Your privacy is important to Axactor. It is important to us that you know how we process your personal data, the categories of personal data that we process and for what purposes. Moreover, it is important that you know which rights you have towards Axactor as data controller and how you can claim your rights.
What is personal data?
Personal data is any information that may be linked to a natural person, directly or indirectly, such as name, postal address, e-mail address, IP-address and mobile phone number.
Who is the data controller?
The Axactor legal entity determining the purposes for which and the means by which personal data is processed is the data controller. This means that we in most situations are the data controller for data processing as part of debt collection activities and when purchasing debt, when we process a job application or processing of contact details as part of a process with a customer, vendor or public authorities. For some of our services, we merely act as a data processor processing your personal data on our customer’s instructions e.g. when we provide account receivable management services.
The data controller shall ensure that your personal data is processed in a secure and legal manner in accordance with EU Regulation 2016/679 (GDPR) and national data protection laws.
categories of data subjects
We may process personal data linked to the following categories of data subjects:
- Debtors: natural persons or representatives of legal persons who are subject to debt collection or debt management
- Customer representatives: natural persons who are representatives of our customers, partners or vendors (i.e. contact persons)
- Public authorities and supplier representatives: natural persons who are representatives of our suppliers or public authorities (i.e. contact persons)
- Other data subjects: any other natural person (i.e. persons who visit our websites, job applicants or otherwise get in contact with us)
Why DO WE have access to and process your data?
What categories of personal data do we process?
The categories of personal data that we process vary depending on the data subject and the purpose.
The personal data we may process about representatives of the customer, vendors and public authorities may be categorised as follows:
- Personal details: We hold necessary information for the management of the contractual or prospective business relationship. To be able to communicate with you and to ensure safe and true identification we need your name, job title and contact details such as address, telephone number and email. Depending on the nature of the assignment and the relevant country, we may ask a screening expert to determine whether there are any circumstances which would disqualify you or the company you represent from that assignment.
- National ID number: To be able to comply with our legal obligations related to e.g. anti-money laundering we also may need passport or similar identification and related information.
- Picture and ID: For our employees’ security and to keep your personal data safeguarded we also use video surveillance cameras in several locations and request you to provide e.g. your name and telephone number to enter our location.
The personal data we may process about the debtors may be categorised as follows:
- Personal details, including name, address, postal code, city/town, date of birth, gender, e-mail address, telephone number, etc. for the management of your account and to be able to communicate with you.
- National ID number, such as social security number, passport number, unique identifier or other, issued by a public body to ensure safe and true identification e.g. to comply with our legal obligation to provide your personal data when we are audited by the authorities and to prevent, monitor and evidence fraud, anti-money laundering and other criminal activities.
- Contract details: details relating to the contract between our customer and debtor.
- Financial information: means (a) information obtained from external sources (i.e. public databases, credit rating providers, etc.) related to the debtor, which is processed in relation to the debt collection and (b) any information relating to the payment details arising from the contract (received from the customer) or (c) information from our own debt collection process, hereunder payment history, income, assets, loans, etc. to evaluate your ability to pay, risk analysis and risk management, make payment plans, debt surveillance or portfolio evaluations.
- Confidential information: obtained from debtors during debt collection, i.e. reasons for delayed payment which are considered to be confidential of nature (but not necessarily sensitive data), such as individual or family circumstances, work situation, etc. to better understands your specific situation and to make a well informed decision on how to handle your case, but may also include sensitive data regarding your health and information about criminal convictions
- IP addresses and other technical information: The information we have on you may be anonymized and used for developing of our business. However, when necessary to secure your personal data and ensure appropriate test development of and changes in our IT system your personal data may be used as-is.
- Voice and picture: We use tape of phone conversations to train our personal and to document your rights. For our employees’ security and to keep your personal data safeguarded we also use video surveillance cameras in several locations.
The personal data we may process about job applicants may be categorised as follows:
- Contact details. Such as your name, address, email address, telephone number.
- Information from your resume/cv. Such as your career history, educational history, skills, language fluency and any other information you may choose to include in your resume/cv.
- Motivation letter. Any information you choose to include in your motivation letter.
- Eligibility to work. You may have to demonstrate that you are legally eligible to take work.
- Statement of good standing. Depending on the nature of the role and the relevant country, we may ask you to obtain a statement from the government certifying that you have not been convicted of any crimes which would disqualify you from that role.
The processing of anonymous data, i.e. data that cannot be linked directly or indirectly to a natural person, is not subject to the restrictions described in this policy.
Do we process sensitive personal data?
Sensitive personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person and data concerning health or data concerning a natural person's sex life or sexual orientation.
Unless otherwise agreed with you or is necessary for the establishment, exercise or defense of legal claims, we will not include special categories of personal data.
As a debtor, it may however benefit you to notify us of any health condition, disability and/or personal information relating to your private life that may impact your ability to pay. This will allow us to take reasonable steps to accommodate your needs or requirements such as allowing sufficient breaks in your payment arrangement, providing breathing space to seek free independent debt advice or adjusting your payment arrangement. This information will be used by us to assist you and will be kept as long as it is required for this purpose, or until you notify us that you no longer agree to the processing or it is necessary for the establishment, exercise or defense of legal claims.
If you are a job applicant, we may under certain circumstances process sensitive data, such as data about ethnic background, or information about gender to assist us in ensuring that we have a diverse pool of candidates and employees.
If you are participating on an Axactor event we may ask you to inform of allergies or the like relevant for your well-being when participating.
The legal basis for our processing of your personal data
According to the GDPR, Axactor must base its processing of personal data on a legal basis. Our processing of personal data will be based on one or more of the following as further explained throughout this policy:
- The processing of personal data is necessary for the performance of a contract which you are party to or in order to take steps at your request prior to entering into a contract.
- The processing of personal data is necessary for compliance with a legal obligation, inter alia our obligation to keep information in accordance with the prevailing accounting or anti-money laundering legislation.
- The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
- The processing is necessary for the purposes of our legitimate interest, insofar as this interest is not overridden by your interests or fundamental rights and freedoms which require protection of personal data.
- You have given consent to the processing for one or more specific purposes.
From what sources do we collect personal data about you?
In addition to the information you may provide us with, we may receive information from
- your creditor
- public registries
- credit rating companies
- our own historical information
- social media; such as Facebook, LinkedIn, Google
Representative of customers, vendors, public authorities and others
In addition to the information provided by you, we may receive personal data from your employer being e.g. our customers or supplier.
In addition to the information you provide us with, we may collect information from:
- Internal applications. If you are already employed at Axactor and are applying for another internal position, we can use information from your personnel file to supplement the information you provide us when you apply for the job.
- Assessment. We may ask you to undergo an assessment of your skills, personality or cognitive aptitude. Such assessments are usually performed using third-party software or a third-party company, who will share the results with us. Prior to undergoing such an assessment, we will provide you with further information relevant to your specific situation.
- Pre-employment screening. Depending on the nature of the role and the relevant country, we may ask a pre-employment screening expert to determine whether there are any circumstances which would disqualify you from that role. Whether or not a screening will occur, as well as the scope and purpose will be discussed with you prior to the start of the screening.
- References. We may decide to obtain references from individuals who have worked with you in the past. Generally, we will only contact those individuals if you have provided us with their names and contact details. If you are already an Axactor employee, we may ask for references from your manager and/or co-workers, without your knowledge.
- Social media; Information available on social media (such as Facebook, LinkedIn, Google+ or Instagram), can be collected and used.
Who may we transfer personal data to?
We may transfer your personal data within the Axactor group of companies. Every Axactor employee has committed him/herself to confidentiality.
To be able to fulfill our contractual obligations, we may share the personal data of you as a debtor with our customers whom we are performing debt collection or debt management on behalf of.
We may also share personal data with our agents, lawyers, suppliers e.g. printer and mail services, land registry searches, call center services, field collectors, or another debt collection agency, investors, external advisors or consultants whom we have engaged to perform services or assist us in debt collection or other business processes. Supplier that processes data on our behalf, do so based on a Data Processing Agreement that regulate the responsibilities of the data processor in connection with the processing of the relevant data.
If we have a specific legal basis in law or contract, we may also transfer the person data of the debtors to credit rating companies that are authorized to obtain and process personal data, such as income, debt, etc. for the purpose of providing such information to third parties who perform credit rating or public registers.
If we are to pursue or defend a legal action in connection with the accounts of the debtor, we may transfer the personal data of the debtors to legal advisors/lawyers/bankruptcy estates and the courts.
If you are a job applicant, we may share your personal data with third parties to obtain information from these third parties, service providers helping us performing background checks, providing a recruitment portal or in our assessment of you or in improving our recruiting practices. Our employees bound by an obligation of confidentiality will have access to the personal data.
We may also share personal data with the authorities in cases where we are statutory obligated to do so, this may include regulators, law enforcement authorities, welfare authorities and fraud prevention authorities.
Axactor will ensure adequate safeguards in accordance with applicable law to protect your personal data processed by third party service providers.
DO I HAVE TO PROVIDE YOU WITH MY PERSONAL DATA?
As a representative of a customer or vendor, or as a job applicant you need to provide us with personal data enabling us to communicate with the customer, vendor or you as a job applicant.
As a debtor, you do not have to provide us with any personal data. In fact, most (if not all) personal data that we process about you comes from another source than yourself, i.e your original agreement party, public registers or Credit Reference Agencies. However, you may choose to provide us with additional personal data. Such information may even help us handle your case, and it is usually to your benefit. For example, you may have a valid reason for why you have not paid your debt which you may want to share with us, or if we agree to set up a payment plan to help you pay your debt you may want to provide certain details for making the payment plan reasonable and attuned to your specific situation.
Do we transfer your personal data to countries outside the EU/EEA area?
As we are part of the Axactor group, we may transfer your data to another country. If we do, we will ensure there are suitable safeguards in place to comply with EU General Data Protection Regulation (GDPR). Generally, your personal data will not be transferred outside of the European Economic Area (EEA) unless it is necessary to collect debt and/or pursue a legal claim in a country outside EU/EEA. We also use third-party service providers located outside of EU/EEA whom may access your data, including, but not limited to the United States. We will never transfer your personal data outside of the EEA without ensuring the safety and protection of your personal data. Therefore, we make sure that any recipients have signed the EU Standard Model Clauses, to justify the transfer, or that the country guarantee adequate protection under the data protection legislation. We may also rely on the Privacy Shield program, which is a program where US companies can commit to a higher level of privacy protection than is required by US law. We may disclose information outside of these groups if required by law.
How long do we store your personal data?
We will retain your data as long as required for the lawful purpose for which it was obtained, as long as we have legitimate interest to keep it e.g. until termination of our agreement and/or the statue barring period is due to be able to defend ourselves against legal claims. We are also legally obliged to keep your personal data for a period of time to prevent and detect fraud, detect and evidence anti-money laundering and for financial audits. The retention period will depend on the regulation in the country of the Axactor legal entity processing your personal data.
If you are a job applicant, we will retain your data during the application process and delete it after we have found a suitable candidate. If we have selected you to fill the position, we will retain your personal data in your personnel file in accordance with our HR privacy guidelines. We may process your personal data for a longer period after the application process has ended, if there is a pending legal dispute or if you have given us permission to keep your personal data on record for a longer period of time.
As far as our backups are concerned, we will also delete your data in our backups, but only if and when the back-up tape comes up for restore, according to our backup policy. If the backup comes up for deletion as per back up policy, we will fully delete your data.
do we keep your personal data safe?
We are obliged to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that our processing is performed in accordance with the GDPR and other relevant data protection legislation.
We have implemented several appropriate measures in order to ensure that unauthorized persons do not gain access to your personal data.
WILL YOU BE SUBJECT TO AUTOMATED DECISION-MAKING?
As part of our debt collection Axactor uses scoring. This is necessary for optimizing our service and handling your case in an efficient and timely manner. It is also necessary to ensure compliance with good debt collection practices and avoid unnecessary reminders and fees etc.
A score is awarded by automated means and indicates how you handle your case. The score decides, for example, whether you are likely to pay the debt or that we should forward your case to an Enforcement Agency. We do not consider the scoring to be automated decision-making (as defined in European data protection law) since it does not produce legal effects or similarly significantly affect you as it does not impact your rights and obligations based on the contract.
You will generally not receive any information on the individual score that has been awarded to your case, but if you believe that we have handled your case wrongly due to a score, you may ask us to manually reconsider the score by human intervention.
As a representative of a customer or a vendor, or as a job applicant you will neither be subject to automated decision making.
What are your rights?
What does it mean?
Right to access
You may request information on how we process your personal data, including information on:
You may also request a copy of the personal data we process about you. However, additional copies will be combined with a fee.
Right to correction
It is important that we have the right information about you and encourage you to let us know if any of your personal data is incorrect, e.g. if you have changed your name or moved.
Right to be forgotten
If we process your personal data in an unlawful way, for example if we process your personal data longer than necessary or for no reason, you may ask us to delete this information.
Right to restriction
From the time you have requested we correct your personal data or if you have objected to the processing and until we have been able to investigate the issue or confirm the accuracy of your personal data (or changed it in accordance with your instructions), you are entitled to restricted processing. This means that we (except for storing the personal data) may process your personal data only in accordance with your consent, if necessary with reference to legal claims, to protect someone else's rights or if there is an important public interest in the processing.
You may also request that we restrict the processing of your personal data if the processing is unlawful, but you do not want us to delete the personal data.
Right to objection
If you believe that we do not have the right to process your personal data, or if you want an automated decision to be reconsidered, you may object to our processing. In such cases, we may continue processing only if we can show compelling justifying reasons that out-weigh your interests, rights and freedoms. However, we may always process your personal data if it is required for the determination, exercise or defense of legal claims.
Right to data portability
Where the processing of the personal data is based on consent or a contract and the processing is carried out by automated means, you may have the right to data provided to you in a structured, widely used and machine-readable format. You also have the right to request to transfer that information to another data controller.
Withdrawal of consent
Axactor does not base its processing upon consent. However, given that some processing activities should be based on consent, you are in your right to withdraw it and we will consequently stop the processing activities based on this legal ground.
We will also notify others we may have shared your personal data with of your request(s).
How to complain about the use of your data or exercise my rights?
If you wish to raise a complaint about how we handle your personal data, including in relation to any of the rights outlined above, or you have any further questions on how we process your personal data, please contact our Data Protection Officer locally or through this link:
DP@axactor.com and we will investigate your concerns.
If you are not satisfied with our response, or believe we are processing your data unfairly or unlawfully, you can complain to the Data Inspectorate. You can find further information about the Norwegian Data Inspectorate, being the lead supervisory authority of the Axactor group and their complaints procedure here: https://www.datatilsynet.no/en/about-us/contact-us/
Use of third party websites
In case of material changes, you may receive a notice, either by e-mail or when visiting our website.