Privacy policy

Oriel Collections Limited Privacy Policy
1. About Oriel
Oriel Collections Limited (“The Company”) is committed to protecting its information and that of its customers and staff. The Company will comply with the rule & regulations that are part of UK law and the General Data Protection Regulation (GDPR). Oriel Collections Limited is a company registered in England and Wales, company registration number 04807044, registered office: 3 Manchester Park, Tewkesbury Road, Cheltenham, GL51 9EJ, UK. Oriel, Oriel Collections, Oriel Collections Services, FlexEd, FlexPay, Oriel Resolve and Oriel Resolve University Services are all trading names of Oriel Collections Limited. Oriel has set out to achieve its goal of Compliance by implementing multiple strategies that benefit its staff, clients and customers. The Company works openly with:
• the Information Commissioners Office (ICO) (The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals)
• the Financial Conduct Authority (FCA) (The FCA is the conduct regulator for financial services firms and financial markets in the UK and the prudential regulator for some of those firms) Oriel Collections Limited is authorised and regulated by the Financial Conduct Authority for accounts created under the Consumer Credit Act 1974 (amended 2006). Oriel Collections Limited is registered on the Financial Services Register under registration number 715390.
• the Credit Services Association (CSA) (the UK trade association for the debt collection and debt purchase industry)
• Ombudsman services that request information from the Company. To support its Compliance strategies Oriel has implemented an Information Security Management System (ISMS) to the internationally recognised ISO/IEC 27001:2013 standard and is Certified by a UKAS accredited body.

2. Primary Activities
The Company’s primary activities include the provision of Credit Control, Debt Collection and Payment Plan services. Oriel Collections Limited will only ever use the information provided to them for the purpose it was originally provided for. This means when you entrusted one of our Clients or Oriel with your Personal Data you can be confident that it won’t be sold or passed onto 3rd parties outside of the service provision Oriel are providing its clients, customers or staff.

3. How and Why we Use Information
The Company has established clear guidelines on why Personal Data is being processed. Oriel Collections has provided the following breakdown depending on whose data is being processed and for what purpose.
Staff
When Oriel processes Personal Data for its Staff, it is a Data Controller. The Lawful Basis for processing our Staff’s data falls in to the category of Legal Obligation. An employer needs to process Personal Data to comply with its Legal Obligation to disclose employee salary details to HM Revenues and Customs (HMRC). Further details can be found at https://www.gov.uk/government/organisations/hm-revenue-customs In the UK all employers are required to ensure all prospective and current staff are legally working in the UK. Legislation, such as the Immigration, Asylum and Nationality Act 2006, outlines such requirements.
Employers also have a legal requirement to hold employees next of kin records. Consent is not required from the next of kin to store their details. Oriel provides it staff with compensation and benefits when in employment. For Oriel to offer its staff these services Personal Data will be shared with an agreed supplier who will become a Data Processor.
Direct Customers
When Personal Data is provided to Oriel under the Trading Names of FlexPay for the FlexEd, FlexFactor and FlexFees services, Oriel is the Data Controller. The Lawful Basis for processing Personal Data in this circumstance is for the performance of a Contract.
A customer will enter into an agreement for a spread payment plan and Oriel need to process Personal Data to provide this service at the point a natural person registers for the service. The information provided is for the purpose of managing the payment plan only.
Indirect Customers
Oriel provides Debt Collection, Credit Control and Payment Plan services to a large a varied Client base.
The Lawful Basis for processing personal data in this circumstance is based on Legitimate Interests. To achieve its role Oriel requires its client to provide Personal Data. The data that is provided to Oriel will be based on Name, Contact Details, Date of Birth and details for the account that the balance remains unresolved. This means Oriel is a Data Processor when working for Clients in this way and the Client is a Data Controller. A Data Subject can expect to receive contact via Telephone, Letter, Email, SMS\Text to gain repayment of monies owed to the Client.
Special Category Data
For customers we may also need to capture more sensitive information relating to your personal circumstances as they maybe impacting your ability to resolve the outstanding balance. This could be Information about your health, including any medical condition, health and sickness records.
If we do have to capture this type of sensitive information on your account we will always ask your permission to do so, requesting Consent to process Special Category Data. If you agree and consent to Oriel capturing this type of information on your account you have control over its removal too, you can withdraw Consent to processing of Special Category Data at any stage by contacting Oriel and withdrawing consent to Oriel processing your Special Category Data.
Clients
When Oriel works with clients it is required to complete due diligence exercises on the clients themselves before engaging in business activities.
The Lawful Basis for processing Personal Data in this circumstance is a Legal Obligation. A financial institution relies on the legal obligation imposed by the Part 7 of Proceeds of Crime Act 2002 to process personal data in order submit a Suspicious Activity Report to the National Crime Agency when it knows or suspects that a person is engaged in, or attempting, money laundering.
Client Portal
Where Oriel holds a Client’s Personal Data submitted through the Client Portal, or used in the creation of their Client Portal account, this data will be held in accordance with the requirements of GDPR. Oriel will not retain a Client’s Personal Data for any longer than we have a legitimate interest to do so. It is the Client’s right to access, rectify, or erase the Personal Data we currently hold on record for them. Should a Client wish to exercise any of these rights, please contact Data.Protection@orielcollections.co.uk or call 01242 508639. Please be aware, you will be asked to verify your name, address and date of birth before we release any Personal Data – this is to ensure we are not sharing Personal Data with unauthorised individuals.
Credit Reference Agency Information Notice (CRAIN)
In order to provide support of our Primary Activities, Oriel will use Credit Reference Agencies (CRA). Oriel will use a CRA for the following;
verify Staff and Customer identities, trace customers whereabouts for recovery of debt, prevent criminal activity, fraud and money laundering.
To do this, we will supply your personal information to CRAs and they will give us information about you.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail via the three CRA’s, clicking on any of these three links will take you to the same CRAIN documentation:
Call Credit – www.callcredit.co.uk/crain
Equifax – www.equifax.co.uk/crain
Experian – www.experian.co.uk/crain
A record is held and maintained of all data processing activities at Oriel, this is known as the Register of Data Processing. Oriel lists the services and data processing activities provided to us or for us by Clients or Suppliers and helps Oriel know the journey any piece of data has been on.

4. International Transfer
If we are required to transfer Personal data outside of the European Economic Area (EEA) we would only do so in a way that is consistent with and which respects the UK laws on Data Protection and the GDPR.

5. Security
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. Oriel Collections Limited operates an Information Security Management System which complies with the requirements of ISO/IEC 27001:2013.

6. Website
You can use our website to contact Oriel. We have a Contact Form on the ‘Contact Us’ page that requests your name and email address. If you are a customer, your contact form detail will be added to your account if we are provided with sufficient details to enable the processing of that information. If we are not provided with details that enable us to recognise how the information you provide should be processed, we will delete the information as have no lawful basis for processing that data.
Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system. Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
Web Links
Links to other websites are outside of our control. Therefore, we cannot be responsible for the protection and privacy of any information you provide on such sites.


7. Payment Portal Terms and Conditions
When you choose to make an online payment, you will be asked to enter your transaction details including your Oriel reference number, phone number and the amount you wish to pay. Your reference number and balance can be found in the letter or email sent to you by Oriel Collections Ltd.
Once these details have been completed you will be directed to the payments page and asked to enter your credit or debit card details. All card payments are subject to authorisation by your card issuer and you may be asked to provide additional security or password information. By completing your transaction and payment details, you confirm that you are the authorised holder of the credit or debit card being used and that the payment has been authorised by you. You also confirm that the payment is affordable and that it does not affect your priority bills such as (but not exclusive to) food, rent and utilities.
The details you provide will only be used for transactional purposes and if you wish to understand how we handle your personal information, please read the Privacy Policy in full.

8. Requests for Information and Correction of Information
You may request details of personal information which we hold about you. Please contact Data.Protection@orielcollections.co.uk or call 01242 508639 to request a copy of the information we process. Please note, to ensure we are not sharing Personal Data with unauthorised individuals, you will be asked to verify your name and address before we release any Personal Data. If you believe that any information we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any information found to be incorrect.

9. Objection and Erasure of Information
Should you object to how the personal information we hold about you is being processed, or should you like us to erase the personal information we hold about you please contact Data.Protection@orielcollections.co.uk or call 01242 508639. Please note, to ensure we are not sharing Personal Data with unauthorised individuals, you will be asked to verify your name, address and date of birth before we release any Personal Data.

10. Policy Updates
This Policy was updated 7 th March 2023.
Oriel may wish to update its policy at any time. A new Privacy Policy will be published and made available if there are any changes to your rights or how your Personal data is processed.

11. Data Protection Contact
Any questions relating to this Privacy Policy or Data Protection should be directed to Data.Protection@orielcollections.co.uk or via the Company address at the beginning of this policy.

12. Contacting the ICO
Data Protection is regulated in the UK by the Information Commissioner’s Office. If you want to know more about data protection you can contact them at the details below:
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/concerns/