Data Protection & GDPR Compliance
Last updated: August 2026
Our Commitment to Data Protection
CM Debt Recovery takes data protection seriously. We are registered with the Information Commissioner's Office (ICO) and comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
ICO Registration Number: ZB866648
Data Protection Principles
We adhere to the following data protection principles when processing your personal data:
- Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
- Purpose Limitation: We collect data only for specified, explicit, and legitimate purposes
- Data Minimisation: We process only data that is adequate, relevant, and limited to what is necessary
- Accuracy: We take reasonable steps to ensure data is accurate and kept up to date
- Storage Limitation: We retain data no longer than necessary
- Integrity and Confidentiality: We protect data using appropriate security measures
- Accountability: We are responsible for demonstrating compliance with these principles
Lawful Bases for Processing
We rely on one or more of the following lawful bases when processing personal data:
- Contract: Processing is necessary for performing our contract with you
- Legal Obligation: Processing is necessary for compliance with legal obligations
- Legitimate Interests: Processing is necessary for our legitimate interests (or those of a third party) unless overridden by your rights
- Consent: You have given clear consent for the specific processing activity
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right to Access (Subject Access Request)
You can request confirmation that we are processing your personal data and obtain access to that data and supplementary information.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to Be Forgotten")
In certain circumstances, you can request deletion of your personal data.
Right to Restrict Processing
In certain circumstances, you can request that we restrict processing of your data.
Right to Data Portability
You can request transfer of your data in a machine-readable format to another controller.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to solely automated decisions that have legal effects on you.
How to Exercise Your Rights
To exercise any of these rights, please contact us:
- Email: info@cmdebtrecovery.co.uk
- Post: CM Debt Recovery, 3 Jubilee House, The Drive, Great Warley, Brentwood, Essex, CM13 3FR
- Phone: 01245 976 716
We will respond to your request within one month (extendable by two months for complex requests).
Data Breaches
In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and, where appropriate, inform affected individuals without undue delay.
International Transfers
We do not transfer personal data outside of the UK/European Economic Area unless appropriate safeguards are in place.
Data Protection Officer
Craig Martindale acts as the person responsible for data protection matters within CM Debt Recovery. For data protection queries, please contact us using the details above.
Complaints
If you have any questions about how we handle your data or respond to your requests, please contact us using the details above.