Privacy declaration

What is personal data?

Personal data is any information that may be linked to a natural person, directly or indirectly, such as name, postal address, e-mail address, IP-address and mobile phone number.

Who is the data controller?

The Axactor legal entity determining the purposes for which and the means by which personal data is processed is the data controller. This means that we in most situations are the data controller for data processing as part of debt collection activities and when purchasing debt, when we process a job application or processing of contact details as part of a process with a customer, vendor or public authorities. For some of our services, we merely act as a data processor processing your personal data on our customer’s instructions e.g. when we provide account receivable management services.

The data controller shall ensure that your personal data is processed in a secure and legal manner in accordance with EU Regulation 2016/679 (GDPR) and national data protection laws.

Categories of data subjects

We may process personal data linked to the following categories of data subjects:

• Debtors: natural persons or representatives of legal persons who are subject to debt collection or debt management
• Customer representatives: natural persons who are representatives of our customers, partners or vendors (i.e. contact persons)
• Public authorities and supplier representatives: natural persons who are representatives of our suppliers or public authorities (i.e. contact persons)
• Other data subjects: any other natural person (i.e. persons who visit our websites, job applicants or otherwise get in contact with us)

Why do we have access to and process your data?

Debtors

It is in the public interest to collect debts. We have a legitimate interest to process your personal data when the creditor has assigned claims arising from a contract between you and the creditor to us for debt collection or we have purchased the claim.

This means we have the legal right to process your personal data without your prior approval. In accordance with our legitimate interest, we may also undertake tracing activities, scoring to ensure effective service and compliance with good debt collection practices, enrich the data from different sources e.g. Credit Reference Agencies, historical cases we hold on you and public registers, verify that the data we hold is correct and share your data with approved third parties such as other public and private collection servicers and Credit Reference Agencies. Please contact us if you’d like to know more about how we have evaluated our legitimate interest. Your data will be held securely in compliance with data protection legislation.

As part of our investments, we may also process your personal data in order to make valuations of your claim(s) or of a portfolio that includes your claim(s), and further sell and transfer your claim(s) and conduct statistical analysis or modelling. When we purchase your debt from your original agreement party, we mainly receive pseudonymized or anonymized data as part of the purchasing process and use the pseudonymised statistical and financial information we hold to predict the forecast of the portfolios. When the debt has been purchased, we will be your new agreement party. When we later collect the debt, we do that to fulfil our agreement and to carry out our task and process your personal data based on legitimate interest. Axactor may purchase the portfolio containing your debt through one of our investment companies and outsource the collection of the debt to our local collection company as informed of in the welcoming letter sent you. Both companies will act as independent controllers of your personal data, as defined under applicable data protection legislation. The legal entity that has purchased your debt has outsourced the handling of any requests and notifications to the local collection entity as informed in the letter sent you.

Customer, vendor and others

To enter into and fulfil the agreement we have with you or the company you are representing, processing of your personal data is necessary. We may also process personal data about visitors to our website(s) or physical locations, depending on how you chose to interact with us. You may be interested in courses or events we offer or information we provide.

We will only process your personal data if we have a legal ground to do so. This means that the processing must be necessary for the performance of a contract to which you or the company you represent is a party or to take steps at the request of you prior to entering into a contract. In accordance with our legitimate interest, we may also use your data to provide you with information about our services, prospects, analyses, events, trainings which are likely to be in your best interest or being able to execute necessary or desired tasks expected by the business relationship you represent. Please use the contact information below if you’d like to know more about how we have evaluated our legitimate interest.

We may also process your data if you have applied for a job in Axactor to ascertain whether you are a qualified candidate for the role you have applied for.

We may process personal data for the purposes of resolving disputes, complaints or legal procedures and to comply with the law or a judicial order.

We have a legal obligation to provide your personal data when we are audited by the authorities and to prevent, monitor and evidence fraud, anti-money laundering and other criminal activities.

Security

In order to secure our network and information, we must prevent circumstances, events, or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data.

What categories of personal data do we process?

The categories of personal data that we process vary depending on the data subject and the purpose.

The personal data we may process about representatives of the customer, vendors and public authorities may be categorised as follows:

• Personal details; We hold necessary information for the management of the contractual or prospective business relationship. To be able to communicate with you and to ensure safe and true identification we need your name, job title and contact details such as an address, telephone number and email. Depending on the nature of the assignment and the relevant country, we may ask a screening expert to determine whether there are any circumstances that would disqualify you or the company you represent from that assignment.
• National ID number; To be able to comply with our legal obligations related to e.g. anti-money laundering we also may need a passport or similar identification and related information.
• Picture and ID; For our employees’ security and to keep your personal data safeguarded we also use video surveillance cameras in several locations and request you to provide e.g. your name and telephone number to enter our location.

The personal data we may process about the debtors may be categorised as follows:

• Personal details, including name, address, postal code, city/town, date of birth, gender, e-mail address, telephone number, etc. for the management of your account and to be able to communicate with you.
• National ID number, such as social security number, passport number, unique identifier or other, issued by a public body to ensure safe and true identification e.g. to comply with our legal obligation to provide your personal data when we are audited by the authorities and to prevent, monitor and evidence fraud, anti-money laundering and other criminal activities.
• Contract details: details relating to the contract between our customer and debtor.
• Financial information: means (a) the information obtained from external sources (i.e. public databases, credit rating providers, etc.) related to the debtor, which is processed in relation to the debt collection and (b) any information relating to the payment details arising from the contract (received from the customer) or (c) information from our own debt collection process, hereunder payment history, income, assets, loans, etc. to evaluate your ability to pay, risk analysis and risk management, make payment plans, debt surveillance or portfolio evaluations.
• Confidential information: obtained from debtors during debt collection, i.e. reasons for delayed payment which are considered to be confidential of nature (but not necessarily sensitive data), such as individual or family circumstances, work situation, etc. to better understands your specific situation and to make a well-informed decision on how to handle your case, but may also include sensitive data regarding your health and information about criminal convictions
• IP addresses and other technical information: The information we have on you may be anonymized and used for developing our business. However, when necessary to secure your personal data and ensure appropriate test development of and changes in our IT system your personal data may be used as-is.
• Voice and picture: We use tape of phone conversations to train our personal and to document your rights. For our employees’ security and to keep your personal data safeguarded we also use video surveillance cameras in several locations.

The personal data we may process about job applicants may be categorised as follows:

• Contact details. Such as your name, address, email address, telephone number.
• Information from your resume/cv. Such as your career history, educational history, skills, language fluency and any other information you may choose to include in your resume/cv.
• Motivation letter. Any information you choose to include in your motivation letter.
• Eligibility to work. You may have to demonstrate that you are legally eligible to take work.
• Statement of good standing. Depending on the nature of the role and the relevant country, we may ask you to obtain a statement from the government certifying that you have not been convicted of any crimes which would disqualify you from that role.

The processing of anonymous data, i.e. data that cannot be linked directly or indirectly to a natural person, is not subject to the restrictions described in this declaration.

Do we process sensitive personal data?

Sensitive personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person and data concerning health or data concerning a natural person's sex life or sexual orientation.

Unless otherwise agreed with you or is necessary for the establishment, exercise or defence of legal claims, we will not include special categories of personal data.

As a debtor, it may, however, benefit you to notify us of any health condition, disability and/or personal information relating to your private life that may impact your ability to pay. This will allow us to take reasonable steps to accommodate your needs or requirements such as allowing sufficient breaks in your payment arrangement, providing breathing space to seek free independent debt advice or adjusting your payment arrangement. This information will be used by us to assist you and will be kept as long as it is required for this purpose, or until you notify us that you no longer agree to the processing or it is necessary for the establishment, exercise or defence of legal claims.

If you are a job applicant, we may under certain circumstances process sensitive data, such as data about ethnic background, or information about gender to assist us in ensuring that we have a diverse pool of candidates and employees.

If you are participating in an Axactor event we may ask you to inform of allergies or the like relevant for your well-being when participating.

The legal basis for our processing of your personal data

According to the GDPR, Axactor must base its processing of personal data on a legal basis. Our processing of personal data will be based on one or more of the following as further explained throughout this declaration:

• The processing of personal data is necessary for the performance of a contract which you are party to or in order to take steps at your request prior to entering into a contract.
• The processing of personal data is necessary for compliance with a legal obligation, inter alia our obligation to keep information in accordance with the prevailing accounting or anti-money laundering legislation.
• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• The processing is necessary for the purposes of our legitimate interest, insofar as this interest is not overridden by your interests or fundamental rights and freedoms which require protection of personal data.
• You have given consent to the processing for one or more specific purposes.

From what sources do we collect personal data about you?

Debtor
In addition to the information you may provide us with, we may receive information from

• your creditor
• public registries
• credit rating companies
• our own historical information
• social media; such as Facebook, LinkedIn, Google

Representative of customers, vendors, public authorities and others
In addition to the information provided by you, we may receive personal data from your employer being e.g. our customers or supplier.

Job applicant
In addition to the information you provide us with, we may collect information from:

• Internal applications. If you are already employed at Axactor and are applying for another internal position, we can use information from your personnel file to supplement the information you provide us when you apply for the job.
• Assessment. We may ask you to undergo an assessment of your skills, personality or cognitive aptitude. Such assessments are usually performed using third-party software or a third-party company, who will share the results with us. Prior to undergoing such an assessment, we will provide you with further information relevant to your specific situation.
• Pre-employment screening. Depending on the nature of the role and the relevant country, we may ask a pre-employment screening expert to determine whether there are any circumstances that would disqualify you from that role. Whether or not a screening will occur, as well as the scope and purpose will be discussed with you prior to the start of the screening.
• References. We may decide to obtain references from individuals who have worked with you in the past. Generally, we will only contact those individuals if you have provided us with their names and contact details. If you are already an Axactor employee, we may ask for references from your manager and/or co-workers, without your knowledge.
• Social media; Information available on social media (such as Facebook, LinkedIn, Google+ or Instagram), can be collected and used.

Who may we transfer personal data to?

We may transfer your personal data within the Axactor group of companies. Every Axactor employee has committed him/herself to confidentiality.

To be able to fulfil our contractual obligations, we may share the personal data of you as a debtor with our customers whom we are performing debt collection or debt management on behalf of.

We may also share personal data with our agents, lawyers, suppliers e.g. printer and mail services, land registry searches, call centre services, field collectors, or another debt collection agency, investors, external advisors or consultants whom we have engaged to perform services or assist us in debt collection or other business processes. A supplier that processes data on our behalf, do so based on a Data Processing Agreement that regulates the responsibilities of the data processor in connection with the processing of the relevant data.

If we have a specific legal basis in law or contract, we may also transfer the person data of the debtors to credit rating companies that are authorized to obtain and process personal data, such as income, debt, etc. for the purpose of providing such information to third parties who perform credit rating or public registers.

If we are to pursue or defend a legal action in connection with the accounts of the debtor, we may transfer the personal data of the debtors to legal advisors/lawyers/bankruptcy estates and the courts.

If you are a job applicant, we may share your personal data with third parties to obtain information from these third parties, service providers helping us performing background checks, providing a recruitment portal or in our assessment of you or in improving our recruiting practices. Our employees bound by an obligation of confidentiality will have access to the personal data.

We may also share personal data with the authorities in cases where we are statutory obligated to do so, this may include regulators, law enforcement authorities, welfare authorities and fraud prevention authorities.

Axactor will ensure adequate safeguards in accordance with applicable law to protect your personal data processed by third-party service providers.

Do I have to provide you with my personal data?

As a representative of a customer or vendor, or as a job applicant you need to provide us with personal data enabling us to communicate with the customer, vendor or you as a job applicant.

As a debtor, you do not have to provide us with any personal data. In fact, most (if not all) personal data that we process about you comes from another source than yourself, i.e your original agreement party, public registers or Credit Reference Agencies. However, you may choose to provide us with additional personal data. Such information may even help us handle your case, and it is usually to your benefit. For example, you may have a valid reason for why you have not paid your debt which you may want to share with us, or if we agree to set up a payment plan to help you pay your debt you may want to provide certain details for making the payment plan reasonable and attuned to your specific situation.

Do we transfer your personal data to countries outside the EU/EEA AREA?

As we are part of the Axactor group, we may transfer your data to another country. If we do, we will ensure there are suitable safeguards in place to comply with EU General Data Protection Regulation (GDPR). Generally, your personal data will not be transferred outside of the European Economic Area (EEA) unless it is necessary to collect debt and/or pursue a legal claim in a country outside EU/EEA. We also use third-party service providers located outside of EU/EEA whom may access your data, including, but not limited to the United States. We will never transfer your personal data outside of the EEA without ensuring the safety and protection of your personal data. Therefore, we make sure that any recipients have signed the EU Standard Model Clauses, to justify the transfer, or that the country guarantees adequate protection under the data protection legislation. We may also rely on the Privacy Shield program, which is a program where US companies can commit to a higher level of privacy protection than is required by US law. We may disclose information outside of these groups if required by law.

How long do we store your personal data?

We will retain your data as long as required for the lawful purpose for which it was obtained, as long as we have legitimate interest to keep it e.g. until termination of our agreement and/or the statue barring period is due to be able to defend ourselves against legal claims. We are also legally obliged to keep your personal data for a period of time to prevent and detect fraud, detect and evidence anti-money laundering and for financial audits. The retention period will depend on the regulation in the country of the Axactor legal entity processing your personal data.

If you are a job applicant, we will retain your data during the application process and delete it after we have found a suitable candidate. If we have selected you to fill the position, we will retain your personal data in your personnel file in accordance with our HR privacy guidelines. We may process your personal data for a longer period after the application process has ended, if there is a pending legal dispute or if you have given us permission to keep your personal data on record for a longer period of time.

As far as our backups are concerned, we will also delete your data in our backups, but only if and when the back-up tape comes up for restore, according to our backup policy. If the backup comes up for deletion as per back up policy, we will fully delete your data.

Do we keep your personal data safe?

We are obliged to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that our processing is performed in accordance with the GDPR and other relevant data protection legislation.

We have implemented several appropriate measures in order to ensure that unauthorized persons do not gain access to your personal data.

Will you be subject to automated decision-making?

As part of our debt collection, Axactor uses scoring. This is necessary for optimizing our service and handling your case in an efficient and timely manner. It is also necessary to ensure compliance with good debt collection practices and avoid unnecessary reminders and fees etc.
A score is awarded by automated means and indicates how you handle your case. The score decides, for example, whether you are likely to pay the debt or that we should forward your case to an Enforcement Agency. We do not consider the scoring to be automated decision-making (as defined in European data protection law) since it does not produce legal effects or similarly significantly affects you as it does not impact your rights and obligations based on the contract. You will generally not receive any information on the individual score that has been awarded to your case, but if you believe that we have handled your case wrongly due to a score, you may ask us to manually reconsider the score by human intervention.

As a representative of a customer or a vendor, or as a job applicant you will neither be subject to automated decision making.

How to complain about the use of your data or exercise my rights?

If you wish to raise a complaint about how we handle your personal data, including in relation to any of the rights outlined above, or you have any further questions on how we process your personal data, please contact our Data Protection Officer locally or through this link: DP@axactor.com and we will investigate your concerns.

If you are not satisfied with our response or believe we are processing your data unfairly or unlawfully, you can complain to the Data Inspectorate. You can find further information about the Norwegian Data Inspectorate, being the lead supervisory authority of the Axactor group and their complaints procedure here: https://www.datatilsynet.no/en/about-us/contact-us/

Use of cookies

We use so-called cookies on our websites. A cookie is a small text file sent to your browser and placed on your computer, tablet or mobile device when you visit a website. It can be used to remember information about your visit and may, for example, be used to track your preferences. Please read more about our use of cookies in our cookie policy.

Use of third-party websites

We may link to third-party websites via our website. By clicking on one of these links, you will be referred directly to a website that is not controlled by us. Please observe that we are not responsible for third party websites and that our cookie policy and this privacy declaration do not apply when using these websites.

Amendments to this privacy declaration

We are constantly developing our services. We may therefore from time to time need to update our privacy declaration. All amendments to this privacy declaration will be made available on our web site, www.axactor.com.

In case of material changes, you may receive a notice, either by e-mail, post or when visiting our website.