Oriel Collections Limited Privacy Policy

1. About Oriel
Oriel Collections Limited (“The Company”) is committed to protecting its information and that of its
customers and staff. The Company will comply with the rule & regulations that are part of UK law
and the General Data Protection Regulation (GDPR).
Oriel Collections Limited is a company registered in England and Wales, company registration
number 04807044, registered office: 3 Manchester Park, Tewkesbury Road, Cheltenham, GL51 9EJ,
UK. Oriel, Oriel Collections, Oriel Collections Services, FlexEd, FlexPay, Oriel Resolve and Oriel
Resolve University Services are all trading names of Oriel Collections Limited.
Oriel has set out to achieve its goal of Compliance by implementing multiple strategies that benefit
its staff, clients and customers.
The Company works openly with:
• the Information Commissioners Office (ICO) (The UK’s independent authority set up to uphold
information rights in the public interest, promoting openness by public bodies and data privacy for
individuals)
• the Financial Conduct Authority (FCA) (The FCA is the conduct regulator for financial services firms
and financial markets in the UK and the prudential regulator for some of those firms) Oriel
Collections Limited is authorised and regulated by the Financial Conduct Authority for accounts
created under the Consumer Credit Act 1974 (amended 2006). Oriel Collections Limited is registered
on the Financial Services Register under registration number 715390.
• the Credit Services Association (CSA) (the UK trade association for the debt collection and debt
purchase industry)
• Ombudsman services that request information from the Company.
To support its Compliance strategies Oriel has implemented an Information Security Management
System (ISMS) to the internationally recognised ISO/IEC 27001:2013 standard and is Certified by a
UKAS accredited body.

2. Primary Activities
The Company’s primary activities include the provision of Credit Control, Debt Collection and
Payment Plan services. Oriel Collections Limited will only ever use the information provided to them
for the purpose it was originally provided for. This means when you entrusted one of our Clients or
Oriel with your Personal Data you can be confident that it won’t be sold or passed onto 3rd parties
outside of the service provision Oriel are providing its clients, customers or staff.

3. How and Why we Use Information
The Company has established clear guidelines on why Personal Data is being processed. Oriel
Collections has provided the following breakdown depending on whose data is being processed and
for what purpose.
Staff
When Oriel processes Personal Data for its Staff, it is a Data Controller.
The Lawful Basis for processing our Staff’s data falls in to the category of Legal Obligation.
An employer needs to process Personal Data to comply with its Legal Obligation to disclose
employee salary details to HM Revenues and Customs (HMRC). Further details can be found at
https://www.gov.uk/government/organisations/hm-revenue-customs
In the UK all employers are required to ensure all prospective and current staff are legally working in
the UK. Legislation, such as the Immigration, Asylum and Nationality Act 2006, outlines such
requirements.
Employers also have a legal requirement to hold employees next of kin records. Consent is not
required from the next of kin to store their details.
Oriel provides it staff with compensation and benefits when in employment. For Oriel to offer its
staff these services Personal Data will be shared with an agreed supplier who will become a Data
Processor.
Direct Customers
When Personal Data is provided to Oriel under the Trading Names of FlexPay for the FlexEd,
FlexFactor and FlexFees services, Oriel is the Data Controller.
The Lawful Basis for processing Personal Data in this circumstance is for the performance of a
Contract.
A customer will enter into an agreement for a spread payment plan and Oriel need to process
Personal Data to provide this service at the point a natural person registers for the service. The
information provided is for the purpose of managing the payment plan only.
Indirect Customers
Oriel provides Debt Collection, Credit Control and Payment Plan services to a large a varied Client
base.
The Lawful Basis for processing personal data in this circumstance is based on Legitimate Interests.
To achieve its role Oriel requires its client to provide Personal Data. The data that is provided to Oriel
will be based on Name, Contact Details, Date of Birth and details for the account that the balance
remains unresolved. This means Oriel is a Data Processor when working for Clients in this way and
the Client is a Data Controller. A Data Subject can expect to receive contact via Telephone, Letter,
Email, SMS\Text to gain repayment of monies owed to the Client.
Special Category Data
For customers we may also need to capture more sensitive information relating to your personal
circumstances as they maybe impacting your ability to resolve the outstanding balance.
This could be Information about your health, including any medical condition, health and sickness
records.
If we do have to capture this type of sensitive information on your account we will always ask your
permission to do so, requesting Consent to process Special Category Data. If you agree and consent
to Oriel capturing this type of information on your account you have control over its removal too,
you can withdraw Consent to processing of Special Category Data at any stage by contacting Oriel
and withdrawing consent to Oriel processing your Special Category Data.
Clients
When Oriel works with clients it is required to complete due diligence exercises on the clients
themselves before engaging in business activities.
The Lawful Basis for processing Personal Data in this circumstance is a Legal Obligation.
A financial institution relies on the legal obligation imposed by the Part 7 of Proceeds of Crime Act
2002 to process personal data in order submit a Suspicious Activity Report to the National Crime
Agency when it knows or suspects that a person is engaged in, or attempting, money laundering.
Client Portal
Where Oriel holds a Client’s Personal Data submitted through the Client Portal, or used in the
creation of their Client Portal account, this data will be held in accordance with the requirements of
GDPR. Oriel will not retain a Client’s Personal Data for any longer than we have a legitimate interest
to do so. It is the Client’s right to access, rectify, or erase the Personal Data we currently hold on
record for them. Should a Client wish to exercise any of these rights, please contact
Data.Protection@orielcollections.co.uk or call 01242 508639. Please be aware, you will be asked to
verify your name, address and date of birth before we release any Personal Data – this is to ensure
we are not sharing Personal Data with unauthorised individuals.
Credit Reference Agency Information Notice (CRAIN)
In order to provide support of our Primary Activities, Oriel will use Credit Reference Agencies (CRA).
Oriel will use a CRA for the following;
verify Staff and Customer identities,
trace customers whereabouts for recovery of debt,
prevent criminal activity, fraud and money laundering.
To do this, we will supply your personal information to CRAs and they will give us information about
you.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways
in which they use and share personal information, data retention periods and your data protection
rights with the CRAs are explained in more detail via the three CRA’s, clicking on any of these three
links will take you to the same CRAIN documentation:
Call Credit – www.callcredit.co.uk/crain
Equifax – www.equifax.co.uk/crain
Experian – www.experian.co.uk/crain
A record is held and maintained of all data processing activities at Oriel, this is known as the Register
of Data Processing. Oriel lists the services and data processing activities provided to us or for us by
Clients or Suppliers and helps Oriel know the journey any piece of data has been on.

4. International Transfer
If we are required to transfer Personal data outside of the European Economic Area (EEA) we would
only do so in a way that is consistent with and which respects the UK laws on Data Protection and
the GDPR.

5. Security
We are committed to ensuring that your information is secure. In order to prevent unauthorised
access or disclosure, we have put in place suitable physical, electronic and managerial procedures to
safeguard and secure the information we collect online. Oriel Collections Limited operates an
Information Security Management System which complies with the requirements of ISO/IEC
27001:2013.

6. Website
You can use our website to contact Oriel. We have a Contact Form on the ‘Contact Us’ page that
requests your name and email address. If you are a customer, your contact form detail will be added
to your account if we are provided with sufficient details to enable the processing of that
information. If we are not provided with details that enable us to recognise how the information you
provide should be processed, we will delete the information as have no lawful basis for processing
that data.
Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you
agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a
particular site. Cookies allow web applications to respond to you as an individual. The web
application can tailor its operations to your needs, likes and dislikes by gathering and remembering
information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about
web page traffic and improve our website in order to tailor it to customer needs. We only use this
information for statistical analysis purposes and then the data is removed from the system.
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages
you find useful and which you do not. A cookie in no way gives us access to your computer or any
information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but
you can usually modify your browser setting to decline cookies if you prefer. This may prevent you
from taking full advantage of the website.
Web Links
Links to other websites are outside of our control. Therefore, we cannot be responsible for the
protection and privacy of any information you provide on such sites.

7. Payment Portal Terms and Conditions
When you choose to make an online payment, you will be asked to enter your transaction details
including your Oriel reference number, phone number and the amount you wish to pay. Your
reference number and balance can be found in the letter or email sent to you by Oriel Collections
Ltd.
Once these details have been completed you will be directed to the payments page and asked to
enter your credit or debit card details. All card payments are subject to authorisation by your card
issuer and you may be asked to provide additional security or password information.
By completing your transaction and payment details, you confirm that you are the authorised holder
of the credit or debit card being used and that the payment has been authorised by you. You also
confirm that the payment is affordable and that it does not affect your priority bills such as (but not
exclusive to) food, rent and utilities.
The details you provide will only be used for transactional purposes and if you wish to understand
how we handle your personal information, please read the Privacy Policy in full.

8. Requests for Information and Correction of Information
You may request details of personal information which we hold about you. Please contact
Data.Protection@orielcollections.co.uk or call 01242 508639 to request a copy of the information
we process. Please note, to ensure we are not sharing Personal Data with unauthorised individuals,
you will be asked to verify your name and address before we release any Personal Data.
If you believe that any information we are holding on you is incorrect or incomplete, please contact
us as soon as possible. We will promptly correct any information found to be incorrect.

9. Objection and Erasure of Information
Should you object to how the personal information we hold about you is being processed, or should
you like us to erase the personal information we hold about you please contact
Data.Protection@orielcollections.co.uk or call 01242 508639. Please note, to ensure we are not
sharing Personal Data with unauthorised individuals, you will be asked to verify your name, address
and date of birth before we release any Personal Data.

Whereby a data erasure request impacts operational ability of Oriel Collections Limited, this data will not be erased due to the data being of legitimate interest of Oriel Collections Limited business activity.

10. Policy Updates
This Policy was updated 10th July 2023.
Oriel may wish to update its policy at any time. A new Privacy Policy will be published and made
available if there are any changes to your rights or how your Personal data is processed.

11. Data Protection Contact
Any questions relating to this Privacy Policy or Data Protection should be directed to
Data.Protection@orielcollections.co.uk or via the Company address at the beginning of this policy.

12. Contacting the ICO
Data Protection is regulated in the UK by the Information Commissioner’s Office. If you want to
know more about data protection you can contact them at the details below:
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/concerns/