Oriel Collections Limited Privacy Policy
Oriel Collections Limited (“The Company”) is committed to protecting its information and that of its customers and staff. The Company will comply with the rule & regulations that are part of UK law and the General Data Protection Regulation (GDPR).
Oriel Collections Limited is a company registered in England and Wales, company registration number 04807044, registered office: 3 Manchester Park, Tewkesbury Road, Cheltenham, GL51 9EJ, UK. Oriel, Oriel Collections, Oriel Collections Services, FlexEd, FlexPay, Oriel Resolve and Oriel Resolve University Services are all trading names of Oriel Collections Limited.
Oriel has set out to achieve its goal of Compliance by implementing multiple strategies that benefit its staff, clients and customers.
The Company works openly with:
To support its Compliance strategies Oriel has implemented an Information Security Management System (ISMS) to the internationally recognised ISO/IEC 27001:2022 standard and is Certified by a UKAS accredited body.
The Company’s primary activities include the provision of Credit Control, Debt Collection and Payment Plan services. Oriel Collections Limited will only ever use the information provided to them for the purpose it was originally provided for. This means when you entrusted one of our Clients or Oriel with your Personal Data you can be confident that it won’t be sold or passed onto 3rd parties outside of the service provision Oriel are providing its clients, customers or staff. Should further involvement be required from Oriel Collection Limited’s 3rd Party Solicitors, during the course of debt collection activities, the solicitors would become a Joint Controller.
The Company has established clear guidelines on why Personal Data is being processed. Oriel Collections has provided the following breakdown depending on whose data is being processed and for what purpose.
Staff
When Oriel processes Personal Data for its Staff, it is a Data Controller.
The Lawful Basis for processing our Staff’s data falls in to the category of Legal Obligation.
An employer needs to process Personal Data to comply with its Legal Obligation to disclose employee salary details to HM Revenues and Customs (HMRC). Further details can be found at https://www.gov.uk/government/organisations/hm-revenue-customs
In the UK all employers are required to ensure all prospective and current staff are legally working in the UK. Legislation, such as the Immigration, Asylum and Nationality Act 2006, outlines such requirements.
Employers also have a legal requirement to hold employees next of kin records. Consent is not required from the next of kin to store their details.
Oriel provides it staff with compensation and benefits when in employment. For Oriel to offer its staff these services Personal Data will be shared with an agreed supplier who will become a Data Processor.
Direct Customers
When Personal Data is provided to Oriel under the Trading Names of FlexPay for the FlexEd, FlexFactor and FlexFees services, Oriel is the Data Controller.
The Lawful Basis for processing Personal Data in this circumstance is for the performance of a Contract.
A customer will enter into an agreement for a spread payment plan and Oriel need to process Personal Data to provide this service at the point a natural person registers for the service. The information provided is for the purpose of managing the payment plan only.
Indirect Customers
Oriel provides Debt Collection, Credit Control and Payment Plan services to a large a varied Client base.
The Lawful Basis for processing personal data in this circumstance is based on Legitimate Interests.
To achieve its role Oriel requires its client to provide Personal Data. The data that is provided to Oriel will be based on Name, Contact Details, Date of Birth and details for the account that the balance remains unresolved. This means Oriel is a Data Processor when working for Clients in this way and the Client is a Data Controller. A Data Subject can expect to receive contact via Telephone, Letter, Email, SMS\Text to gain repayment of monies owed to the Client.
Provision of Personal Data
Is the provision of personal data statutory or contractual?
The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.
Personal data is required to:
What are the consequences of not providing personal data?
If you choose not to provide the personal data, we request:
Categories of personal data processed
We may collect and process the following categories of personal data, as necessary to provide our services and meet our legal, contractual, and security obligations:
Special Category Data
For customers we may also need to capture more sensitive information relating to your personal circumstances as they maybe impacting your ability to resolve the outstanding balance.
This could be Information about your health, including any medical condition, health and sickness records.
If we do have to capture this type of sensitive information on your account, we will always ask your permission to do so, requesting Consent to process Special Category Data. If you agree and consent to Oriel capturing this type of information on your account you have control over its removal too, you can withdraw Consent to processing of Special Category Data at any stage by contacting Oriel and withdrawing consent to Oriel processing your Special Category Data.
Clients
When Oriel works with clients it is required to complete due diligence exercises on the clients themselves before engaging in business activities.
The Lawful Basis for processing Personal Data in this circumstance is a Legal Obligation.
A financial institution relies on the legal obligation imposed by the Part 7 of Proceeds of Crime Act 2002 to process personal data in order submit a Suspicious Activity Report to the National Crime Agency when it knows or suspects that a person is engaged in, or attempting, money laundering.
Client Portal
Where Oriel holds a Client’s Personal Data submitted through the Client Portal, or used in the creation of their Client Portal account, this data will be held in accordance with the requirements of GDPR. Oriel will not retain a Client’s Personal Data for any longer than we have a legitimate interest to do so. It is the Client’s right to access, rectify, or erase the Personal Data we currently hold on record for them. Should a Client wish to exercise any of these rights, please contact
Data.Protection@orielcollections.co.uk or call 01242 508639. Please be aware, you will be asked to verify your name, address and date of birth before we release any Personal Data – this is to ensure we are not sharing Personal Data with unauthorised individuals.
Data retention periods
We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.
Credit Reference Agency Information Notice (CRAIN)
In order to provide support of our Primary Activities, Oriel will use Credit Reference Agencies (CRA). Oriel will use a CRA for the following; verify Staff and Customer identities, trace customers whereabouts for recovery of debt,
prevent criminal activity, fraud and money laundering.
To do this, we will supply your personal information to CRAs and they will give us information about you.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail via the three CRA’s, clicking on any of these three links will take you to the same CRAIN documentation:
Call Credit – www.callcredit.co.uk/crain
Equifax – www.equifax.co.uk/crain
Experian – www.experian.co.uk/crain
A record is held and maintained of all data processing activities at Oriel, this is known as the Register of Data Processing. Oriel lists the services and data processing activities provided to us or for us by Clients or Suppliers and helps Oriel know the journey any piece of data has been on.
Credit Reference and Affordability Checks for Staff/Suppliers/Clients
To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:
Data Protection Rights
Right of access – You have the right to request a copy of the personal data we hold about you and information about how it is used. See section 8.
Right to rectification – You have the right to request that inaccurate or incomplete personal data is corrected. See section 8.
Right to erasure (“right to be forgotten”) – You have the right to request that we delete your personal data where there is no lawful reason for us to continue processing it. See section 9.
Right to restrict processing – You have the right to request that we limit how we use your personal data in certain circumstances. See section 9.
Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another organisation where technically feasible readable format, and to request that we transfer it to another organisation where technically feasible. See section 8.
Right to object – You have the right to object to the processing of your personal data where we rely on legitimate interests or where data is used for direct marketing. See section 9.
Right to complain to ICO – You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data. See section 12.
Non-Automated Decision Making and Profiling Making and Profiling Making and Profiling
We may use systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.
These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.
The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.
We may transfer personal data to recipients or service providers located outside the UK and/or European Economic Area (EEA).
Where such transfers take place, we ensure appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws. These safeguards may include the use of approved standard contractual clauses, international data transfer agreements, or transfers to countries that have been recognised as providing an adequate level of data protection.
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. Oriel Collections Limited operates an Information Security Management System which complies with the requirements of ISO/IEC 27001:2022.
You can use our website to contact Oriel. We have a Contact Form on the ‘Contact Us’ page that requests your name and email address. If you are a customer, your contact form detail will be added to your account if we are provided with sufficient details to enable the processing of that information. If we are not provided with details that enable us to recognise how the information you provide should be processed, we will delete the information as have no lawful basis for processing that data.
Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
Web Links
Links to other websites are outside of our control. Therefore, we cannot be responsible for the protection and privacy of any information you provide on such sites.
When you choose to make an online payment, you will be asked to enter your transaction details including your Oriel reference number, phone number and the amount you wish to pay. Your reference number and balance can be found in the letter or email sent to you by Oriel Collections Ltd.
Once these details have been completed you will be directed to the payments page and asked to enter your credit or debit card details. All card payments are subject to authorisation by your card issuer and you may be asked to provide additional security or password information.
By completing your transaction and payment details, you confirm that you are the authorised holder of the credit or debit card being used and that the payment has been authorised by you. You also confirm that the payment is affordable and that it does not affect your priority bills such as (but not exclusive to) food, rent and utilities.
The details you provide will only be used for transactional purposes and if you wish to understand how we handle your personal information, please read the Privacy Policy in full.
You may request details of personal information which we hold about you or request a transfer to another organisation where appropriate. Please contact Data.Protection@orielcollections.co.uk or call 01242 508639 to request a copy of the information we process. Please note, to ensure we are not sharing Personal Data with unauthorised individuals, you will be asked to verify your name and address before we release any Personal Data.
If you believe that any information we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any information found to be incorrect.
Should you object to how the personal information we hold about you is being processed, or should you like us to erase the personal information we hold about you please contact
Data.Protection@orielcollections.co.uk or call 01242 508639. Please note, to ensure we are not sharing Personal Data with unauthorised individuals, you will be asked to verify your name, address and date of birth before we release any Personal Data. Whereby a data erasure request impacts operational ability of Oriel Collections Limited, this data will not be erased due to the data being of legitimate interest of Oriel Collections Limited business activity.
This Policy was updated 12th March 2026
Oriel may wish to update its policy at any time. A new Privacy Policy will be published and made available if there are any changes to your rights or how your Personal data is processed.
Any questions relating to this Privacy Policy or Data Protection should be directed to
Data.Protection@orielcollections.co.uk or via the Company address at the beginning of this policy.
The DPO of Oriel Collections Ltd is Claire Jackson, who may be contacted through Data.Protection@orielcollections.co.uk, for data protection related queries.
Data Protection is regulated in the UK by the Information Commissioner’s Office. If you want to know more about data protection you can contact them at the details below:
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/concerns/