Why have we access to and process your data?
Under the terms of your original agreement your personal data may be passed to a third party in the event that payments are not made as agreed. In such cases, your personal data may be transferred to Intrum for the purposes of debt collection. Intrum may also have purchased your debt and will now collect the outstanding monies owed. To be able to deliver these services we have been provided with, and will process, your personal data.
We will only process your personal data if we have a legal ground to do so. Debt collection is a task of public interest and we have legitimate interest to process your personal data as your account has been legally assigned to us. This means we have the legal right to process your data without your prior approval. In accordance with our legitimate interest we may also undertake tracing activities, scoring to ensure an effective service and compliance with good debt collection practices, enrich the data from different sources e.g. historical cases we hold on you, verify that the data we hold is correct and share your data with approved third parties such as other public and private collection services. Please use the contact information below if you'd like to know more about how we have evaluated our legitimate interest here. Your data will be held securely in compliance with data protection legislation.
What personal data are you processing about me and why?
We hold necessary information for the management of your account. To be able to communicate with you and to ensure safe and true identification we need your name, personal identity number, date of birth and contact details such as address, telephone number and email.
To evaluate your ability to pay, risk analysis and risk management, make payment plans and debt surveillance, we also hold financial information such as payment history, default details, information on your debt, income, assets, credit, loans, and payment history.
To better understands your specific situation and to make a well informed decision on how to handle your case we also keep your reasons for non-payment: depending on the information you provide to us, e.g. individual or family circumstances, work-related issues, etc.
The personal data we hold is also needed for us to be able to defend legal claims or obtain other execution or enforcement. We also use your personal data to offer and further develop an effective service and to ensure good debt collection practices e.g. through scoring activities among others based on historic information and performance and taping of phone conversations to train our personal and to document your rights. Unless we have legal obligations to keep the records we will delete them after a short period of time.
We have a legal obligation to provide your personal data when we are audited by the authorities and to prevent, monitor and evidence fraud, anti-money laundering and other criminal activities.
We provide access to or share your personal data approved third party suppliers.
As part of our corporate responsibility and role in the society we also provide anonymized statistics and analyses where your data may be used as a base. These anonymized analyses may be used as part of a general risk evaluation by us or our clients.
As part of our investments, we may also process your personal data in order to make valuations of your claim(s) or of a portfolio that includes your claim(s), and further sell and transfer your claims(s) and conduct statistical analysis.
The information we have on you may be anonymized and used for developing of our business. However, when necessary to secure your personal data and ensure appropriate test development of and changes in our IT system your personal data may be used as-is.
Unless otherwise agreed with you or it is necessary for the establishment, exercise or defense of legal claims, we will not include special categories of personal data.
Are you processing any sensitive data regarding me?
Unless otherwise agreed with you or is necessary for the establishment, exercise or defense of legal claims, we will not include special categories of personal information (often known as ‘sensitive personal data’ such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life).
It may however benefit you to notify us of any health condition, disability and/or personal information relating to your private life that may impact your ability to pay. This will allow us to take reasonable steps to accommodate your needs or requirements such as allowing sufficient breaks in your payment arrangement, providing breathing space to seek free independent debt advice, or adjusting your payment arrangement.
This information will be used by us to assist you and will be kept as long as it is required for this purpose, or until you notify us that you no longer consent to its processing or it is necessary for the establishment, exercise or defense of legal claims.
Do I have to provide you with my personal data?
You do not have to provide us with any personal data. In fact, most (if not all) personal data that we process about you comes from another source than yourself i.e. your original agreement party or public registers.
However, you may choose to provide us with additional personal data. Such information may even help us handle your case, and it is usually to your benefit. For example, you may have a valid reason for why you have not paid your debt which you may want to share with us, or if we agree to set up a payment plan to help you pay your debt you may want to provide certain details for making the payment plan reasonable and attuned to your specific situation.
Will you share my personal data with others?
We may share your personal data with our suppliers that facilitate and/or provide parts of our services, e.g. printer and mail services, call center services, field collectors, legal representatives etc. We may also share your personal data with our Client (your agreement party), bailiffs and governmental authorities.
Our employees will have access to the personal data. In such a case, access will be granted only if necessary for the purposes described and only if the employee is bound by an obligation of confidentiality.
Will my personal data be transferred to another country?
As we are part of the Intrum group, we may transfer your data to another country. If we do, we will ensure there are suitable safeguards in place to comply with EU General Data Protection Regulation (GDPR). Generally, your personal data will not be transferred outside of the European Economic Area (EEA). However, in case of international debt collection, your personal data may be transferred to one of our agents working in the relevant country. We also use third-party service providers to store or whom may access your data, which may be located outside of the EEA, including, but not limited to the United States. We will never transfer your personal data outside of the EEA without ensuring the safety and protection of your personal data. Therefore we make sure that any recipients have signed the EU Standard Model Clauses, to justify the transfer, or that the country guarantee adequate protection under the data protection legislation. We may also rely on the Privacy Shield program, which is a program where US companies can commit to a higher level of privacy protection than is required by US law. We may disclose information outside of these groups to help prevent fraud, or if required to do so by law.
How long do you store my personal data?
We will retain your data as long as required for the lawful purpose for which it was obtained, as long as we have legitimate interest to keep it e.g. to ensure good debt collection practices and until the statue barring period is due to be able to defend ourselves against legal claims. We are also legally obliged to keep your personal data for a period of time to prevent and detect fraud, detect and evidence anti-money laundering and for financial audits (for example 5 years to comply with AML legislation and 7 years for financial audits). After we have collected your debt and your case is closed we also keep part of your personal data in aggregated/pseudonymized for up to nine years and analyse it to create an efficient service (scoring), statistical and investment purposes and for business development.
During the period after your case is closed the data is kept separated subject to strict security measures and with limited access rights.
As far as our backups are concerned, we will also delete your data in our backups, but only if and when the back-up tape comes up for restore, according to our backup policy. If the backup comes up for deletion as per back up policy, we will fully delete your data.
Will I be subject to automated decision-making?
As part of our debt collection, Intrum uses scoring of cases.It is necessary for optimizing our service and handling your case in an efficient and timely manner. It is also necessary to ensure compliance with good debt collection practices and to avoid unnecessary reminders and fees.
A score is awarded by automated means, and indicates how you handle your case. The score decides, for example, whether you are likely to pay the debt or that we should forward your case to the Enforcement Agency. We do not consider the scoring to be automated decision making (as defined in the European data protection law) since it does not produce legal effects or similarly significantly affect you as it does not impact your right and obligations based on the contract.
You will generally not receive any information on the individual score that has been awarded to your case, but if you believe that we have handled your case wrongly due to the score, you may ask us to manually reconsider the score by human intervention.
What rights do I have?
It is important you understand that it is your personal data that we process and that we want you to be comfortable with us doing so. Even if we do not need your permission to process your personal data, you have many rights in relation to the processing of your personal data.
Your rights, and what does it mean?
Right to access
- You may request information on how we process your personal data, including information on:
- Why we process your personal data
- What categories of personal data we process
- Who we share your personal data with
- How long we store your personal data or the criteria for determining this period
- What rights you have
- From where we have received your personal data (if we have not received it from you)
- If the processing includes automatic decision making (so-called profiling)
- If your personal data has been transferred to a country outside of the EEA, how we ensure the protection of your personal data.
You may also request a copy of the personal data we process about you. However, additional copies will be combined with a fee.
Right to correction
It is important that we have the right information about you and urge you to let us know if any of your personal data is incorrect, e.g. if you have changed your name or moved.
Right to be forgotten
If we process your personal data in an unlawful way, for example if we process your personal data longer than necessary or for no reason, you may ask us to delete this information.
Right to restriction
From the time you have requested we correct your personal data or if you have objected to the processing and until we have been able to investigate the issue or confirm the accuracy of your personal data (or changed it in accordance with your instructions), you are entitled to restricted processing. This means that we (except for storing the personal data) may process your personal data only in accordance with your consent, if necessary with reference to legal claims, to protect someone else's rights or if there is an important public interest in the processing.
You may also request that we restrict the processing of your personal data if the processing is unlawful but you do not want us to delete the personal data.
Right to objection
If you believe that we do not have the right to process your personal data, or if you want an automated decision to be reconsidered, you may object to our processing. In such cases, we may continue processing only if we can show compelling justifying reasons that out-weigh your interests, rights and freedoms. However, we may always process your personal data if it is required for the determination, exercise or defense of legal claims.
Right to data portability
You may request to have your personal data processed via automated means that you have provided to us for processing based on consent or to fulfill a contract, provided to you in a structured, widely used and machine-readable format. You also have the right to request to transfer that information to another data controller.
Withdrawal of consent
Intrum does not base its processing upon consent. However, given that some processing activities should be based on consent, you are in your right to withdraw it and we will consequently stop the processing activities based on this legal ground.
We will also notify others we may have shared your personal data with of your request(s).
How to complain about the use of your data or exercise my rights?
If you wish to raise a complaint about how we handle your personal data, including in relation to any of the rights outlined above, you can contact our Data Protection Officer directly who will investigate your concerns.
Data Protection Officer: firstname.lastname@example.org
If you are not satisfied with our response, or believe we are processing your data unfairly or unlawfully, you can complain to the Office of the Data Protection Commission. You can find further information about the Office of the Data Protection Commission and their complaints procedure here:
If you have any further questions on how we process your personal data you may contact us through our Data Protection Officer or if you wish to make a request in relation to your data you can make it here.