DutifulData Limited

Who We Are

We are DutifulData Limited, a UK-based company working predominantly with financial service providers, such as lenders, to help them meet their regulatory responsibilities to assess credit and affordability risk and provide insights into indicators of vulnerability within their customer base.

We are registered with the Information Commissioner’s Office. Our registration number is ZC026834.

Our work involves receiving and analysing data from several sources to feed into a model that provides a statistically relevant method of assessing affordability, and information that can assist firms in managing their customers appropriately.

We do not deal directly with members of the public or process personal data for our own marketing purposes. Our services are provided strictly on a business-to-business (B2B) basis.

If you need to contact us about this notice or about how we handle personal data, please email us at: info@dutifuldata.co.uk.

What Data We Receive and Use

We receive and process personal data provided by our carefully selected suppliers and third-party sources. The types of personal data we may handle include:

• Basic identifying details (e.g. name, address, date of birth).
• Other details (e.g. marital status, no. of dependents, employment status, length of time at address).
• Financial information (e.g. income, non-discretionary expenditure, loan details, loan term, loan purpose, repayment history).
• In some cases, information relating to civil offences (e.g. being awarded a county court judgement)

We only process the personal data necessary for our clients’ legitimate business purposes.

Why We Use Personal Data

We use personal data to:

• Collate and analyse information from multiple sources on behalf of our clients.
• Identify and share relevant updates or discrepancies between records.
• Help our clients to assess and manage financial risk.
• Help our clients manage their customers appropriately.
• Maintain accurate and secure data processing systems.
• Meet our legal and contractual obligations to our clients.

We do not use personal data to make decisions about individuals ourselves. We only provide data insights to our clients, who remain responsible for any lending or related decisions.

Our Lawful Bases for Processing

We rely on the following lawful bases under the UK GDPR:

Legitimate Interests (Article 6(1)(f)) — when we collect, match, or analyse data from third parties to support clients in assessing affordability risk, identify potential customer vulnerability or fraudulent behaviours.

Contract (Article 6(1)(b)) — when we process data as part of a service agreement with our clients.

For any special category data, we rely on the condition of substantial public interest under Schedule 1 of the Data Protection Act 2018 (for example, in relation to preventing fraud or financial crime).

Who We Share Data With

We share data only with:

• Our clients, in line with their lawful purposes and agreements.
• Carefully selected third-party suppliers and service providers who support our systems and services — for example, secure cloud hosting or data analysis tools.

All processors are bound by written contracts and must comply with strict confidentiality, security, and data protection requirements.

We may provide some of your information to our clients as part of our service, for which we may receive a fee.

International Data Transfers

All data we handle is stored and processed within the United Kingdom. If in future we use any systems or suppliers located outside the UK, we will ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement or adequacy decisions approved by the UK Government).

Data Security

We apply robust technical and organisational security measures to protect all data we handle. These include encryption, access controls, secure storage, monitoring, and regular risk assessments.

Only authorised personnel with a legitimate business need have access to personal data.

How Long We Keep Data

We only retain personal data for as long as necessary to fulfil our contractual and legal obligations, or for other legitimate business purposes such as audit or compliance. Retention periods are defined in our internal retention policy and data sharing agreements with clients. Once no longer required, data is securely deleted or anonymised.

Individual Rights

Although we normally receive personal data indirectly from our suppliers, individuals still have rights under the UK GDPR, including the right to:

• Access their personal data
• Request correction of inaccurate data
• Object to certain types of processing
• Request erasure of their data (where applicable)

Requests of this nature should usually be directed to the original supplier who provided the data, but we will cooperate fully with our clients to respond appropriately.

If you believe your personal data has been processed by us and you wish to exercise your rights, you can contact us at info@dutifuldata.co.uk.

How to Contact Us

Post: DutifulData Limited, Ollerbarrow House, 209-211 Ashley Road, Hale, Altrincham WA15 9SQ
Email: info@dutifuldata.co.uk

Complaints

If you are concerned about how we handle personal data, you can contact us directly at any time. If you are still not satisfied you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at:
Website: www.ico.org.uk
Telephone: 0303 123 1113

Updates to This Privacy Notice

We may update this notice from time to time to reflect changes in our activities or legal obligations. The most recent version will always be available on our website.