Privacy Policy

1 Who this covers

This policy describes what the Debit Management System stores, why, and who it goes to. It covers two different groups of people:

• Users — staff given an account to sign in and operate the System.
• Debtors — people and businesses whose debts are recorded. Debtors have no account and do not sign in, but the System holds information about them.

The organisation operating this installation decides what is recorded and is responsible for it. The System is the tool it uses to do so.

2 What is stored

Information is described here by category. Data protection law requires the categories to be disclosed, not the internal structure of the records, which is not published.

About Users

• Identity and contact details — the name, username and email address held for your account.
• Credentials — your password, kept only in a one-way hashed form. It is never stored readably and cannot be retrieved by anyone, including the operator.
• Preferences — settings such as your chosen interface language.
• Usage and security records — a record of actions taken through your account, together with technical information such as the network address and browser your device reported.

About Debtors

• Identity — the name recorded for the person or business.
• Contact details — the phone, mobile messaging or email address a User recorded in order to make contact.
• Financial information — the amount owed, the currency, the dates agreed, and the record of payments received.
• Commercial context — a description of what the debt relates to, as recorded by a User.
• Free-text notes — anything a User chose to type about the account.
• Communications — reminders sent, the channel used, and whether delivery succeeded.

Not stored: no payment card numbers, bank credentials or identity document numbers. The System takes no payment. Payments are recorded after they happen elsewhere, so no card or bank details pass through it.

3 Where it comes from

• Entered by Users. Nearly all information about a Debtor is recorded by hand by a signed-in User.
• Recorded automatically as the System is used, such as the technical and security information described above.
• Returned by messaging providers, where a reminder has been sent.

Nothing is bought from data brokers, and nothing is collected from Debtors directly — a Debtor never interacts with the System.

4 Why it is held

• To provide the service the operator uses it for: keeping records of debts and payments.
• To contact Debtors about amounts owed, on the instruction of a User.
• For accountability: so that a disputed change can be traced. This protects Users as much as anyone.
• For security: so that unusual or unauthorised access can be identified and investigated.
• To meet record-keeping duties where financial or tax law requires it.

Information is not used for advertising, profiling, automated decision-making, or sold to anyone.

5 Who it is shared with

Data leaves the System only when a reminder is sent, and only to the messaging providers used to deliver it. Each receives no more than what is needed to send that message — the recipient's address or number and the message text — never the full debt record.

Each provider handles that data under its own terms and privacy policy. The providers in use can be identified on request through the contact below.

Data may also be disclosed where the law requires it, or to protect the rights and safety of the operator or others. It is not shared for any other purpose.

These providers operate internationally, so a message may be processed outside your country.

6 Cookies and local storage

No advertising, analytics or third-party tracking cookies are used, and nothing here follows you to other websites.

• A sign-in cookie that keeps you signed in for the length of your session. It is strictly necessary — the System cannot work without it — and is removed when you sign out.
• An optional "remember me" cookie, set only if you tick that box. It holds a revocable token, never your password.
• Browser preferences such as your chosen theme and layout. These are held locally in your browser, are never transmitted to the server, and contain no personal information.

You can clear cookies and local storage at any time through your browser. Clearing the sign-in cookie signs you out.

7 How it is protected

The System applies technical and organisational measures appropriate to the sensitivity of the information it holds. In general terms:

• Passwords are never stored in readable form. They cannot be retrieved or reversed by anyone, including the operator — only replaced.
• Access is restricted. Each account can reach only what it is permitted to, and every request is checked.
• Actions are recorded against the account that took them, so activity can be reviewed and unusual access investigated.
• Input is handled safely and requests are validated, to guard against common classes of web attack.
• Data is backed up so that it can be restored if something goes wrong.
• Access is reviewed and removed when a person no longer needs it.

For security reasons this policy does not describe the specific technologies, configuration or controls in use. Details are available to auditors and regulators on request through the contact below.

No system can be guaranteed secure, and none of the above is a warranty against compromise.

8 How long it is kept

Retention periods are set by the operator in line with its legal, accounting and audit obligations.

• Debt and payment records are kept for as long as the debt is live, and afterwards for any period that financial or tax law requires.
• Records of communications are kept for as long as needed to evidence what was sent.
• Security and accountability records are kept for as long as needed for those purposes.
• User accounts are kept while active. A closed account may be retained so that past actions remain attributable.
• Sign-in and password-reset tokens are short-lived and expire automatically.

Records are removed or anonymised once there is no longer a lawful reason to keep them.

9 Rights of people in the records

Depending on the law that applies, a Debtor or User may be entitled to:

• Ask what is held about them and receive a copy.
• Have inaccurate information corrected.
• Ask for deletion, where no legal or financial duty requires the record to be kept.
• Object to, or ask for a restriction on, how it is used.
• Ask that reminders stop being sent to a particular channel.

Requests go to the contact below. Note that a debt record generally cannot be erased while the debt is live or while accounting law requires it to be kept — but it can be corrected, and messaging can be stopped.

10 If something goes wrong

If a breach affecting personal data is discovered, the operator will investigate, take steps to contain it, and notify the people affected and any regulator where the law requires.

If you think data has been exposed, or you can see records you should not be able to, report it to the contact below rather than exploring further.

11 Changes to this policy

This policy may be updated as the System changes. The date at the top shows when it last did. Where a change materially affects how personal data is handled, Users will be told before it takes effect.

12 Contact

For access requests, corrections, deletion requests, or any privacy question:

See also the Terms of Service.