with that condition.
Where explicit consent is the appropriate condition for a particular processing activity, we will obtain your explicit consent and explain how you can withdraw it.
We will only record and use information concerning your health or other special category data where it is necessary, relevant and proportionate to the purpose for which it is being processed. We will not normally require detailed medical information and ask that you provide only information that is relevant to your circumstances and your account.
Where appropriate, information about your circumstances may be used to help us identify whether additional support, adjustments or an alternative approach to managing your account may be appropriate.
Where special category data is processed for another specific purpose, we will identify and rely upon the Article 9 condition applicable to that processing.
We will retain your personal data only for as long as it is necessary for the purposes for which it is being processed, including where necessary to meet legal, regulatory, accounting or reporting requirements and to establish, exercise or defend legal claims.
Generally, we will retain information relating to your account while we are managing or recovering the debt.
Once your account has been closed, we will normally retain relevant personal data for six years from the date the account is closed.
This period allows us to:
Different information may be retained for different periods where this is appropriate.
For example, information collected for website security or technical purposes may have a shorter retention period, while information that we are legally required to retain may need to be retained for longer.
We will periodically review the personal data we hold and securely delete or anonymise information when it is no longer necessary to retain it.
We are based in the United Kingdom and generally process personal data within the UK.
Some of our service providers may process or store personal data outside the UK. Where personal data is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable data protection law.
Depending on the destination and circumstances, this may include relying on:
Where required, we will carry out appropriate assessments and implement supplementary safeguards to ensure that personal data receives an appropriate level of protection.
You can contact our Data Protection Officer if you require further information about international transfers.
When you use our website, information transmitted over the internet cannot be guaranteed to be completely secure. We use appropriate technical and organisational measures to protect your information, but you should take reasonable steps to protect your own devices, passwords and account credentials.
Data protection law gives you a number of rights in relation to your personal data. These rights do not apply in every circumstance and may be subject to legal conditions and exemptions.
You have the right to ask us whether we process personal data about you and, where applicable, to request a copy of your personal data.
This is commonly known as a Subject Access Request (SAR).
We will provide the information required by law within the applicable statutory timescale, subject to any applicable exemptions.
You have the right to ask us to correct personal data that is inaccurate or incomplete.
We will consider your request and, where appropriate, update our records.
In certain circumstances, you have the right to ask us to delete your personal data.
This right is not absolute. For example, we may be entitled or required to retain information where it is necessary to comply with a legal or regulatory obligation or to establish, exercise or defend legal claims.
In certain circumstances, you have the right to ask us to restrict the processing of your personal data.
For example, this may apply where you dispute the accuracy of your personal data or where you have objected to processing and we are considering your objection.
You have the right to object to certain types of processing, including processing based on our legitimate interests.
Where we process your personal data for direct marketing purposes, you have an absolute right to object to that processing.
Where your right to object applies, we will explain the consequences of your objection and consider your request in accordance with applicable data protection law.
In certain circumstances, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to ask us to transmit that information to another controller.
This right only applies where the legal requirements for data portability are satisfied, including where processing is based on consent or a contract and is carried out by automated means.
You have rights in relation to certain decisions made solely by automated means where those decisions have legal or similarly significant effects on you.
We will provide the information and safeguards required by law where such processing applies.
If you have concerns about a decision made about you, you can contact us and ask us to review the matter.
Where we rely on your consent as the lawful basis for processing your personal data, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Where we are processing your personal data under another lawful basis, withdrawing consent will not necessarily require us to stop processing your information.
If you wish to exercise any of your rights, please contact our Data Protection Officer:
MFDP Services Ltd
Trinity Chambers
800 Mandarin Court
Centre Park
Warrington
Cheshire
WA1 1GG
Email: dpo@mfdp.co.uk
We may need to ask for additional information to verify your identity before responding to a request. This is to ensure that personal data is not disclosed to someone who is not entitled to receive it.
Our website and customer portal may use cookies and similar technologies.
Cookies are small files stored on your device when you visit a website. They may be used for purposes such as:
Some cookies may be necessary for the website to operate, while others may be used for additional purposes.
Where consent is required for a particular type of cookie or similar technology, we will obtain consent in accordance with applicable law.
You can also control or disable cookies through your browser settings, although doing so may affect the functionality of parts of our website or customer portal.
Further information about the cookies we use and how you can manage them is provided in our Cookies Policy.
We may update this Privacy Notice from time to time to reflect changes in our services, the way we process personal data, legal or regulatory requirements, or changes to data protection law.
If you have any questions, concerns or complaints about how we use your personal data, please contact our Data Protection Officer in the first instance.
MFDP Services Ltd
Trinity Chambers
800 Mandarin Court
Centre Park
Warrington
Cheshire
WA1 1GG
Email: complaints@mfdp.co.uk
We will investigate your concerns and seek to resolve them appropriately.
You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your personal data has been processed unlawfully or that your data protection rights have not been respected.
The ICO can be contacted at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
You do not have to contact us before complaining to the ICO, although we would welcome the opportunity to address your concerns first.
