Purpose
This Privacy Notice explains how and why Equivo Limited processes personal data, who we share personal data with, how long we keep it, and the rights individuals have in relation to the personal data we process about them. This is a general Privacy Notice for Equivo Limited. For applicants, please refer to our Applicant Privacy Notice.
We may update this Privacy Notice from time to time to reflect changes in data protection law, regulatory requirements, our business activities, technology or operational processes. The most up to date version will be made available on our website and in hard copy on request.
In this Privacy Notice, references to “we”, “us” and “our” mean Equivo Limited (“Equivo”).
About Equivo
Equivo is a trading name of Equivo Limited. Equivo Limited is a limited liability company registered in England and Wales under company number 12058753. Our registered office is Abbots House, Abbey Street, Reading, RG1 3BD. The addresses and contact information for our trading addresses can be found under the “Contact us” section of our website.
Equivo Limited is authorised and regulated by the Financial Conduct Authority (FCA). Our Firm Reference Number is 845356. Details can be found on the Financial Services Register at register.fca.org.uk.
Equivo Limited is also authorised and regulated by the Solicitors Regulation Authority (SRA). Our SRA number is 811299. The SRA Standards and Regulations can be accessed at www.sra.org.uk/solicitors/standards-regulations.
Equivo Limited is authorised by the Ministry of Justice and provides services across the recoveries lifecycle, including Collections and Field, and Enforcement activities.
Equivo is registered with the Information Commissioner’s Office (ICO) under registration number ZA542203.
For most of the processing described in this Privacy Notice, Equivo acts as a data controller. This means that we determine why and how personal data is processed. In limited circumstances, Equivo may act as a data processor and will process personal data only on documented instructions from the relevant controller.
How the law protects personal information
We process personal data only where we have a lawful basis to do so under applicable data protection law. References to “data protection law” in this notice include the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable amendments made by the Data (Use and Access) Act 2025.
Lawful bases we rely on
Depending on the purpose of processing, we may rely on one or more of the following lawful bases:
- Legitimate interests – where processing is necessary for our legitimate business interests, or those of our clients or a third party, and those interests are not overridden by the rights and freedoms of the individual.
- Legal obligation – where processing is necessary to comply with obligations imposed by law or regulation, including fraud prevention, anti-money laundering, regulatory record keeping and obligations relating to vulnerable customers.
- Contract – where processing is necessary to enter into or perform a contract with a client, supplier, employee or other party.
- Consent – where we ask for consent for a specific activity. Where consent is relied on, it can be withdrawn at any time.
- Vital interests – where processing is necessary to protect someone’s life or physical safety.
- Recognised legitimate interests – where applicable under data protection law, for specified purposes such as crime prevention, safeguarding, emergency response, public security or other recognised purposes set out in legislation.
Processing personal information
Debt collection and enforcement services are provided in the public interest. Where we receive an instruction from a client to provide debt collection or enforcement services, the processing of personal data may be necessary and lawful even where the individual has not consented to the processing.
Depending on the matter, we may process personal data to:
- carry out debt collection and enforcement services;
- verify and maintain accurate contact and account records;
- enhance or validate data using appropriate sources, including Credit Reference Agencies and approved suppliers;
- trace individuals, vehicles and assets;
- review historical cases or accounts previously issued to us;
- undertake quality assurance and compliance monitoring to support good debt collection and enforcement practices;
- search public registers and other lawful public sources;
- handle queries, complaints, disputes, data protection requests and regulatory enquiries;
- prevent and detect fraud, money laundering and other financial crime; and
- maintain internal records, management information, audit trails and regulatory evidence.
We will verify, where appropriate, that personal data is accurate and may share data with approved third parties such as Credit Reference Agencies, solicitors, Equivo agents, Certificated Enforcement Agents, regulators and other authorised third parties where required or appropriate.
Information we obtain, process and/or store
The categories of personal data we process will vary depending on our relationship with the individual and the nature of the account, case, instruction or service. We may process:
- full name, title, date of birth and contact details;
- current and former residential addresses;
- email addresses and mobile or landline telephone numbers;
- vehicle registration and registered keeper details;
- National Insurance number and driving licence number where relevant;
- trading name, business name or company name;
- credit reference data and information obtained from credit or tracing checks;
- employment status, employment details and financial information where relevant to affordability or account management;
- income and expenditure information, payment history, account notes, case history and information relating to a debt;
- bank details where provided or authorised for payment purposes;
- information held by our client, claimant or creditor in relation to an account;
- information relating to visits, property, enforcement activity and body worn video or audio recordings;
- caller line identification, telephone call recordings and communication records;
- information obtained from public sources, such as public registers and publicly available online sources; and
- technical information about visits to our website, including IP address and cookie or similar technology data.
Special categories of personal data we collect
When carrying out debt collection or enforcement activities, we may need to understand whether an individual may be vulnerable or may require reasonable adjustments. We may ask for, or individuals may volunteer, information about personal circumstances, including health, disability, medical conditions, pregnancy, accessibility needs, religious beliefs, dietary requirements or other sensitive information.
We will process special category data only where an appropriate condition applies, such as explicit consent, the establishment, exercise or defence of legal claims, the protection of vital interests, or another condition permitted by data protection law. Where consent is used, the individual may withdraw that consent at any time, although this may not affect processing already carried out or processing we must continue for legal or regulatory reasons.
How we collect personal information
We may collect personal data from:
- our clients, claimants or creditors;
- Credit Reference Agencies;
- third party tracing agencies and approved suppliers;
- public sources such as public registers, search engines or information available on the internet;
- the Driver and Vehicle Licensing Agency (DVLA);
- the Motor Insurance Database (MID);
- information obtained during visits made by or on behalf of Equivo;
- information provided by parties present during visits;
- body worn video recording equipment used by or on behalf of Equivo;
- information provided directly by individuals;
- our website, including through cookies and similar technologies; and
- regulators, courts, public authorities, law enforcement bodies, professional advisers and other authorised sources where relevant.
Who we share personal information with
Where appropriate and lawful, we may share personal data with:
- our clients, claimants or creditors;
- our collection agents and Certificated Enforcement Agents;
- third party agents and approved advisers, including debt collection agencies, tracing agents, process servers and solicitors;
- our regulators, the Financial Ombudsman Service, the Legal Ombudsman where applicable, the ICO, courts, HM Courts and Tribunals Service, law enforcement agencies, local or central government bodies and social or welfare organisations;
- fraud prevention agencies and anti-money laundering or financial crime screening providers;
- our independent financial, legal or professional advisers;
- approved consultants, subcontractors, processors and suppliers who provide goods or services to us;
- executors of an estate and authorised representatives;
- HM Land Registry, DVLA, MID, the Insolvency Service and insolvency practitioners;
- debt management companies or other third parties nominated or authorised by an individual;
- Credit Reference Agencies and other data suppliers, including the Credit Reference Agency Information Notices; and
- other parties where required by law, regulation, court order, regulatory request or to protect rights, property, safety, or the integrity of our services.
Where we use processors or approved suppliers, we take appropriate steps to safeguard personal data and relevant rights and freedoms under data protection law.
Changes to corporate structure
If our business structure changes, for example through sale, transfer, merger, acquisition or restructuring, we may need to share personal data with another party. We will do this only where appropriate safeguards are in place and where the recipient agrees to keep the data safe and use it in a way that is consistent with this Privacy Notice or any updated notice provided at the relevant time.
International transfers and overseas access
We do not send your personal information outside of the UK.
We reserve the right for data to be accessed outside of the UK/EEA strictly for support purposes only. If our approach changes materially, we will update this Privacy Notice.
Marketing
We do not carry out marketing activities that use customer personal information.
How long we keep personal information
We retain personal data for as long as required for the lawful purpose for which it was obtained and for as long as we have a lawful reason, legal obligation or legitimate interest to keep it. This may include retaining information to evidence good debt collection and enforcement practices, comply with regulatory and legal requirements, prevent and detect fraud or financial crime, detect and evidence money laundering, respond to regulators, support audits, handle complaints and defend legal claims.
In cases where a debt remains due and payable, data may be retained until the debt is extinguished, paid, settled, closed or otherwise processed in accordance with applicable retention rules.
Data will be maintained in accordance with Equivo’s Data Retention Policy.
We may retain information for longer where required to comply with legal or regulatory obligations, answer requests from regulators, support legal proceedings, respond to complaints or preserve records where a litigation, audit, regulatory or investigation hold applies. If we no longer need to keep information, we will delete, destroy or anonymise it securely.
Your data protection rights
Individuals have rights under data protection law. These rights are not absolute and may be subject to exemptions or limitations depending on the circumstances.
Right to be informed: You have the right to be informed about how we collect and use personal data. This Privacy Notice is intended to provide that information.
Right of access: You may ask for confirmation that we process personal data about you and request a copy of your personal data. This is known as a data subject access request or DSAR.
Right to rectification: You may ask us to correct inaccurate or incomplete personal data.
Right to erasure: You may ask us to delete personal data in certain circumstances. This right is not absolute and we may need to retain data for legal, regulatory, complaints, fraud prevention, financial crime, audit or legal claim purposes.
Right to object: You may object to processing in certain circumstances. Where we rely on legitimate interests, we may continue processing if we can demonstrate compelling legitimate grounds which override the rights and freedoms of the individual.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format.
Right to restrict processing: You may ask us to restrict processing in certain circumstances, including while we verify accuracy or consider an objection.
Rights relating to automated decision-making: You have rights where a decision is made solely by automated means and has legal or similarly significant effects. Equivo does not undertake solely automated decision-making or profiling of this type. Where automated processing tools are used to support operational activity, accounts are subject to human review at appropriate points throughout their lifecycle.
Data Subject Access Requests
Where an individual makes a DSAR, we will respond in accordance with applicable data protection law. We will carry out reasonable and proportionate searches for personal data. If we require additional information to identify the requestor, clarify the request or locate the relevant data, the response period may be paused while we await the information needed to proceed. We may refuse to respond or charge a reasonable fee where permitted by law, for example where a request is manifestly unfounded or excessive.
When responding to DSARs, we may withhold or redact information where an exemption applies, including where disclosure would reveal third party personal data, legally privileged information, confidential information, or information connected with legal or enforcement proceedings.
Cookies and similar technologies
A cookie is a small file placed on a device when visiting a website. We use cookies and similar technologies to understand website traffic, support website functionality, improve the user experience and gather statistical information about how our website is used.
Some cookies or similar technologies may be used without consent where permitted by data protection law and PECR, for example where they are strictly necessary or fall within a permitted low-risk category. Where consent is required, we will ask for it and provide options to accept or decline cookies. You can also manage cookies through your browser settings, although disabling cookies may affect website functionality.
Security
We are committed to keeping personal data secure. We maintain appropriate electronic, physical and managerial procedures designed to prevent unauthorised access, unauthorised processing, accidental loss, destruction, damage or disclosure. Access to personal data is restricted to personnel and approved third parties who need access for the purposes described in this Privacy Notice.
How to raise a data protection complaint
If you are concerned about how we have used your personal data, or you believe we may have breached data protection law, you can raise a data protection complaint with us using the contact details below.
When we receive a data protection complaint, we will:
- facilitate the making of the complaint, including by accepting complaints by email or another appropriate channel;
- acknowledge receipt of the complaint within 30 days;
- take appropriate steps to consider and investigate the complaint without undue delay;
- keep the complainant informed of progress where appropriate; and
- inform the complainant of the outcome.
You also have the right to complain to the Information Commissioner’s Office if you believe our use of your personal data breaches data protection law. More information is available at ico.org.uk. This does not affect any other legal rights or remedies you may have.
Complaints handling and other complaint routes
Where your concern relates to our services, account handling, debt collection activity, enforcement activity or another aspect of your matter, it may be handled under our complaints process rather than, or in addition to, the data protection complaints process above.
Where applicable, we will tell you how to progress your complaint and whether you may have rights to refer the matter to external bodies such as the Financial Ombudsman Service, the Legal Ombudsman, the Enforcement Conduct Board, CIVEA, HCEO-related bodies or other relevant organisations. These routes may depend on the type of service, jurisdiction, account, instruction and regulatory status of the matter.
We may process and retain personal data to investigate, respond to, evidence and defend complaints, including correspondence, call recordings, body worn video, account notes, audit trails, quality assurance records and information supplied by clients, agents, advisers, regulators or other third parties.
Links to other websites
Our website may contain links to other websites. Once you use those links, we do not control the other website and are not responsible for the protection or privacy of information you provide while visiting it. You should review the privacy notice applicable to that website.
Updates to this Privacy Notice
This Privacy Notice will be reviewed at least annually, or earlier where required by regulatory change, legal change, business change, operational risk assessment or other relevant circumstances.
Contacting us
If you require further information, wish to exercise your data protection rights, or wish to raise a data protection concern or complaint, please contact us at data.protection@equivo.com.
Equivo Limited
August 2026