This notice explains what we do with personal data. It covers three different groups of people, and the part that applies to you depends on why we hold your information.
Clearline Technologies Ltd is the data controller for website visitors and for the recovery work we carry out. Where we operate a client's credit control function under subscription, we act as that client's data processor for their ledger and contact data, and as controller of our own compliance records. Clearline Technologies Ltd is registered with the Information Commissioner's Office. Contact for any data question: privacy@clearline.co.uk.
What we collect: the information you give us in a form or email (name, business, email, phone, and anything you tell us), any ledger or aged debtor report you send for a scan, and limited technical data about your visit as described in our cookie notice.
Why: to reply to you, to prepare the report you asked for, and to run and improve the site. Lawful basis: our legitimate interests in responding to business enquiries, and your consent for non-essential cookies.
Ledgers sent for a free scan: analysed to prepare your report. If you do not ask for the report, nothing is stored. If you do, your contact details and the report itself (the invoices as priced, and the headline figures) are kept for six months under the email address you gave, so that it is waiting in your portal if you open an account on that address, and so we can discuss it with you. It is then deleted by a scheduled process unless you have opened an account, or sooner on request. It is not shared with anyone outside our service providers and never used to approach your customers.
We hold contact details for the people we deal with, the instructions you give us, your ledger and invoice data, and records of our correspondence. We use it to provide the service, to account to you for money recovered, and to meet our legal and audit obligations. Lawful basis: performance of our contract with you, and our legal obligations. Retention: six years from the end of the relationship.
What we process: your business contact details, the debt and its history, our correspondence and call recordings, payment information you provide, and information from public sources including Companies House, the Register of Judgments, Orders and Fines, and The Gazette. We may also use business credit reference data; for sole traders this may include personal data held by credit reference agencies.
Why and on what basis: to administer recovery of sums lawfully due to our client. We rely on our legitimate interests and those of our client in recovering a debt, and on our legal obligations for record keeping. Where a statutory moratorium such as Breathing Space applies, we stop.
Who we share it with: our client, our service providers under contract (communications, printing, payments, telephony, data enrichment and hosting), our client's or our solicitors where a matter escalates, and courts or enforcement agents where proceedings are issued.
Automated processing: we use automation to prioritise work, draft communications and estimate the likelihood of recovery. Decisions with a significant effect on an individual, including any decision to escalate legally, are made or approved by a person, and we keep a record of what was considered. You can ask us for an explanation of any decision.
Retention: case records for six years from closure, in line with the limitation period and our audit obligations. Call recordings for two years unless a matter is subject to litigation.
We also use information about how accounts are resolved, such as which communications received a response and how quickly payment followed, in anonymised and aggregated form, to improve our methods and to produce statistics, sector benchmarks and analytics products. This relies on our legitimate interests. It never identifies you, any individual, or any client. We do not license or sell information that identifies you or your business, and we never publish a statistic derived from fewer than five distinct creditors. You may object to this use at any time.
Data is held in the United Kingdom. Encryption in transit and at rest, role-based access with logging, and contractual data protection terms with every service provider. Where a provider processes data outside the UK, we rely on an appropriate transfer mechanism and record it in our processor register.
We use a small number of specialist providers, each under a written contract, each for one purpose. Our hosting and database providers hold the platform and its records. An email delivery provider sends our letters and tells us whether they arrived, bounced or were refused, and receives replies. An email address checking service confirms that an address exists before we write to it for the first time. A telephony provider carries calls and text messages where those are used. A language model provider classifies the replies we receive (paid, promise, dispute, distress, please stop) so that a person sees them in the right order; the reply text is sent for classification and is not used to train any model. Where a debtor pays by bank transfer through the payment page, an open banking provider initiates the payment and sees only what the payment needs. Where a client connects their accounting software, that software's provider gives us read access to the ledger the client chooses. The register naming each provider, what it receives, where it processes and the transfer mechanism relied on is available on request from privacy@clearline.co.uk.
Records of a case, including the letters sent and any money received on it, are kept for six years from closure and then deleted by a scheduled process. One-time sign-in codes are deleted within a day; sign-in sessions within thirty days of their last use; rate-limit counters within a day; address-verification results are refreshed after thirty days. When a client closes their account, their contact details, connections to accounting software and pending invitations are removed within thirty days; the case files, receipts and correspondence are kept for the six-year period as our legal record and then deleted. A debtor's request not to be emailed is kept for as long as it is needed to honour it.
You have the right to be informed, to access your data, to have inaccurate data corrected, to erasure and to restriction in some circumstances, to object to processing based on legitimate interests, and to data portability where relevant. To exercise any of these, email privacy@clearline.co.uk. We respond within one calendar month and may need to verify your identity first. There is no charge.
If you are unhappy with how we have handled your data, please tell us first using our complaints procedure. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
We update this notice when our processing changes; the date at the top shows the current version. Material changes affecting debtors will be reflected in our correspondence.