Privacy Notice

Introduction

Your privacy is very important to Scott & Co (Scotland) LLP. We are committed to protecting your personal data and ensuring your privacy rights are respected and upheld.

Scott & Co (Scotland) LLP is a subsidiary of Marston Holdings Limited. We are committed to protecting personal data and ensuring that all processing activities comply with UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

Please take some time to read this Privacy Notice carefully, as it sets out the basis on which we collect, use, store and protect your personal data, as well as your privacy rights and how the law protects you. It also sets out how to contact us if you have a privacy question and, if you are unhappy with our response, how to raise a complaint or obtain advice from the Information Commissioner’s Office (ICO): www.ico.org.uk

We do not process personal data for marketing purposes unless explicitly stated. Our services and website are not directed at children, and we do not knowingly collect personal information from children.

Who we are

Scott & Co (Scotland) LLP

279 Bath Street

Glasgow

G2 4JL

Company No: SO305258

A Data Protection Officer has been appointed and can be contacted as follows:

Email address: dpo@marstonholdings.co.uk

Postal address: Data Protection Officer, Scott & Co (Scotland) LLP, 77 Shaftesbury Avenue, 3rd Floor, London, W1D 5DU

ICO Registration Number: ZA054553

What this Privacy Notice covers

This Privacy Notice aims to give you information on the personal data we collect and process in relation:

In many cases, we obtain personal information about you from our clients, who instruct us to provide debt recovery, enforcement or related services on their behalf.

Data we may collect about and how we use it

Scott & Co (Scotland) LLP will often act as a data processor on behalf of its clients, who are the data controllers. In some circumstances we act as a joint controller or an independent controller. Where we act as a controller, we identify an appropriate lawful basis for processing personal data.

This Privacy Notice does not extend to the use of personal data by other third-party websites that are linked from our website, whether we provide those links or whether they are shared by other users. We have no control over how your data is collected, stored or used by third parties and we recommend that you check the privacy policies of any such websites before providing any data to them.

The personal information we collect about you will vary depending upon our relationship with you. We will collect more detailed information about you if you are a customer than we would if you are a third party.

We may collect your personal data through various means, including via our website, email, telephone, direct contact, or if you voluntarily submit it, and where we are otherwise required by law to collect personal data.

The table below explains how we process personal data for the services we provide to clients as well as any other activities that involve processing personal data.

Data Subject Why do we process personal data? Main categories of Personal Data Where we are Data Controller what is our lawful basis for processing?
Customer To collect and/or enforce a court order on behalf of our client

Examples of court orders:

  • Summary Warrant
  • Decree
 Contact and identity verification:

  • Name
  • Postal address
  • Email address Telephone number

Personal data to support the collection/enforcement process:

  • Details of the debt / offence
  • Amount and statutory fees
  • Inbound and outbound customer correspondence
  • Contact Centre customer telephone call recordings
  • Motor vehicle details (if applicable)
  • Customer payment details

Special category personal data:

  • Mental or physical health

We only process special category personal data where a lawful condition under Article 9 UK GDPR applies. Where consent is required, we will obtain your explicit consent before processing.

 Our lawful basis for processing personal data is compliance with a legal obligation and, where applicable, our legitimate interests in fulfilling our contractual obligations to our client.

Our client has obtained the court order and provided your details to us so that we can enforce on their behalfWe process personal data to fulfil our contractual obligations to our client and, where applicable, rely on our legitimate interests in delivering those services.
Customer and/or their representative To process card payments Personal data to support payment processing:

  • Card number
  • Payer’s name
  • Amount
 Our lawful basis for processing your personal data is performance of a contract.

We process the personal data to execute the payment that you have requested

We also have a statutory financial and tax obligation to maintain accounting records to support the transaction
Customer To conduct visits for clients Contact and identity verification:

  • Name
  • Address
  • Contact Telephone Number

Personal data to support processing:

  • Client correspondence with customer
 Our lawful basis for processing personal data is legitimate interest.

We perform a contract with our clients to conduct visits
Defendants To carry out client instructions Contact and identity verification:

  • Name
  • Address
  • Date of birth
  • Contact Telephone Number

Personal data to support processing:

  • ·Individual nature of instruction (e.g., statutory demand)
 Our lawful basis for processing personal data is compliance with a legal obligation.

We perform a legal instruction to carry out this work as Officers of Court

Other Personal Data we may process:

Data Subject Why do we process your personal data? Main categories of Personal Data that we process Where we are data controller what is our lawful basis for processing?
Customer Recording inbound and outbound telephone calls for training and monitoring purposes Telephone call recordings Our lawful basis for processing your personal data is legitimate interests

Special category Personal Data

UK Data Protection legislation defines certain personal data as special category such as data relating to your ethnic origin, physical health and mental health.

If we identify potential or actual customer vulnerability, we may ask for relevant information. We never compel customers to provide special category personal data and will only process such information where an appropriate condition under Article 9 UK GDPR applies. Where consent is required, we will obtain your explicit consent

Sometimes we receive special category data to support a particular matter (e.g. a complaint). Where special category personal data is voluntarily provided to us, we will only process it where a valid condition under Article 9 UK GDPR applies. Where consent is relied upon, it will be obtained in accordance with applicable data protection law.

We may share special category data with our client, as the joint data controller, or other areas of the business to ensure the enforcement is managed appropriately and in line with our legal obligations.

How and where information is stored and how long we hold it for?

We process data in the UK, and it is securely stored in Tier IV UK-based data centres with appropriate physical, technical and organisational measures in place.

We will only transfer personal data outside the United Kingdom where permitted by applicable data protection law. Where such transfers occur, we will ensure appropriate safeguards are in place, including adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

We always establish a lawful basis for processing where we are the data controller, and we will only retain personal data for as long as necessary to fulfil the purpose for which it was collected and to meet legal, regulatory, contractual and business requirements. We have a system of retention periods which are regularly reviewed by the Data Protection Officer. Where the information is no longer required, we will ensure it is disposed of or deleted in a secure manner.

Disclosure of your information

We will only share personal data with third parties or within our business for the specific purposes set out below and we have confidentiality clauses and confidentiality agreements (including data protection obligations) in place:

  • We may share your data with our client where they have instructed us. We will only do this where our client is data controller for the specific case
  • We may sometimes contract with third parties to supply services on our behalf. This may include payment processing and mailing. In some cases, the third parties may require access to some of your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure your data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the law
  • We may compile statistics about the use of our website including data on traffic, user numbers and other information. All such data will be anonymised and will not include any personally identifiable information.
  • In certain circumstances we may be legally required to share certain data held by us, which may include your personal information, for example, for compliance or regulatory purposes, where we are involved in legal proceedings, or where we are complying with the requirements of legislation, a court order, or a governmental, investigative or taxation authority. We do not require any consent from you in order to share your data in such circumstances and will comply, as required, with any legally binding request that is made of us. In these circumstances we may be prevented by the police, courts, or a similar authority from pre-notification or being as transparent as with other data processing activities.
  • We may share your data in pursuing a third party’s legitimate interest. This may include situations where we are required to go beyond our specific legal obligations set in laws and regulations to assist law enforcement or private stakeholders in their efforts to combat illegal activities, such as money laundering, fraud detection or prevention or misuse of services. We will ensure that any such processing is strictly necessary for these purposes. We will only share personal data where we are satisfied that there is an appropriate lawful basis for doing so and where the processing is necessary and proportionate.
  • We may share your name and address with trusted tracing providers for the purposes of confirming residency, verifying contact details, locating individuals, preventing fraud, or supporting debt recovery and enforcement activities. The tracing agencies we use are set out below together with their customer websites:

Complaints

We continuously review and monitor our standards for processing your personal data. If you have queries or concerns, please contact us on datarequest@marstonholdings.co.uk and we will do our best to resolve it. If you remain dissatisfied about how we have processed your personal data, you may want to escalate to a complaint. If your complaint is about a subject access request or your privacy rights, please refer to section entitled Legal Rights where you will find further information on how we process these.

  1. Stage One

Please forward your complaint plus any supporting documentation either by email or post. We will aim to investigate and respond to your complaint within 30 days. We would appreciate the chance to properly investigate the matter and report our findings back to you.

Postal address: Data Privacy Team, 77 Shaftesbury Avenue, 3rd Floor, London, W1D 5DU

Email address:  datarequest@marstonholdings.co.uk

  1. Stage Two

If you are unhappy with the stage one complaint investigation response from the Data Privacy Team, you can appeal at stage 2 directly to the Data Protection Officer. Please forward your appeal to dpo@marstonholdings.co.uk or alternatively write to the Data Protection Officer at the above address. The Data Protection Officer will respond within 14 days. The decision of the Data Protection Officer is our final response and the end of the internal complaints process. You can also ask the Information Commissioner’s Office (ICO) to review how we handled your complaint (https://ico.org.uk/). The ICO prefers that you exhaust our internal complaints process and provide them with a copy of our final response before they begin their investigation.

Controlling your personal information

When you provide personal information through our website, you may be given options to manage how your information is used.

Where we send direct marketing communications, you can opt out at any time by using the unsubscribe link included in our emails or by contacting us using the details provided in this Privacy Notice.

You may also register with the UK’s preference services, including the Telephone Preference Service (TPS), the Corporate Telephone Preference Service (CTPS), and the Mailing Preference Service (MPS), to reduce unsolicited marketing communications. Please note these services do not prevent organisations from contacting you where you have specifically consented to receive marketing communications.

Data Security

We take the security of your personal information seriously and have implemented appropriate technical and organisational measures to protect it from unauthorised access, loss, misuse, alteration, or disclosure.

These measures include physical, electronic, and managerial safeguards, together with appropriate access controls and security procedures.

We also require our third-party service providers to protect personal information through contractual confidentiality and data protection obligations and to process personal data in accordance with applicable data protection laws.

While we take reasonable steps to protect personal information, the transmission of information over the internet is not completely secure. We therefore recommend that you take appropriate precautions when sending personal information to us electronically.

Legal Rights

Under UK data protection law, you have rights in relation to your personal data. The rights available to you depend on our reason for processing your information and (in most cases) we have one calendar month to respond to your request:

  • Your choice to provide information: You are not required to provide personal information when accessing certain areas of our website. However, if you choose not to provide information that is necessary to deliver a service or feature, we may be unable to provide that service or enable that functionality.You can also manage your cookie preferences through your browser settings or our cookie management tools. For more information, please see Cookies and our Cookie Policy
  • Ensuring the accuracy of your information: If you believe that any personal information we hold about you is inaccurate or incomplete, please contact us using the details provided in this Privacy Notice. We will review the information and correct it where appropriate.You may also request that we close any customer account you hold with us, where applicable. Please note that we may need to retain certain information after account closure to comply with legal, regulatory, or business requirements.Any information retained in backup or archive systems will be securely deleted in accordance with our retention policies.
  • Your right of access: You have the right to request access to the personal data we hold about you.There are some exemptions under data protection law, which means you may not always receive all the information we process. Where an exemption applies, we will explain this to you.For example, you may not receive full copies of original documents because your right of access only applies to your personal information. Information relating to other individuals, or other exempt information, may be redacted.You can submit a Subject Access Request in writing by emailing complaints@scottandco.uk.com or verbally through our Customer Contact Centre.
  • Your right to rectification:You have the right to ask us to correct personal data you believe is inaccurate. You also have the right to ask us to complete information that you believe is incomplete. This right applies in certain circumstances under data protection law.However, please be aware that, much of the information we hold about you is provided by our clients. In some cases, we may not be able to amend personal data immediately upon request and may need to consult with our client or direct you to them instead.For example, we cannot change information contained within a court order or other official documentation issued by, or on behalf of, a client. Where we are unable to make a requested change, we will explain the reasons why and advise you of the appropriate next steps.
  • Your right to erasure: You have the right to ask us to erase your personal data in certain circumstances. If an exemption applies, we will explain why we cannot erase the information. For example, we would not normally erase information relating to a live court order or ongoing enforcement action, as we are required to process and retain this information to comply with legal obligations and exercise our legal powers.
  • Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances. Where this right applies, we will continue to store your personal information but will not process it unless permitted by law.
  • Your right to object to processing: You have the right to object to the processing of your personal information where we are relying on our legitimate interests as the lawful basis for processing. If an exemption applies, we will always explain it to you.
  • Your right to data portability: This right only applies if we are processing information based on your consent or under a contract with you and the processing is automated. You have the right to request a transfer of automated information you provided.

Cookies

Our website may place and access certain Cookies on your computer or device. Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of our website and to provide and improve our services. You can manage your cookie preferences through our cookie management tool or through your browser settings.

By using our website, you may also receive certain third-party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than us. For more details, please refer to Our Cookie Policy: https://scottandco.uk.com/cookie-policy/

Changes to our Privacy Notice

We may change this Privacy Notice as we may deem necessary from time to time, or as may be required by law. Any changes will be immediately posted on our website together with the version number and date. If the change in Privacy Policy materially impacts our data subjects, then we will also communicate with them directly.

We recommend you check this page regularly to keep up to date.

Version 7
Effective Date: 7 August 2026
Last Review Date: 7 August 2026