Information Notice given under Article 14 of the GDPR

In accordance with Article 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), PRA Group (UK) Limited informs you that:


1. The Data Controller of your personal data is PRA Group (UK) Limited located at Wells House, 15-17 Elmfield Road, Bromley, Kent BR1 1LT (hereinafter “PRA” “we” “our” and “us”)


2. Contact point for matters concerning data protection:

  1. Wells House, 15-17 Elmfield Road, Bromley, Kent BR1 1LT
  2. privacy@pragroup.co.uk
  3. Tel: 0800 877 2772


3. Purpose of processing personal data and legal basis:

  1. Note that your personal data will be processed by us for the purposes of: of –communication, collecting outstanding debt, trace activities. carrying out risk assessments and audits, carrying out analysis, market research and to produce reports and management information, behavioural scoring, preventing or detecting of crime, evaluating portfolios of debt, optimising and improving our debt collection processes, for training and quality assurance of staff, evaluating your circumstances to provide you with solutions, administrative and other debt collection purposes.
  2. Our legal basis for processing your personal data is:
    1. Pursuant to article 6 (1) (b) of the GDPR we will process your personal data when it is necessary for the fulfilment of your obligation under the contract with the original creditor under your credit agreement which also includes payment obligation, and/or
    2. Pursuant to article 6 (1) (f) of the GDPR we will process your personal data when it is necessary for the purposes of the legitimate interest of PRA. We have a legitimate interest in collecting the debt owed by you to PRA, and to process your personal data for that purpose.
  3. Categories of personal data
    i. We will process the following categories of personal data:
    information relating to your identity, information in order for us to be able to communicate with you [1], information relating to your debt and payments, information about your financial circumstances, information about your personal circumstances, including, marital status, dependants, employment, and income, provided by you or a third party authorised by you, other information relevant to your circumstances which impact your ability to pay your debt.


4. Special categories of personal data:

  1. Our legal basis for processing special categories of personal data is:
    1. Pursuant to article9(2)(a) of the GDPR, we will process your personal data where you have given us your explicit consent to do so; or
    2. Pursuant to article9(2)(a) of the GDPR, where that processing is required or permitted by law including but not limited to the Financial Conduct Authority’s (“FCA”) Consumer Credit Sourcebook.
  2. We will process the following information relating to special categories of personal data
    1. information relating to health
    2. information relating to your religious beliefs [2]
    3. information relating to trade union membership [3]
    4. information relating to your sexual orientation [4]
    5. The abovementioned data has been received from you, or a third party authorised by you to disclose such special categories of personal data.

5. Data recipients

  1. For the abovementioned purpose(s) we can transfer your data to the following recipients:. (i) to any of our related affiliates within the PRA Group of companies; (ii) to any agencies or other third parties that provide us with services, including companies used to send communications to you or that provide us with technical support or assistance, debt collection agencies, law firms, insolvency practitioners, and tracing agents; (iii) to fraud prevention agencies and law enforcement agencies including where you give us false or inaccurate information or where we suspect or identify fraud [5] ; (iv) to land registries, courts, governmental and nongovernmental regulators and ombudsmen;; (v) to any third party that acquires, or is interested in acquiring or securitising, all or part of our assets or shares, or that succeeds us in carrying on all or a part of our business, whether by merger, acquisition, reorganisation or otherwise; and (vi) where we have your consent or as required or permitted by law, including to comply with a subpoena or similar legal process or government request, to dispute resolution service providers, debt advice and debt management companies, or when we believe in good faith that disclosure is legally required or we have a legitimate interest in making a disclosure, such as where necessary to protect our rights and property.
  2. In addition, where we are permitted, we may share your personal data with Credit Reference Agencies (“CRAs”) and the information may be recorded by the CRAs in your credit history record. We may also make periodic searches at CRAs. Where CRAs carry out a search for us they will place a search footprint on your credit file. CRAs may supply us with both public and shared credit and fraud prevention information. CRAs will record all outstanding debt and may disclose this information to other organisations to perform further checks, trace your whereabouts or recover the debt. If you pay your account in full then we will update the reports accordingly. Records remain on file with the CRAs for 6 years after they are closed whether settled by you or defaulted. You should be aware that the existence of a default, particularly defaults which are not marked as “settled” or “satisfied”, may adversely affect your ability to obtain credit in the future. See below for further information on how your data may be used by CRAs [6]
  3. For details on how you can contact the CRAs or for details of fraud prevention agencies please visit our website at [www.pragroup.co.uk or contact us on 0800 877 2772.
  4. Your personal data may be transferred to a recipient in a third country [7]. We may transfer your personal data on the basis of an adequacy decision by the European Commission, including, European Union Standard Contractual Clauses or where relevant EU/US Privacy Shield

6 Data Storage

Your personal data will be retained by us:

  1. for as long as is reasonably necessary, having regard to the Limitations Act 1980 for a legal claim to be raised which PRA would be entitled to defend
  2. for as long as is reasonably necessary to respond to any queries by you or any regulatory authority, including but not limited to the Financial Conduct Authority’s (“FCA”) Consumer Credit Sourcebook
  3. for as long as is reasonably necessary to comply with any legal and regulatory obligations which PRA may have, including those requirements imposed by Her Majesty’s Revenue and Customs and other governmental, law enforcement and regulatory bodies

7. Your Rights

We also would like to inform you that, subject to further legal obligations, you have the following rights:

  1. Access to your personal data - You have the right to access the personal data relating to you that we hold, as well as that of any third parties which process your personal data on our behalf.
  2. Rectify your personal data - If you believe that any of the personal data we hold for you is incorrect, it is important that you make us aware as soon as possible, so that we can rectify our records.
  3. Erasure (right to be forgotten) - if you believe we no longer have a lawful basis to process your personal data have the right to request that we delete it.
  4. Restriction of processing - If you believe we are processing your personal data unlawfully or that we no longer need your personal data for the purposes we collected it .
  5. Right to data portability - You have the right to request that we transfer personal data you have provided to us either to yourself or to another data controller.
  6. Right to object to processing - if the processing itself is an unwarranted interference with your interests or rights.
  7. Right to not to be subject to a decision based solely on automated processing including profiling – As stated, we may use the personal data we hold on you to conduct profiling and make decisions solely by automated means, for example, to predict how likely you are to be able to pay your debt, or how best to manage our relationship with you. However, We do not believe that this processing has either a legal effect or similarly significant impact on you, which is the basis of being able to exercise this right.

Right to a complaint

You have the right to complain to the Data Protection Officer, whose contact details are as follows:

Data Protection Officer,
PRA Group (UK) Limited, Wells House,
15-17, Emfield Road, Bromley, BR1 1LT
Email: privacy@pragroup.co.uk

You also have the right to complain to a competent supervisory authority:, if you believe that the processing of your personal data is unlawful, you have the right to make a complaint to the competent supervisory authority. The name and address of the relevant competent supervisory authority is: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Right to withdraw a consent:

Where processing of your personal data is based on consent given to us for one or more specific purposes, you may withdraw your consent at any time providing it will not affect the lawfulness of processing based on consent before its withdrawal. If you wish to withdraw your consent, please contact us by telephone on: 0800 877 2772 or email us on: privacy@pragroup.co.uk



[1] We may communicate with you by mail, e-mail, telephone, by fax and by text. Should we contact you by telephone or other form of electronic communication, or should you contact us by telephone or other form of electronic communication, we may monitor and/or record the telephone conversation or other electronic communication in the interests of security, to improve our services, for training purposes, and to assist in collection of any outstanding debt.

[2] Where provided by you in the context of PRA assessing your income and expenditure

[3] Where provided by you in the context of PRA assessing your income and expenditure

[4] Where provided by you in the context of PRA assessing your income and expenditure

[5] Including the following: Cifas, National Crime Agency, Action Fraud, Police ,Her Majesty’s Revenue and Customs

[6] Please click on the following links and read the Credit Reference Agencies’ Information Notice (“CRAIN”) to see how Experian, Equifax and Call Credit process your personal data. Go to the following links: Experian.co.uk/crain; Equifax.co.uk/crain; callcredit.co.uk/crain.

[7] A third country is a country located outside the European Economic Area (“EEA”), including the United States of America, which may not have data protection laws equivalent to those in the EEA. In such case, (and provided we are not restricted from transferring your personal data in this way), we will take all necessary steps to ensure the safety and security of your personal data in accordance with applicable data protection laws.