Privacy Policy

Data Controller

Whyte & Co is an enforcement agency and carries out data processing on behalf of a number of local authority clients. The Data Controller is the local authority (Council) named in the communication you have received from Whyte & Co. Your data has been given to us by the Council and has not been obtained from publicly available sources although having obtained your data from the Council Whyte & Co may add to it or amend using publicly available information and information voluntarily provided to us by data subjects.

Whyte & Co is the data controller in respect of data obtained via our use of body worn audio-video (BWV) and audio recordings of phone calls to our offices.

About Us

Whyte & Co is registered with the Information Commissioners Office under registration number: Z7251166.

Our Data Protection Officer can be contacted by phoning 0345 458 9429 or emailing dpo@whyte.co.uk.

Purpose of Processing

The processing of personal data is necessary for our local authority clients and for Whyte & Co to fulfil statutory requirements and for Whyte & Co to fulfil its contractual obligations to the local authorities.

The lawful bases for processing are:

  • Legal Obligation (GDPR Article 6c): The processing is necessary to comply with the law (The Tribunals, Courts & Enforcement Act 2007 and the associated Taking Control of Goods Regulations).
  • Public Task (GDPR Article 6e): Processing is necessary for us to perform tasks in the public interest and to perform official functions on behalf of local authorities e.g. the collection and recovery of taxes and civil penalties and other public funds through the execution of Warrants of Control and debt collection. Both the task and functions have a clear basis in law e.g. The Tribunals, Courts & Enforcement Act 2007.
  • Legitimate Interest (GDPR Article 6f): Processing is necessary for Whyte & Co’s legitimate interests as it central to the conduct of Whyte & Co’s business.

Categories of Data Processed

The following information about you is provided by the local authority

  • Your name
  • Your current address and the address to which the debt relates (if different)
  • The nature of the debt (Council Tax, Penalty Charge etc)
  • The period the debt relates to (where relevant)
  • The date and nature of the contravention (for traffic related penalty charges)
  • Your telephone number(s) and email address(s) (if known)
  • The amount that you owe
  • The date of the court hearing or date the warrant was issued
  • Make, model, colour and vehicle registration (traffic related penalty charges)

Whyte & Co may add to this the following:

Data obtained from Credit Bureaux:

  • Any subsequent addresses, telephone number or email address
  • Date of birth
  • Evidence of residence at an address e.g. the fact that bank, utility, telecommunications etc. accounts are registered in your name at the address.

Data obtained from DVLA:

  • Confirmation that you remain the registered keeper
  • Any address change notified to DVLA

Data obtained through our use of body worn audio-video (BWV) and audio recordings of phone calls to our offices.

Any Data you supply to us voluntarily and in particular in support of claimed vulnerability:

  • Bank and income and expenditure statements
  • Medical evidence

Special category personal data

The only special category personal data processed by Whyte & Co relates to the physical and mental health of customers who may be regarded as vulnerable. Such personal data is obtained only as a result of it having been supplied voluntarily by customers, whether or not at our request, and subject to explicit consent. The data is used solely to ensure that the enforcement process adopted is appropriate to the individual's circumstances. Special category personal data may be shared with our client local authority.

Automated Individual Decision Making and Profiling

Whyte & Co has a legal obligation to understand whether customers are vulnerable and we use automated profiling to assist with this. Information obtained from Credit Bureau is used to classify customers into different segments using algorithms and machine-learning. Profiling produces no negative impact on individuals as it is used solely to send additional reminders and information to those who may be vulnerable regarding the assistance available to the vulnerable and their rights. Processing does not therefore fall under Article 22 of UK GDPR. If and when a customer contacts us, further decisions are made with human involvement and automated individual decision making ceases to apply.

Who we Share Your Data With

We only share your data with our instructing local authority and data is not transferred outside of the UK.

For research purposes we may share pseudonymised data with the Enforcement Conduct Board (ECB) and any research company acting on the ECB’s behalf. The ECB provides independent oversight of the enforcement industry to ensure all who are subject to enforcement action are fairly treated. The purpose of research is to analyse the adherence of enforcement agents to the current national standards and to assist the ECB in its development of standards and codes of practice.

Data Retention Periods

Body worn audio-video footage: The purpose of retaining footage is to assist in the investigation of complaints. We consider that 28 days is a sufficient period to allow for a complaint to be received and footage is normally erased after 28 days. However, if we have reason to believe that a complaint or litigation is likely in a particular case and that it is essential to retain the footage for evidential purposes and to adequately defend any proceedings, we may retain that footage for a longer period.

Audio Recording of Phone Calls: The purpose of retaining audio-recordings is to confirm the content of the conversation in the event that a dispute arises. In our view an audio-recording is considerably less intrusive than an audio-visual recording and a longer retention period is justified. Accordingly, we retain audio recordings for one year. However, if we have reason to believe that a complaint or litigation is likely in a particular case and that it is essential to retain the recording for evidential purposes and to adequately defend any proceedings, we may retain the recording for a longer period.

All other Data: Is retained for 6 years after we have completed action on a case. This is because the Limitations Act 1980 allows civil proceedings to be issued up to 6 years after the event which gave rise to them. Our business is litigious by its very nature e.g. we execute warrants by taking control of debtors goods and in some case these goods are removed and sold. Consequently, people who feel aggrieved by our actions issue proceedings against us and sometimes do so years after the event. We can only defend ourselves against such proceedings if we have retained a full and thorough record of our actions.

Your Rights

You have the right to:

  • be informed about the collection and use of your personal data
  • access and receive a copy of your personal data and other supplementary information
  • have inaccurate personal data rectified, or completed if it is incomplete.
  • have personal data erased. This right is not absolute and only applies in certain circumstances. It does not apply where processing is necessary to comply with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority
  • obtain and reuse your personal data for your own purposes across different services (data portability)
  • request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances.
  • object to the processing of your data. This is not an absolute right and applies in certain circumstances. It is also subject to a number of exemptions including “the assessment or collection of a tax or duty or an imposition of a similar nature” and Whyte & Co has the right to refuse an objection where we feel we have a compelling reason to do so.