Sigma Connected Group Ltd & HSBC Privacy Policy

If you owe money, we’re here to work with you on clearing that debt and building a brighter financial future and that takes trust. We are committed to building that trust, starting with helping you to understand our privacy practices, so you can be confident that your business is no-one else’s business.

This notice explains the personal data we collect, where we get it from, how it’s used and shared, and your choices regarding your information.

We recommend that you read this and get in touch if there is anything you are unsure about.

Data Controllers and Data Processors

We have partnered with HSBC to help support customers like you. So that we can contact you to provide our unique service, HSBC have passed us a small amount of your information (such as your name and contact details) so that we can get in touch and see if we can help. This will either be with your consent or because they have a legitimate interest by nature of money owed to them. Sometimes, your information is passed to us based on a combination of both those things.

HSBC as Data Controller and Reachout as Data Processor

ReachOut never own the personal data passed to us by HSBC, we look after it carefully for the short period of time that we are engaged to provide support to you and then we pass it back or permanently delete it, processing it only under HSBC’s instructions. On this basis, we are a Data Processor which is someone who processes data on behalf of another person or business, a Data Controller, and HSBC are that data controller. A Data Controller makes the decisions about how and why data is used, in this instance for your confidentiality and to make independent contact with you.

Example: we call you and talk to you about your circumstances, you don’t provide us with any new personal data or information that HSBC don’t already know. In this situation, HSBC are the Data Controller throughout.

You will find a similar data protection notice on their website which will explain your rights in more detail. If you would like more information about how HSBC use your data, please go here.

ReachOut as Data Controller

Often, people using ReachOut will share information about themselves in confidence, things specific to their own personal situation that they feel sensitive about and we fully understand this. We feel privileged that people are comfortable sharing those intimate details about their mental or physical health, their life and those personal experiences which have contributed to their current financial position.

If it makes you feel more comfortable, we can keep this information just between you and ReachOut. To be able to keep this information confidential and not share it back with HSBC, ReachOut will need to become the Data Controller.

Example: we call you and you share insight into your health which is impacting your financial situation, but you would rather we didn’t share that back to HSBC. In this scenario, HSBC are still the Data Controller for the information they already had about you, but ReachOut will become data controller for the new, health information.

When we say our service is confidential, we mean it. To maintain your trust, we will only ever pass sensitive information, such as physical or mental health details, back to HSBC with your express permission. So, you can be confident that, even though most of the time we are processing your data on their behalf, our conversation with you is protected.

Finally, because we only have a short period of time to try and get in touch and help you, you may end up calling us after we’ve removed your details from our system. In this instance, any data we collect about you, either on our database or through call recordings, we will do with your consent, and we will become the Data Controller.

In either situation described above, where ReachOut become a Data Controller, the rest of this notice is for you.

Who we are

ReachOut is a trading style of Sigma Connected Ltd and we are registered with the Information Commissioner’s Office and the UK Data Protection register. Our company number is 01221157.

The type of personal information we collect

When we act as a Data Controller, we collect basic personal information about you such as your name and address and other contact details. Depending on the conversation we have, you may also disclose to us some more sensitive details about your personal, health, legal or financial situation. Much of this is defined as ‘Special Category Data’ under data protection law (the GDPR) and that is why we take extra care with the data of anyone using the ReachOut service.

In short, after the original window given to us by HSBC, any information we collect is given to us by you and we do so with your consent. This is called our legal basis for processing.

What do we use this data for

Quite simply, we use your data to help you and nothing else. We ask questions to understand your circumstances and then we provide you  with information about support and services that may help you. We keep limited records on databases, and we keep our call recordings for 12 months. We keep these recordings for two main reasons:

1. Training and quality assurance for our Pathfinders, so we can improve our service to you.
2. In case you ever felt the need to make a complaint. We take complaints very seriously and having a record of the call enables us to hear what was said and make sure we can resolve the issue and improve our service.

Who we share your data with

No-one.

Well, almost no-one.

If you give us permission, we may share details of the call with whichever partner referred you on to our service in the first place.

Very occasionally we speak to people who appear to be in great distress. Where we think it is appropriate, we may refer those details on to the emergency services or welfare services. We would always try to get permission first, but data protection laws allow us to do this where we believe someone is at risk.

How we store your personal information.

Your information is securely stored in UK datacentres. We have some very clever people in our IT team who continually check to ensure that we have the latest firewalls,the most up to date security and the best equipment. We train our staff regularly on data protection and information security and we are proud to hold both the ISO27001 Information Security Standard and the ISO9001 Quality Standard.

You are important to us. Your data is important to us.

How long we will store your data

We keep call recordings for 12 months, then they are permanently deleted.

We keep any information about you in our database for 12 months from the last contact we had with you, then we permanently delete that too.

Your data protection rights

Here in the UK, our data protection laws give you lots of rights in relation to your data. These are really important for your privacy and to make sure that you have full control over any information that exists about you.

This is a list of your rights and how you can exercise them with ReachOut if you feel you need to.

• You have the right of access – if you want to know what information any data controller holds about you, you have the right to ask for copies of your personal information. You can do this by any communication method and we will not charge you for doing so.
• You have the right to rectification – if you think any information that we hold about you is incomplete or inaccurate, tell us. We are required to rectify that information.
• You have the right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• You have the right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• You have the right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• You have the right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

All of these rights are free to you from us or any other organisation holding your data. If you make a request, we have one month to respond to you.

You can contact us on the details at the top of this notice to make a request in relation to your rights, or if you have a question about them.

How to complain

If you are worried in any way about our use of your personal information, you can talk to us about it using any of the contact methods in this document. If you are so worried you wish to make a complaint, please contact our Data Protection Officer at:

DPO@reachout.co.uk
Peter Hopgood-Gravett, The McLaren Building, Birmingham, B4 7LR, UK.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

What now?

That’s everything we think you might want to know about how we collect, use and store your data. If you have any questions, please drop us a line.

Other than that, we thank you for reaching out and look forward to speaking with you. Hopefully we can help.