Privacy Statement

1. Who are we

This website is operated by Link Financial Outsourcing Limited (referred to as “we”, “us” or “our” in this privacy statement). We take privacy seriously and we are open and transparent about how we handle your personal information and about our obligations under applicable data protection laws and regulations, including the General Data Protection Regulation (the “GDPR”) and the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time).

This privacy statement explains the basis on which we will control and process any personal information we collect from you or that you may provide to us through this website or otherwise. We are responsible for any such personal data in our capacity as a data controller or as a data processor, as determined in accordance with applicable data protection legislation.

We have tried to keep this statement as straightforward as possible. However, if you require any further information or clarification then please contact us directly at:

Link Financial Outsourcing Ltd, Brecon House, Caerphilly Business Park, Caerphilly CF83 3GQ

Telephone number: 02920 85 3600

Email address: [email protected]

2. Do we have a Data Protection Officer

Yes, given the nature of our business and the data that we hold we have appointed a Data Protection Officer to help ensure that your rights are protected. You can contact our Data Protection Officer at the following email address: [email protected] or write to the Data Protection Officer at the address listed above.

3. What information do we collect

Personal data means any information capable of identifying an individual. It does not include anonymised data.

Personal Data

We may process the following categories of personal data about you:

• Customer data – this includes data such as names, title, address, phone number, email address, financial details and circumstances and employment details.
• Client data – this includes data such as names, title, address, email address for the purposes of carrying out know your client and anti-money laundering checks.
• Financial data – this includes details about your accounts including your account number and outstanding balance. It also includes income and expenditure data and information from credit reference agencies, such as your credit history, payment history and information about defaults and missed payments.
• Communication data – this includes any communication that you send to us whether that be via email, telephone or any other method.
• Technical data – this includes data about how you use our website such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details of the number of times you use our website. The source of this data is our analytics tracking system.

If you do not provide personal data we ask for, it may delay or prevent us from performing our contract with you and providing these services.

Profiling and automated decision-making

We do not carry out automated decision-making.

We may carry out profiling to make decisions about your account. Using the information that:

• we collect from you about your accounts with us; or
• we have obtained from the previous owner of your account;

We use a system from a third party (Transunion) to predict how likely you are to pay your balance.  This is known as profiling which means that we use our computer systems to help us predict this information about you. As we are required to service your account, we have a legitimate interest in understanding how likely you are to pay your balance. Where we process your information on the basis of “legitimate interests”, we make sure that those legitimate interests do not override your interests, rights and freedoms.

You can find out more about profiling and automated decision-making on the ICO website by clicking here.

Special Category Data

We require your explicit consent if we process special category data (e.g. health data). Where relevant, we will send you a further communication asking you to confirm your consent for this processing.

If we believe you are in immediate danger, we may process information relating to your physical and mental health conditions (including sharing this information with the emergency services) on the basis that it is necessary to protect your economic well-being.

4. How do we collect your data

We may collect data about you when you provide the data directly to us (for example, by sending us emails or through other forms of correspondence we have with you such as phone calls).  We may also collect data when you set up an online account through our website and fill in forms on our website.

We may obtain data about you from the previous (or current) owner of your account.

Third parties that we appoint may collect data from you and pass it on to us. We may also use third party data sources such as Land Registry, Credit Reference Agencies (CRAs), registers of court judgments, bankruptcies, postcode lookup databases and telephone number verification databases.

We may automatically collect certain data from you as you use our website through our use of cookies and similar technologies. Please see our cookie policy for more details about this.

We may receive data from third parties such as analytics providers for example, Google, some of which may be based outside the United Kingdom and/or the European Economic Area. Please see section 11 below for further details.

5. What do we do with your information

We may use your information on any of the following lawful grounds:

1. For the performance of a contract with you; or
2. For compliance with a legal obligation to which we are subject; or
3. For the purposes of our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms.

Our legitimate interests include the following:

• To conduct our business as an asset manager;
• To communicate with you;
• To provide, monitor and improve any service we offer to you;
• To manage and maintain relationships with you and for ongoing customer service;
• For record keeping;
• To generate reports;
• To monitor and record calls for quality, business analysis, training and related purposes in order to improve any service we offer you;
• To protect our legal rights and interests including screening for fraud prevention and anti-money laundering purposes;
• For the establishment, pursuance or defence of complaints, investigations and legal claims;
• To operate and ensure the security of our website;
• To maintain back-ups of our website or databases;
• To analyse your use of our website;
• To deliver relevant website content;
• To grow our business;
• To decide our marketing strategy (to the extent that we market to customers as a result of this, we will rely on our legitimate interests or otherwise obtain consent from customers).
• To meet our regulatory, legal and/or compliance requirements.

6. Who do we share your information with

The three main credit reference agencies TransUnion, Equifax and Experian ( also called CRAs) each use and share personal data they receive about you that is part of, derived from or used in credit activity and this is explained in more detail in the Credit Reference Agency Information Notice (CRAIN)  available at any of the following: TransUnion (www.transunion.co.uk/legal/privacy-centre/pc-credit-reference.); Equifax (www. Equifax.co.uk/crain) and Experian (www.experian.co.uk/crain)

We may share your information with our employees, directors, shareholders and to those of our affiliates (and our trading names which include Honours Student Loans, Thesis Servicing and Elmwood Park), financial institutions, the previous or current owner of your loan (or their advisers and third party service providers), investment companies, accountants, lawyers, auditors, insurers, professional advisors, or other third party service providers who provide services to us such as those that assist us with running our business (e.g. IT service providers) and asset management companies. We may also disclose information we have a legal or regulatory right or obligation to report. Further, we may share your information with third parties to whom we sell, transfer or merge parts of our business or our assets.

If we instruct third party debt collection agencies and third party law firms to act on our behalf to recover the debt you owe, take legal action and enforce any judgments that we may have against you, we will share your information with them.

Where you have asked a third party such as StepChange, Pay Plan or Citizens Advice to support you with your account, we may share your information and discuss your account with them.

If you pay via Direct Debit, we will share your data with the Direct Debit scheme.

It is our commitment that prior to disclosing any personal information about you to another organisation we have taken all reasonable steps to ensure that that organisation will hold and protect your information with adequate security measures and in accordance with relevant regulation.

7. How do we keep your information safe

We protect your information with appropriate security measures under the laws and regulations that apply to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed without authorisation. We confirm our security measures are subject to regular testing and updated as appropriate to the level of data that we hold.

We have procedures in place to deal with suspected personal data breaches and will notify you and any applicable regulator of a breach if we are legally required to do so.

8. How long do we keep your information for

We will only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

When deciding what the correct time is for which we should keep the data, we look at its amount, nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the processing purposes, whether these can be achieved by other means and legal requirements.

For tax purposes, in certain circumstances the law requires us to keep information about customers (including Customer, Client, Investor and Communication Data) for six years after they stop being customers.

In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. What are your rights regarding your information

You have explicit rights concerning your personal information and we will ensure that your rights are protected while your data is in our possession. Your rights include the following:

• Right of Access – you may request a copy of all the personal information we hold about you and we will respond within one month. If your request is particularly complex or you have made a number of requests, we may extend this period by a further two calendar months and we shall explain our reasons.
• Right of Deletion – You may wish to have certain data we hold deleted and we will comply with this right where, for example, it is no longer necessary for us to hold the data or if there is no lawful ground for processing.
• Right of Rectification – You have a right to request that any incorrect, inaccurate or incomplete data is updated, corrected and/or completed.
• Right of Restriction – You may wish to restrict us from using your data where, for example, you contest the accuracy of the data.
• Right to Object – You have a right to object to us using your data where processing is carried out for direct marketing or for our legitimate interest. We will no longer process your data unless we can demonstrate compelling legitimate grounds.
• Right to Data Portability – You have a right to request we share your data with another organisation and we will assist with that process where possible.

You will not have to pay a fee to access your personal data (or to access any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Please note that we may ask you to provide us with additional documentation to verify your identity before we action your request. This is to ensure we are dealing with the correct individual and also for Anti-Money Laundering purposes. We will tell you when we ask for your information whether it is a statutory or contractual requirement to give us the information and the consequences of not providing the information.

Right to withdraw consent

Where we are relying on consent to process your personal data you have the rights to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

 

10. Making a complaint

If you wish to make a complaint then you may do so in person, by telephone, in writing and/or by email. Please note that all complaints are dealt with according to our complaints policy and will be fully logged and investigated.

You can also contact the supervisory body for data protection issues for your relevant jurisdiction, as set out below:

(i) UK – The Information Commissioner’s Office (ICO) (www.ico.org.uk)
(ii) Jersey – Jersey Office of the Information Commissioner (www.jerseyoic.org)
(iii) Guernsey – The Office of the Data Protection Authority (www.odpa.gg)
(iv) Isle of Man – The Isle of Man Information Commissioner (www.gov.im/about-the-government/offices/isle-of-man-information-commissioner)

11. General

We will not transfer your data to a country outside of the United Kingdom and/or the European Economic Area unless that country ensures an adequate level of data protection, has appropriate safeguards in place or relies on one of the derogations provided for under applicable law and regulation.

This site may contain links to other sites. We are not responsible for their privacy practices or content nor potential damage, loss or offence caused.

It is very important that the information we hold about you is accurate and up-to-date. Please let us know if at any time your personal information changes by contacting us via the details set out above.

This privacy statement was first published in May 2018 and last updated in November 2025. This may be updated by us at any time. When we make any material changes to this statement, we will communicate these to you appropriately.

Link Financial Outsourcing Limited, November 2025