Your data may be processed, as appropriate, by: Axactor España, S.L. with N.I.F.: B87334637; Axactor España Platform, S.A.U. with N.I.F.: A81238917; Alcalá Lands Investments, S.L.U., with N.I.F.: B87774865; Beta Properties Investments, S.L.U., with N.I.F.: B87774881; Borneo Commercials Investments, S.L.U, with N.I.F.: B87774857; Axactor Capital Luxembourg, S.a.r.l, with N.I.F.: B217699; , Axactor Invest 1, S.a.r.l., with N.I.F.: B219479 and Axactor Portfolio Holding AB, with N.I.F.: 559031-2954 (all hereinafter jointly referred to as Axactor and with registered office for this purpose at C/Alcalá, 63, 4ª planta, 28014 - Madrid [Spain]).
Your privacy is important to Axactor. It is important for us to know how we treat your personal data, the categories of personal data we process and for what purposes. In addition, it is important for you to know what rights you have towards Axactor as the Controller of your personal data and how you can exercise your rights.
WHAT ARE PERSONAL DATA?
Personal data is any information that may be linked to a natural person, directly or indirectly, such as name, postal address, e-mail address, IP address and mobile phone number.
WHO IS THE DATA CONTROLLER?
The entities of Axactor that determine the purposes and means through which personal data will be processed will be considered as the Data Processors. Thus, in certain situations we are the Data Controller for processing activities related to debt collection when we purchase debt, when we process an application for employment or contact details as part of a process with a customer, a vendor or public authorities. For some of our services, provided only through AXACTOR ESPAÑA PLATFORM, S.A.U., we only act as Data Processor processing your personal data according to our customers' instructions, for example, when we provide management services for accounts receivable.
The Data Controller will ensure that your personal data is processed safely and lawfully in accordance with EU Regulation 2016/679 (GDPR) and national data protection laws.
CATEGORIES OF DATA SUBJECTS.
We may process personal data linked to the following categories of data subjects:
• Debtors: natural persons or representatives of legal persons who are subject to debt collection or debt management.
• Customer representatives: natural persons who are representatives of our customers, partners or vendors (i.e. contact persons).
• Public authorities and supplier representatives: natural persons who are representatives of our suppliers or public authorities (i.e. contact persons).
• Other data subjects: any other natural person (i.e. persons who visit our websites, job applicants or otherwise get in contact with us)
WHY DO WE HAVE ACCESS TO YOUR DATA AND PROCESS IT?
There is a legitimate interest in debt collection activity. We have a legitimate interest to process your personal data when the creditor has entrusted us with the management for the collection of an unpaid claim between you and the creditor (as Data Processor) or when we have acquired such a claim (as Data Controller). This means that we have the legal right to process your personal data without your prior consent.
In accordance with our legitimate interest, we may also carry out tracing activities, qualification to ensure efficient service and compliance with good debt collection practices, enrich data from different sources (e.g. credit reference agencies, detective agencies and public records), checks on the accuracy of the data we hold and provide access to your data with contracted third party providers (such as other debt collectors and credit reporting agencies).
Please contact us if you would like to know more about how we have assessed our legitimate interest. Your data will be held securely in compliance with data protection regulations.
As part of our investments, we may also initially process generic data on your unpaid credit in order to make valuations for possible purchases of credit portfolios and to perform statistical analyses or models with such generic data to predict the forecast of the portfolios. And in the event that such a purchase is made, we will be your new part of the assigned credit in our position as creditor and collection manager. In this way, when we claim the debt, we will do it to fulfill our agreement and carry out our obligations and treat your personal data being the legitimate causes the exercise and management of the right of unpaid credit, the legitimate interest as a creditor / manager and the fulfillment of legal obligations. Axactor may purchase credit portfolios that include your debt through one of our investment companies (AXACTOR PORTFOLIO HOLDING, AB; AXACTOR CAPITAL LUXEMBOURG, S.a.r.l. and AXACTOR INVEST 1, S.a.r.l.) and subcontract the management of the debt collection to our Spanish collection company AXACTOR ESPAÑA PLATFORM, S.A.U, as informed in the presentation letter (Hello letter) that we sent to you, or in its case to another collection management company. Both companies will act as Responsible and Responsible of the Treatment respectively, as it is defined in the applicable data protection regulations. The legal entity that has acquired your debt has subcontracted the management of your unpaid credit to the local collection entity, as you were informed in the letter sent.
Customer, seller and others.
In order to conclude and fulfill the agreement we have with you or the company you represent, it is necessary to process your personal data. We may also process personal data about visitors to our website(s) or physical locations, depending on how you have chosen to interact with us. You may be interested in the courses or events we offer or the information we provide.
We will only process your personal data if we have a legitimate reason to do so. This means that the processing must be necessary for the performance of a contract to which you or the company you represent is a party or to take action at your request prior to the conclusion of a contract. In accordance with our legitimate interest, we may also use your data to provide you with information about our services, perspectives, analyses, events, training that are likely to be of interest to you or to be able to execute the necessary or desired tasks that are expected from the business relationship you represent. Please use the contact information below if you would like to know more about how we have assessed our legitimate interest.
We may also process your data if you have applied for a job at Axactor to determine whether you are a qualified candidate for the position you have applied for.
We may process personal data for the purpose of resolving disputes, complaints or legal proceedings and to comply with the law or a court order.
We have a legal obligation to provide your personal data when we are audited by the authorities and to prevent, monitoring and evidence fraud, anti-money laundering and other criminal activities.
In order to secure our network and information we must prevent circumstances, events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data.
WHAT CATEGORIES OF PERSONAL DATA DO WE PROCESS?
The categories of personal data that we process vary depending on the data subject and the purpose.
The personal data we may process about representatives of the customer, vendors and public authorities may be categorised as follows:
• Personal identification and contact data; We have the necessary information to manage the contractual or prospective business relationship. In order to be able to communicate with you and ensure secure and true identification, we need your name, title and contact details such as address, telephone number and e-mail. Depending on the nature of the assignment we may ask a selection expert to determine whether there are circumstances that would disqualify you or the company you represent from that assignment.
• Identification document number (DNI or NIE); In order to comply with our legal obligations relating, for example, to the fight against money laundering, we may also require a passport or similar identification and related information.
• Picture and ID; For our employees’ security and to keep your personal data safe, we may also use video surveillance cameras where appropriate, and may ask you to provide us with, for example, your name and telephone number to enter our location.
The personal data that we may process about you may be classified as follows:
• Personal identification and contact data, including name, address, postal code, city/town, date of birth, gender, e-mail address, telephone number, etc. for the management of your file and to be able to communicate with you.
• Identification document number (DNI or NIE), such as social security number, passport number, a unique identifier or other, issued by a public body to ensure secure and true identification, for example, to comply with our legal obligation to provide your personal data when we are audited by the authorities and to prevent, control and evidence fraud, money laundering and other criminal activities.
• Contract details: details relating to the debtor's unpaid credit.
• Financial information: means (a) information obtained from external sources (i.e. public databases, credit rating providers, etc.) relating to the debtor, which is processed in connection with the collection of the debt and (b) any information relating to payment details arising from the contract (received from the client) or (c) information from our own debt collection process, by virtue of payment history, income, assets, loans, etc. to assess its ability to pay, risk analysis and management, make payment plans, debt monitoring or portfolio evaluations.
• Confidential information: obtained from debtors during debt collection, i.e. the reasons for late payment that are considered confidential in nature (but not necessarily sensitive data), such as individual or family circumstances, employment situation, etc. to better understand their specific situation and make an informed decision on how to handle their case, but may also include sensitive data on their health and information on criminal convictions.
• IP addresses and other technical information: The information we hold about you may be anonymized and used for the conduct of our business. However, where it is necessary to secure your personal data and to ensure appropriate testing and changes to our computer system, your personal data may be used as is.
• Voice and image: We may make recordings of telephone conversations for security and quality reasons and to document your rights. In addition, for the safety of our employees and to keep your personal data safe, we may also use surveillance cameras in our facilities.
The personal data that we may process about job applicants can be classified as follows:
• Identification and contact data. Such as your name, address, e-mail address, telephone number.
• Information from your resume. Such as your professional history, educational background, skills, language fluency and any other information you may include in your resume.
• Letter of motivation. Any information you decide to include in your cover letter.
• Eligibility for employment. You may need to show that you are legally eligible to work.
• Statement of good standing. Depending on the nature of the position, we may ask you to obtain a statement from the appropriate public authority that you have not been convicted of any crime that may disqualify you for that role.
The processing of anonymous data, i.e. data that cannot be linked directly or indirectly to a natural person, is not subject to the restrictions described in this declaration.
DO WE PROCESS SENSITIVE PERSONAL DATA?
Sensitive personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing of genetic data, biometric data for the purpose of identifying a natural person uniquely, and data concerning the health or sex life or sexual orientation of a natural person.
Unless otherwise agreed with you or necessary for the establishment, exercise or defense of legal claims, we will not include special categories of personal data.
However, as a debtor, you may benefit from notifying us of any health conditions, disabilities and/or personal information relating to your private life that may affect your ability to pay. This will allow us to take reasonable steps to accommodate your needs or requirements, such as allowing sufficient interruptions in your payment arrangement, providing a respite to seek free independent debt counseling or adjusting your payment arrangement. This information will be used by us to assist you and will be kept as long as required for this purpose, or until you notify us that you no longer agree to the processing or that it is necessary for the establishment, exercise or defense of legal claims.
If you are a job applicant, in certain circumstances we may process sensitive data, such as data on ethnic origin, or gender information to help us ensure that we have a diverse group of applicants and employees.
If you are participating in an Axactor event, we may ask you to inform us of allergies or similar information relevant to your well-being when you participate.
THE LEGAL BASIS FOR OUR PROCESSING OF YOUR PERSONAL DATA.
According to the GDPR, Axactor must base its processing of personal data on a legal basis. Our processing of personal data will be based on one or more of the following points, as explained throughout this statement:
• The processing of personal data is necessary for the execution and management of a contract to which you are a party or to take action at your request prior to the conclusion of a contract.
• The processing of the personal data is necessary for the fulfilment of a legal obligation, inter alia, the obligation to keep the information in accordance with the applicable accounting/taxation or anti-money laundering legislation.
• Processing is necessary for the fulfilment of a task carried out in the public interest or in the exercise of official authority.
• Processing is necessary for the purposes of our legitimate interest, insofar as this interest is not outweighed by your interests or by the fundamental rights and freedoms requiring the protection of personal data.
• You have given your consent to the processing for one or more specific purposes.
FROM WHAT SOURCES DO WE COLLECT PERSONAL DATA ABOUT YOU?
In addition to the information you may provide to us, we may receive information from:
• Your creditor (our client).
• Public records.
• Credit rating companies.
• Detective agencies to update your location data if necessary.
• Social networks open to the public; such as Facebook, LinkedIn, Google
Representative of clients, vendors, public authorities and others.
In addition to the information provided by you, we may receive personal data from our customers or suppliers.
In addition to the information you provide us with, we may collect information from:
• Internal applications. If you are already employed by Axactor and are applying for another internal position, we may use the information in your personnel file to supplement the information you provide to us when applying for the job.
• Evaluation. We may ask you to submit to an evaluation of your skills, personality or cognitive ability. These assessments are typically conducted using third-party software or a third-party company, which will share the results with us. Before you undergo such an assessment, we will provide you with more information relevant to your specific situation.
• Pre-Employment Assessment. Depending on the nature of the position, we may ask a pre-employment assessment expert to determine whether there are circumstances that would disqualify you for the position. Prior to initiating the selection, we will discuss with you whether or not a selection will be made, as well as the scope and purpose of the selection.
• References. We may decide to obtain references from people who have worked with you in the past. Generally, we will only contact these people if you have provided us with their names and contact details. If you are already an employee of Axactor, we may ask your manager and/or co-workers for references, without your knowledge.
• Social Media; Information available in social media (such as Facebook, LinkedIn, Google+ or Instagram), may be collected and used.
TO WHOM MAY WE TRANSFER PERSONAL DATA TO?
We may transfer your personal data within the Axactor group of companies. All Axactor employees are committed to maintaining confidentiality.
In order to be able to fulfil our contractual obligations, we may share your personal data as a debtor with our customers for whom we carry out debt management on their behalf.
We may also share personal data with our contracted external partners (agents, lawyers, solicitors, suppliers, e.g. printing and mailing services, land registry searches, telecommunications services, other debt collection agency, investors, external advisors or consultants whom we have engaged to provide services or assist us in debt collection or other business processes). Providers who process data on our behalf do so on the basis of a Data Controller Agreement which regulates the responsibilities of such providers as Data Controller in relation to the processing of personal data accessed by them for the provision of the respective contracted service.
If we have a specific legal basis in law or in a contract, we may also transfer debtors' personal data to credit information companies that are authorized to obtain and process personal data, such as income, debts, etc., for the purpose of providing such information to third parties that perform credit rating or public records.
If we are going to take legal action in connection with the debtor's records, we may transfer debtors' personal data to legal advisers/attorneys/bankruptcy courts.
If you are a job applicant, we may share your personal information with third parties to obtain information from these third parties, service providers who assist us in performing background checks, providing a recruitment portal or in our evaluation of you or in improving our recruitment practices. Our employees, subject to a confidentiality obligation, will have access to the personal data.
We may also share personal data with authorities where we are required by law to do so, this may include regulators, law enforcement authorities, social welfare authorities and fraud prevention authorities.
Axactor will ensure appropriate safeguards in accordance with applicable law to protect your personal data processed by third party service providers.
DO I HAVE TO GIVE YOU MY PERSONAL DETAILS?
As a representative of a customer or vendor, or as a job applicant, you have to provide us with personal data that will allow us to communicate with the customer, the supplier or with you as a job applicant.
As a debtor, you do not have to provide us with any personal data. In fact, most (if not all) of the personal data we process about you comes from a source other than yourself, i.e., the party to the original agreement, public records or credit reporting companies. However, you may choose to provide us with additional personal data. Such information may even help us manage your case and is usually to your benefit. For example, you may have a valid reason for not paying your debt, which you may want to share with us, or if we agree to set up a payment plan to help you pay your debt, you may provide certain details to make the payment plan reasonable and appropriate to your specific situation.
DO WE TRANSFER YOUR PERSONAL DATA TO COUNTRIES OUTSIDE THE EU/EEA AREA?
As part of the Axactor group, we may transfer your data to another country. If we do so, we will ensure that adequate safeguards are in place to comply with the EU General Data Protection Regulation (GDPR). Generally, your personal data will not be transferred outside the European Economic Area (EEA), unless it is necessary to collect a debt and/or pursue a legal claim in a country outside the EU/EEA. We also use third party service providers located outside the EU/EEA who may have access to your data, including, but not limited to, the United States. We will never transfer your personal data outside the EU/EEA without ensuring the security and protection of your personal data. Therefore, we ensure that all recipients have signed the EU standard model clauses, to justify the transfer, or that the country ensures adequate protection under data protection legislation. We can also rely on the Privacy Shield program, which is a program where US companies can commit to a higher level of privacy protection than required by US law. We may disclose information outside these groups if required by law.
HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?
We will retain your data for as long as is necessary for the lawful purpose for which it was obtained, provided that we have a legitimate interest in retaining it, for example, until the end of our agreement and/or the period of prohibition by law in order to be able to defend ourselves against legal claims. We are also legally required to retain your personal data for a period of time to prevent and detect fraud, to detect and evidence anti-money laundering and for financial audits. The retention period will depend on the regulations of the country of the legal entity Axactor that processes your personal data.
If you are a job applicant, we will retain your data during the application process and delete it once we have found a suitable candidate. If we have selected you for the position, we will retain your personal data in your personal file in accordance with our HR privacy guidelines. We may process your personal data for a longer period after the application process has been completed, if there is a pending legal dispute or if you have given us permission to keep your personal data on file for a longer period of time.
With respect to our backups, we will also delete your data from our backups, but only if and when the backup tape is recovered for restoration, in accordance with our backup policy. If the backup is listed for deletion under the backup policy, we will completely delete your data.
DO WE KEEP YOUR PERSONAL DATA SAFE?
We are obliged to implement appropriate technical and organizational measures to ensure and be able to demonstrate that our processing is carried out in accordance with the GDPR and other relevant data protection laws.
We have implemented various appropriate measures to ensure that unauthorized persons do not have access to your personal data.
WILL YOU BE SUBJECT TO AUTOMATED DECISION MAKING?
Given Axactor's legitimate interest in the collection of your debt, it uses the scoring system (profiling). This is necessary to optimize our service and manage your case in an efficient and timely manner. It is also necessary to ensure compliance with good debt collection practices and avoid unnecessary reminders and expenses, etc.
Scoring is granted by automated means and indicates how your case is handled. The score decides, for example, whether you are likely to pay the debt or whether we should refer your case to a Collection Agency. We do not consider scoring to be automated decision making (as defined in the European data protection law), as it has no legal effect or affects you in a similar and significant way, as it does not affect your rights and obligations based on the contract.
Generally, you will not receive any information about the individual score that has been awarded to your case, but if you believe that we have handled your case incorrectly because of a score, you can ask us to manually reconsider the score through human intervention.
As a customer or supplier representative, or as a job applicant, you will not be subject to automated decision making.
WHAT ARE YOUR RIGHTS?
What does it mean?
Right to access
You may request information on how we process your personal data, including information on:
All the above information is available in this privacy declaration.
You may also request a copy of the personal data we process about you. However, additional copies will be combined with a fee.
Right to correction
It is important that we have the right information about you and encourage you to let us know if any of your personal data is incorrect, e.g. if you have changed your name or moved.
Right to be forgotten
If we process your personal data in an unlawful way, for example if we process your personal data longer than necessary or for no reason, you may ask us to delete this information.
Right to restriction
From the time you have requested we correct your personal data or if you have objected to the processing and until we have been able to investigate the issue or confirm the accuracy of your personal data (or changed it in accordance with your instructions), you are entitled to restricted processing. This means that we (except for storing the personal data) may process your personal data only in accordance with your consent, if necessary, with reference to legal claims, to protect someone else's rights or if there is an important public interest in the processing.
You may also request that we restrict the processing of your personal data if the processing is unlawful, but you do not want us to delete the personal data.
Right to objection
If you believe that we do not have the right to process your personal data, or if you want an automated decision to be reconsidered, you may object to our processing. In such cases, we may continue processing only if we can show compelling justifying reasons that out-weigh your interests, rights and freedoms. However, we may always process your personal data if it is required for the determination, exercise or defense of legal claims.
Right to data portability
Where the processing of the personal data is based on consent or a contract and the processing is carried out by automated means, you may have the right to data provided to you in a structured, widely used and machine-readable format. You also have the right to request to transfer that information to another data controller.
Withdrawal of consent
Axactor does not base its processing upon consent. However, given that some processing activities should be based on consent, you are in your right to withdraw it and we will consequently stop the processing activities based on this legal ground.
We will also notify others we may have shared your personal data with of your request(s).
HOW TO COMPLAIN ABOUT THE USE OF YOUR DATA OR EXERCISE MY RIGHTS?
If you wish to raise a complaint about how we handle your personal data, including in relation to any of the rights outlined above, or you have any further questions on how we process your personal data, please contact our Data Protection Officer through this link: email@example.com and we will investigate your concerns.
If you are not satisfied with our response, or believe we are processing your data unfairly or unlawfully, you can complain to the Data Inspectorate. You can find more information about the Spanish Data Protection Agency, which is Axactor's main supervisory authority in Spain and its complaints procedure here: https://www.aepd.es
USE OF THIRD-PARTY WEBSITES
AMENDMENTS TO THIS PRIVACY DECLARATION
We are constantly developing our services. We may therefore from time to time need to update our privacy declaration. All amendments to this privacy declaration will be made available on our web site, https://www.axactor.es.
In case of material changes, you may receive a notice, either by e-mail, post or when visiting our website.
Last update: May 2020