Privacy Policy

Privacy Notice

Who we are

Everyday People Financial Solutions Limited ("EPFS", "we", "us" or "our") is a company registered in Scotland under company number SC223606.

Our registered office is:

Everyday People Financial Solutions Limited
9 George Square
Glasgow
G2 1DY

EPFS is authorised and regulated by the Financial Conduct Authority for applicable regulated activities.

This Privacy Notice explains how we collect, use, store and share your personal information when we provide our services, including where we act on behalf of organisations that have instructed us to administer or recover an outstanding account.

We handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

If you have any questions about this Privacy Notice or the way we use your personal information, you can contact our Data Protection Officer:

Email: Data.Protection@myepfs.com
Post: Data Protection Officer, Everyday People Financial Solutions Limited, 7th Floor, 9 George Square, Glasgow, G2 1DY.

Who controls the use of your personal information?

EPFS provides services to a range of lenders, creditors and service providers. In most cases, EPFS acts as a data processor on behalf of the organisation that has instructed us. We also hold a small number of legacy accounts that were purchased or assigned to us, where EPFS acts as the data controller.

Where EPFS acts as a processor

For the majority of accounts we manage, your account has not been sold or assigned to EPFS. Instead, we have been instructed by your lender, creditor or service provider to provide services on its behalf.

These services may include account administration, collections, vulnerability support and/or tracing services.

In these circumstances, your lender, creditor or service provider remains the data controller and determines the purposes for which your personal information is processed. EPFS acts as a data processor, processing your personal information on behalf of, and in accordance with the documented instructions of, that organisation.

Our client may instruct us to contact you on its behalf. In some circumstances, this may include communicating with you using the client's name or branding.

If you would like information about how the controller uses your personal information, you should refer to the privacy notice of the lender, creditor or service provider responsible for your account.

Where EPFS acts as a controller

EPFS also holds a small number of accounts where the legal rights to the account or agreement were purchased by or assigned to us.

Where your account has been assigned to EPFS and we determine the purposes and means by which your personal information is processed, EPFS acts as the data controller.

In these circumstances, we are responsible for determining how and why your personal information is used and for ensuring that our processing complies with applicable data protection law.

We may also act as a controller in relation to certain processing undertaken for our own purposes or to meet legal or regulatory obligations that apply directly to EPFS, even where we otherwise provide services to a client as its processor.

If you are unsure whether EPFS is acting as a controller or processor in relation to your account or personal information, please contact our Data Protection Officer at Data.Protection@myepfs.com.

Exercising your data protection rights

Where EPFS is acting as the data controller, you can exercise your applicable data protection rights directly with us using the contact details set out in this Privacy Notice.

Where EPFS is acting as a data processor on behalf of a lender, creditor or service provider, that organisation remains responsible for responding to requests concerning your data protection rights.

You may still contact EPFS about your request. Where appropriate, we will pass your request to the relevant controller and assist them in responding in accordance with our obligations under data protection law.

If you are unsure which organisation is the controller of your personal information, please contact our Data Protection Officer and we will help you identify the appropriate organisation.

How we obtain your personal information

We may obtain personal information about you:

directly from you, including when you speak to us by telephone, write or email us, use our websites or customer portals, complete a form, make a payment, set up a repayment arrangement or otherwise communicate with us;
from the organisation on whose behalf we are administering or recovering your account;
from credit reference agencies;
from tracing, identity-verification and fraud-prevention service providers;
from publicly available sources where permitted by law;
from payment service providers and other organisations involved in processing payments;
from our service providers acting on our behalf; and
from other third parties where permitted by law.

We may combine information received from these different sources where this is necessary for the purposes described in this Privacy Notice.

Personal information we may collect

Depending on the nature of your account and our relationship with you, we may collect and use information including:

your name, title and date of birth;
current and previous addresses;
telephone numbers and email addresses;
information used to verify your identity;
client and EPFS account or reference numbers;
details of the account, debt or outstanding balance we have been asked to administer;
account balances and transaction information;
payment history;
repayment arrangements and settlement information;
financial circumstances, including income, expenditure and affordability information where relevant;
correspondence and records of our communications with you;
recordings of telephone calls, where calls are recorded;
complaints and information relating to their investigation and resolution;
information obtained from credit reference agencies, tracing services, fraud-prevention organisations and public sources;
information relating to vulnerability or additional support requirements where relevant;
information necessary to detect or prevent fraud, money laundering or other unlawful activity;
information relating to your use of our website or customer portal, including IP address, browser, operating system and technical or security information; and
any other information you provide to us that is relevant to administering your account.

We aim to collect only the information that is reasonably necessary for the purposes for which it is used.

Special category and other sensitive personal information

In some circumstances, you may tell us information about your health or other personal circumstances because it affects your ability to communicate with us, manage your account or make payments.

Information about health and certain other matters is classed as "special category personal data" under UK data protection law and receives additional protection.

We will only process special category personal information where we have both a lawful basis for processing under the UK GDPR and an applicable condition allowing us to process that type of information.

Where appropriate, we may record information about vulnerability or additional support requirements so that we can communicate with you appropriately, consider your circumstances and provide suitable support.

How we use your personal information

We may use your personal information for purposes including:

Managing your account

We may use your information to:

identify you and verify that we are communicating with the correct person;
contact you regarding an account placed with us;
provide you with information about the account;
receive and process payments;
establish and administer repayment arrangements;
discuss and assess affordable repayment options;
update your contact information;
respond to queries and requests;
maintain accurate records; and
report relevant information to the organisation on whose behalf we are acting.

Understanding your circumstances and providing appropriate support

Where appropriate, we may use information about your financial circumstances or vulnerability to:

assess affordability;
consider suitable payment options;
understand whether you require additional assistance;
adapt the way we communicate with you; and
support the fair treatment of customers, including customers experiencing financial difficulty or vulnerability.

Locating and contacting customers

Where permitted, we may use information obtained from clients, credit reference agencies, tracing providers and other lawful sources to verify or update contact information and locate customers where contact details have changed.

Preventing fraud, financial crime and misuse

We may use personal information to detect, investigate and prevent fraud, money laundering, identity theft, misuse of our systems and other unlawful activity, and to comply with applicable legal and regulatory requirements.

Operating and improving our services

We may use information to:

operate, secure and administer our websites, portals and systems;
investigate faults and security incidents;
monitor the effectiveness and quality of our services;
train our staff;
deal with complaints;
maintain appropriate business records;
carry out reporting, audit and quality assurance; and
develop and improve our processes and services.

Our lawful bases for using personal information

UK data protection law requires us to have a lawful basis for each purpose for which we process personal information.

Depending on the particular processing activity, we may rely on one or more of the following:

Contract – where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
Legal obligation – where processing is necessary for us to comply with a legal or regulatory obligation.
Legitimate interests – where processing is necessary for our legitimate interests, or the legitimate interests of another organisation, and those interests are not overridden by your rights and interests.
Consent – where we have specifically asked for and obtained your consent to a particular use of your information.
Other lawful bases where applicable under UK data protection law.

Where we rely on legitimate interests, those interests may include:

administering accounts efficiently and accurately;
assisting our clients in managing and recovering outstanding accounts;
communicating with customers about their accounts;
maintaining accurate contact information;
protecting our business, clients and customers against fraud and misuse;
securing and improving our systems and services;
maintaining appropriate business records; and
establishing, exercising or defending legal rights.

Before relying on legitimate interests, we consider the purpose of the processing, whether the processing is necessary and the potential impact on your rights and interests.

Who we may share your personal information with

Where necessary and lawful, we may share personal information with:

the organisation or organisations on whose behalf we are administering your account;
companies within our corporate group where they provide services to us or another lawful basis for sharing exists;
credit reference agencies;
tracing, identity-verification and fraud-prevention service providers;
payment service providers and banking providers;
print, mail, email, SMS and communications providers;
telephone and call-management service providers;
IT, hosting, cloud, software and cybersecurity providers;
professional advisers including lawyers, auditors and accountants;
regulators, ombudsman services, law-enforcement agencies, courts and other public authorities where required or permitted by law;
prospective purchasers, investors or advisers in connection with a corporate transaction, subject to appropriate safeguards; and
other organisations where you have asked us or authorised us to share information.

Where another organisation processes personal information on our behalf, we require appropriate data-protection and confidentiality arrangements.

We do not sell your personal information for direct marketing purposes.

Credit reference agencies and other information providers

We may obtain information from credit reference agencies and other information providers where this is appropriate for administering an account, verifying information, tracing customers, preventing fraud or carrying out other lawful activities.

Credit reference agencies hold information from a variety of sources, which may include credit-account information, addresses, electoral-register information and public records such as judgments and insolvency information.

Where EPFS provides information to or searches a credit reference agency, the way that information affects your credit file will depend on the particular account, our client's instructions and the role of the relevant credit reference agency.

Further information about how credit reference agencies use personal information is available from the relevant credit reference agency's privacy information.

Payments and card information

Where you make a card payment through our website or another payment service, payment information may be provided directly to our contracted payment-service provider.

Our payment providers are required to apply appropriate security standards. EPFS's current online payment service states that its contracted provider handles payment transactions and is required to comply with the applicable Payment Card Industry Data Security Standard.

We do not use card information for purposes unrelated to administering your payment.

Telephone calls

We may monitor or record telephone calls for purposes including:

establishing a record of our communications;
protecting customers and staff;
quality assurance;
training;
investigating or resolving complaints;
preventing and detecting fraud; and
demonstrating compliance with applicable legal and regulatory requirements.

Automated decision-making and profiling

We may use personal information to carry out profiling or automated processing to help administer accounts and our communications with you.

This may include using information to help determine appropriate contact strategies or the times at which we are more likely to be able to contact you.

Where we make a decision based solely on automated processing that produces legal effects or similarly significantly affects you, additional rights may apply under UK data protection law.

Our current processes are not intended to make solely automated decisions that have a legal or similarly significant effect on you.

You may contact our Data Protection Officer if you have questions about automated processing or profiling involving your information.

How long we keep your information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, accounting and reporting requirements and to establish, exercise or defend legal claims.

The appropriate retention period may depend upon the type of information, why it is being processed and any applicable legal or regulatory requirement.

For customer account information, our usual retention period will not exceed six years from the date on which the account is closed unless a longer period is required or justified in the circumstances.

Different retention periods may apply to particular categories of information.

Where your personal information is processed

We may use suppliers or group companies that process personal information on our behalf.

Where personal information is transferred outside the United Kingdom, we will ensure that the transfer complies with applicable UK data protection law and that an appropriate transfer mechanism or safeguard is in place where required.

The data that we collect from you will not be transferred to or stored anywhere outside of the European Economic Area (EEA).

Security of your information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, alteration, disclosure, loss or destruction.

These measures include controls designed to protect our systems and restrict access to personal information to people who have an appropriate business need.

No internet transmission or storage system can be guaranteed to be completely secure. You should take appropriate steps to protect passwords and other account-access information and should not disclose them to other people.

If you believe that someone else may have obtained access to your account or personal information, please contact us.

Website information and cookies

When you use our websites or customer portals, we may collect technical information necessary to operate, secure and improve those services.

We also use cookies and similar technologies.

Cookies are small files stored on your device that can enable a website to operate correctly, remember information or preferences and provide information about use of the website.

Some cookies are necessary for services such as authentication, security and maintaining your session.

Other cookies or similar technologies may require your consent.

For information about the cookies used on our website, their purposes and how you can manage them, please see our Cookie Policy.

Links to other websites

Our websites may contain links to websites operated by third parties.

Those organisations are responsible for their own websites and privacy practices. If you follow a link to another website, you should review the privacy information provided by that organisation.

Your data protection rights

Depending on the circumstances and the lawful basis on which we use your information, you may have the right to:

Access – ask us for a copy of personal information we hold about you and certain information about how it is used.
Rectification – ask us to correct personal information that is inaccurate or complete information that is incomplete.
Erasure – ask us to delete personal information in certain circumstances.
Restriction – ask us to restrict how we use personal information in certain circumstances.
Object – object to certain processing, including processing based on legitimate interests, in circumstances provided by law.
Data portability – receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, ask for it to be transmitted to another organisation.
Withdraw consent – where we rely on your consent, withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.
Rights relating to automated decisions – exercise applicable rights where decisions are made solely by automated means and have legal or similarly significant effects.

These rights are not absolute and may not apply in every circumstance.

In particular, exercising a right to erasure or objection does not necessarily mean that we must stop processing or delete all information relating to your account. We may continue to retain or use information where we have another lawful basis or are required to do so by law.

Your right to object

Where we process your personal information because this is necessary for our legitimate interests or those of another organisation, you have the right to object to that processing in certain circumstances.

If you wish to exercise this right, please contact our Data Protection Officer.

Making a data protection request

If you wish to exercise any of your data protection rights, please contact:

Data Protection Officer
Everyday People Financial Solutions Limited
9 George Square
Glasgow
G2 1DY

Email: Data.Protection@myepfs.com

We may need to ask you for information to verify your identity before disclosing personal information or acting on a request.

Complaints

If you have concerns about the way EPFS handles your personal information, please contact our Data Protection Officer first so that we have an opportunity to investigate your concerns.

You also have the right to complain to the Information Commissioner's Office ("ICO"), the UK's data protection regulator.

Information Commissioner's Office
Telephone: 0303 123 1113
Website: ico.org.uk

You can contact the ICO at any time, although it generally recommends giving the organisation concerned an opportunity to address the matter first.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time, including where our services, processing activities or legal and regulatory obligations change.

The latest version will be made available on our website.

Where a change has a material effect on how we use your personal information, we will take appropriate steps to bring the change to your attention.

Last updated: September 2026

Cookie Policy

Cookies on MyEPFS.com