Privacy notice
STA International Ltd ("we", "us", "our") gathers and processes your personal information in accordance with this privacy notice and in compliance with the relevant data protection regulation and laws. This notice sets out your rights and our obligations, and explains how, why and when we process your personal data.
Our registered office is The Drying Loft, 24-26 Turkey Court, Turkey Mill Business Park, Ashford Road, Maidstone, Kent, ME14 5PP. We are registered in England and Wales under company number 02893487, and on the Information Commissioner's Office register under number Z7268646. STA International acts as a data controller when processing employees' and clients' data.
To exercise your rights of access to your personal data, contact our Compliance department at [email protected].
Employees and applicants
We process your personal information to meet our legal, statutory and contractual obligations. We never collect unnecessary personal data, and we do not process your information in any way other than as specified in this notice. The personal data we collect includes:
Date of birth, home address, personal email
Home and mobile telephone numbers
Special category data, such as health or medical information
Bank account details and National Insurance number
Next of kin
Passport and driving licence numbers
DBS checks and criminal records, and credit checks
Interview details, including CVs, interviewer notes, dates and times
Work history, qualifications and experience relevant to the role
Disabilities, for monitoring and adjustments only
References from previous employers and personal or educational referees
Documents confirming address, such as utility bills and bank statements
Building entry and exit records, for safety evacuation purposes
CCTV recordings
How we use it. We take your privacy very seriously and never disclose your data without your consent, unless required to do so by law or in accordance with another lawful basis stated in this notice. We collect and store your personal data as part of our legal obligation and for the performance of our contractual obligations, and retain it only as long as is necessary for the purposes specified here.
If you do not provide it. You are not obliged to provide your personal information. However, as this information is required to provide you with information on our services, we will not be able to offer some or all of our services without it.
Sharing and disclosure. We do not disclose any of your personal information without your consent, except for the purposes specified in this notice or where there is a legal requirement. We use third parties to provide our daily business functions; all suppliers and partners acting on our behalf process your data only in accordance with our instructions and comply fully with this privacy notice, data protection law, and appropriate confidentiality and security measures.
How long we keep it. We retain employees' personal information indefinitely for employment purposes — to assist in running the business, to enable individuals to be paid, and to comply with our legal obligations — with the exception of CCTV recordings, which are deleted after three months. Data relating to applicants is stored securely for six months.
Special category data. We sometimes need to process sensitive personal information about you to meet our legal obligations. Where we collect such information we request and process only the minimum necessary for the specified purpose. Where we rely on your consent, we obtain it explicitly, and you can withdraw it at any time — we will act on that immediately unless there is a legitimate or legal reason not to.
Clients and customers
The personal data we collect from our clients, as data controllers, includes date of birth, home address, personal and business email, home and mobile telephone numbers, financial information, and special category data such as health or medical information.
How we use it. We will never disclose your data without your consent unless required to do so by law or in accordance with the lawful basis stated in this notice. We may act as data controller or data processor depending on our contractual obligations. We collect and process your personal data for debt collection services, on the lawful basis of the performance of our client's contract. We securely archive data after account closure on the lawful basis of legitimate interest, recognising that it is in our interest to identify and manage risks to our own and our clients' organisations. We also process your information to fulfil our obligations under the laws and regulations that apply to our business activities.
Sharing and disclosure. We do not disclose your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement. We use third parties to provide our daily business functions; all suppliers and partners acting on our behalf process your data only in accordance with our instructions, as agreed with clients, and comply fully with this privacy notice, data protection and their national laws, and appropriate confidentiality and security measures.
IT providers Adtec Software Ltd, Cardale Park, 5 Greengate, Harrogate, HG3 1GY · 01423 700250 · adtecsoftware.co.uk (opens in a new tab)
Microsoft, Microsoft Campus, Thames Valley Park, Reading, RG6 1WG · 0344 800 2400 · microsoft.com (opens in a new tab)
Mimecast Services Limited, 6th Floor, CityPoint, One Ropemaker Street, London, EC2Y 9AW · 020 7847 8700 · mimecast.com (opens in a new tab)
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg · aws.amazon.com (opens in a new tab)
Mailing services FCS Laser Mail, Wood Lane, Erdington, Birmingham, B24 9QL · 0121 306 4300
Telephony MaxContact, Piccadilly House, 49 Piccadilly, Manchester, M1 2AP · 0333 222 3637 · maxcontact.com (opens in a new tab)
Text messaging Twilio Ireland Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland · twilio.com (opens in a new tab)
Legal firms appointed for further recovery action Transfers occur only on our clients' instructions, on the lawful basis of performance of a contract. We also provide information on EU legal firms and debt collection agencies that may continue recovery of our clients' debts before referral.
Brachers LLP, Somerfield House, 59 London Road, Maidstone, ME16 8JH · 01622 690691 · brachers.co.uk (opens in a new tab)
STA Legal Ltd, 24–26 Turkey Court, Turkey Mill Business Park, Ashford Road, Maidstone, ME14 5PP · stalegal.co.uk (opens in a new tab)
Blacklocks Solicitors and Notaries, 89 Constitution Street, Edinburgh, EH6 7AS · 0131 555 7500 · blacklocks.co.uk (opens in a new tab)
Credit reference agencies We use data from credit reference agencies to establish the current whereabouts of people who are not responding on known contact details, then use that data to get in touch.
Experian Ltd, Accounts Receivable, Talbot House, Nottingham, NG80 1TH · 0844 481 8888 · experian.co.uk (opens in a new tab)
LexisNexis, Lexis House, 30 Farringdon Street, London, EC4A 4HH · 0845 370 1234 · lexisnexis.com (opens in a new tab)
How long we keep it. We retain personal information only for as long as we are obliged to under relevant legislation and regulation, or — where no such rules apply — for no longer than is necessary for our lawful purposes. This will be no longer than six years after closure of your account, after which it is anonymised for statistical purposes. Archived account data is stored securely in our in-house application within a highly secure cloud environment and data centre; it is securely archived and not actively processed.
Special category data. Owing to the services we provide, we sometimes need to process sensitive personal information about you, only with your consent, to assist you in meeting your contractual obligations. We request and process only the minimum necessary for the specified purpose. Where we rely on your consent, we obtain it explicitly by telephone or in writing. You can withdraw consent at any time; we will act on it immediately and confirm within 30 days, unless there is a legitimate or legal reason not to.
Website visitors and marketing
The personal data we may collect, primarily via website forms or Electric Marketing, is job title, business name, business address, business email and IP address.
How we use it. We will never disclose, share or sell your data without your consent unless required to do so by law, and retain it only as long as necessary for the purposes specified here. We occasionally send marketing information where we have assessed that it is beneficial to you as a customer and in our interests; such information is non-intrusive and processed on the grounds of legitimate interests. Where you have consented to promotional offers and marketing, you are free to withdraw that consent at any time.
To unsubscribe, follow the unsubscribe link in any electronic communication, or email [email protected] with the subject line "Unsubscribe".
From time to time we may use Electric Marketing to gather appropriate contact names from prospective clients. You can read Electric Marketing's data protection policy at electricmarketing.co.uk/data.html (opens in a new tab) or by contacting them directly.
Legitimate interests. Where we process your personal information on the legitimate interests basis, we have carried out a Legitimate Interests Assessment to ensure your interests, and any risk posed to you, are proportionate and appropriate against our own interests. Based on our segmentation by organisation, turnover and job function, and our processing of personal data within a business context, we believe any individual receiving direct marketing or sales correspondence from us could be legitimately interested in our services. We deem direct marketing and sales necessary to promote our business to professionals and increase awareness of our solution in the marketplace.
If you do not provide it. You are not obliged to provide your personal information; however, we need it to provide you with details of our services, and will not be able to offer some or all of our services without it.
How long we keep it. We retain personal information for a maximum of six years, with strict review and retention policies in place to meet these obligations.
Your rights
You have the right to access any personal information we process about you. Your rights are:
Right to be informed. To receive clear, easy to understand information on what personal information we hold, why, and who we share it with — which is what this notice provides.
Right of access. To receive a copy of the personal information we hold on you, by making a data subject access request.
Right to withdraw consent. Where you have given consent, you can withdraw it at any time. If withdrawal means we cannot provide certain services, we will tell you.
Right to rectification. If your personal information is inaccurate or incomplete, you can request that it be corrected.
Right to erasure. Also known as the right to be forgotten: you can ask us to delete your personal data where it is no longer necessary for us to use it, where you have withdrawn consent, or where we have no lawful basis for keeping or using it. Limited exceptions apply, for example where we need the information to bring or defend a legal claim.
Right to restrict processing. You can ask us to block or suppress processing for certain reasons. We may still keep the information, but only to ensure we do not use it in future for the reasons you have restricted.
Right to data portability. You can ask us to provide you or a third party with personal data you have given us, in a structured, commonly used electronic form.
Right to object. You may object to processing based on our legitimate interests or for direct marketing. We will assess whether our interest in continuing overrides your rights and freedoms, and will inform you of the outcome either way.
If we receive a request to exercise any of these rights, we may ask you to verify your identity first, to ensure your data stays protected and secure.
Security and international transfers
We take every reasonable measure and precaution to protect and secure your personal data. Maintenance of our network and systems controls lies with our hosting company, which is ISO 27001 certified. We work to protect you and your information from unauthorised access, alteration, disclosure or destruction, with several layers of security measures in place including SFTP, encryption, restricted access, IT authentication, firewalls and anti-virus/malware protection.
The majority of your information is processed in the UK and European Economic Area, where personal data is protected by the GDPR. Some of your information may be processed by us or partners we work with outside the EEA.
Where your information is processed outside the EEA, we take additional steps to ensure it is protected to at least an equivalent level to that required by UK and EEA data privacy law — for example, putting legal agreements in place with our suppliers and partners, and carrying out regular checks to ensure they meet those obligations.