Version 1.0. Last updated 19 October 2026. This notice applies to the website duepaid.co.uk and to the emails and letters we send in the course of our business.
1.1 This notice is issued by Harrison Murray trading as DuePaid, a sole trader ("DuePaid", "we", "us" or "our"). Our postal address is the address shown on our Contact and legal details page on the website. You can contact us about anything in this notice by email at [email protected], and we will direct your message to the person responsible for data protection, who is Harrison Murray.
1.2 Registration with the Information Commissioner's Office is in progress.
1.3 We help UK businesses to recover overdue invoices from other limited companies and limited liability partnerships. In doing so we handle some personal data about the people who work for those businesses. This notice explains what we collect, where it comes from, why we use it, who receives it, how long we keep it and what rights you have. It is written for people who deal with us in one of three ways, which are described in sections 3 to 5 below.
2.1 For the personal data described in this notice we act as a controller within the meaning of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. This means that we decide for ourselves why and how that data is used, and we are directly responsible to you for doing so lawfully, fairly and transparently.
2.2 When we contact a debtor company on behalf of a client, we are an independent controller of the debtor contact data we collect and use for that purpose. We are not simply a processor acting on a client's instructions. We work within the instructions our client gives us about the debt, but we make our own decisions about how and when we contact you, and we answer for those decisions ourselves.
2.3 Our client is a separate controller of its own customer and accounting records, including the invoice and contact details it shares with us. Our client is named in every message we send. If your request or concern relates to records held by our client, we will tell you so, and we may let the client know that you have raised it so that it can respond to you directly.
3.1 This section applies to directors, officers, employees and other contacts of a limited company or limited liability partnership that is said to owe an unpaid invoice to one of our clients. We do not pursue consumers, sole traders or ordinary partnerships, and this section is not aimed at them.
3.2 The personal data we use is normally limited to your name, your job title, your work email address or the postal address of the company, the details of the invoice concerned, the messages we exchange with you, and anything you choose to tell us about the invoice or your circumstances. We try not to collect more than we need, and we do not ask for information about your private life, health or personal finances.
3.3 We receive this data from several sources. Our client gives us the invoice and contact details it holds. We also use public registers, including Companies House for the company's status, registered office and officers, and The Gazette for insolvency notices. We may use role email addresses published by the company itself, such as an accounts or info address on its website. If we found your email address ourselves rather than from our client, we say so in our first message to you.
3.4 We use this data to contact the company about an invoice that our client says is overdue, to ask for payment to be made to our client directly, to record replies, disputes and payment arrangements, to check that a debt is still owed before we write, to report to our client, and to keep records that show we have acted properly. Where a claim proceeds to court, we may also use it to help the client's solicitor.
3.5 Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. The interests are ours and our client's, namely recovering money properly owed between businesses and keeping accurate records. We have weighed these interests against your rights. Our test asks whether the use is needed for that purpose, whether less intrusive means would achieve it, and whether it is within your reasonable expectations as someone who works for a business with an unpaid invoice. We contact only business addresses, in writing, at limited times, and we stop when asked. You may object, as explained in section 12.
3.6 We keep this data while the debt is open and for 12 months after the case closes or after the last contact with you, whichever is later, and then we delete it. We keep a suppression record, consisting of your email address only, for as long as is needed to make sure we do not contact you again after you have asked us to stop. That record is kept indefinitely.
4.1 This section applies to directors and finance contacts at limited companies and limited liability partnerships to whom we send an introductory email about our service. We email only these types of organisation. We do not send marketing emails to sole traders or ordinary partnerships, because the rules on electronic marketing are different for them and we respect those differences.
4.2 The data we hold about prospects is your name, your job title, your work email address, and figures that the company has itself filed at Companies House, which we may refer to in our email to show why our service may be relevant. We collect it from Companies House, from the company's own website and from other public sources. We do not buy lists of personal data from third parties.
4.3 Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. Our interest is in telling businesses about a service that may help them. We have carried out a written balancing assessment, which we will provide on request. It considers that the email is sent to a business contact about a business matter, that the sender is clearly identified, that the volume is small, and that every email includes a simple way to opt out, so the impact on you is limited.
4.4 Under the Privacy and Electronic Communications Regulations 2003 ("PECR"), our emails are sent to corporate subscribers, meaning limited companies and limited liability partnerships. Each email identifies DuePaid, gives a contact address and includes an opt-out. If you opt out, we act on it straight away and add your address to a suppression list so that we do not email you again. We hold only the address for that purpose.
4.5 We keep prospect data for 12 months after our last contact with you. If we have collected your details but never contacted you, we delete them 12 months after collection. We delete earlier if you opt out or ask us to, except for the suppression record, which we keep indefinitely so that your wishes continue to be respected.
5.1 This section applies to businesses that use our service and to people who visit our website. For clients we hold your name, work email address, company details, the bank details you give us for the account into which debtors should pay you, the signed terms of our agreement with the time and IP address of signature, the debts you ask us to pursue, the messages we send for you, and the invoices we issue to you.
5.2 We use client data to provide the service, to bill you, to check the identity and standing of your business, to meet our legal obligations such as accounting and tax, and to keep our systems secure. Our lawful bases are performance of our contract with you, compliance with legal obligations, and legitimate interests in security and in protecting ourselves against claims. We never give out our own bank details to debtors, and we do not hold client money.
5.3 We keep client and legal records for the term of the contract plus 6 years, which allows us to meet tax and accounting requirements and to deal with any dispute or claim. After that period the records are deleted. Records of messages and decisions on a particular debt are dealt with under the shorter periods in section 3 unless we need them for a complaint, a fee dispute or a claim.
5.4 Visitors to the website generate basic technical logs, such as an IP address, browser type and the pages requested, which our hosting and security providers keep for a short period for security and to keep the site working. We do not use these logs to build profiles of individuals. Our use of them is based on our legitimate interest in keeping the website secure and available.
6.1 We use software tools to help sort replies and prepare correspondence. A person is responsible for the way those tools are used, and for the content of what we send. Messages follow approved templates, and checks are applied before any message goes out, including that the amounts match our client's records and that the recipient has not asked us to stop.
6.2 We do not make solely automated decisions about you that produce legal effects or similarly significant effects on you. A person is involved in any decision of that kind. If you believe a decision has been made about you without proper human involvement, you can ask us at [email protected] to have a person review it, and we will do so and tell you the outcome.
7.1 We do not sell personal data to anyone, and we do not share it with other organisations for their own marketing. We do not use personal data for advertising of any kind, whether our own or anyone else's, and we do not use advertising or tracking technologies on our website.
7.2 We do not send client or debtor data to free online services. Personal data is processed only by the providers listed in section 8, each of which is used for a specific purpose, and we do not allow them to use that data for their own purposes beyond what is needed to provide their service to us.
8.1 We share personal data only with the following categories of recipient, and only as far as is needed. Our client receives the details of the debt and your replies. Where a claim proceeds, a solicitor and the court may receive the relevant details. We may also disclose data where the law requires it, for example to a regulator, a court or the police, or to protect our legal rights.
8.2 Our service providers act on our behalf and are bound by written terms. Brevo, based in France, sends email for us and processes data within France and the European Economic Area. Hetzner hosts our systems in Germany and Finland. Cloudflare provides our domain, email routing, website delivery and security through a global network and is a company based in the United States.
8.3 We also use a technology provider, based in the United States, which helps us sort replies and prepare correspondence. A UK print-and-post provider prints and posts letters for us within the United Kingdom. We choose providers carefully, we give them only the data they need, and we review their terms and security arrangements before and during use.
9.1 Most of our processing takes place in the United Kingdom or the European Economic Area, but some of our providers, or their group companies or support staff, are located in or can access data from the United States. Where personal data leaves the United Kingdom, we make sure that a lawful transfer route and appropriate safeguards are in place, as the UK GDPR requires.
9.2 For transfers to the European Economic Area, including to Brevo in France and to Hetzner in Germany and Finland, we rely on the UK's adequacy regulations, which recognise the legal protection there as adequate. For transfers to the United States, including to Cloudflare and our technology provider, we rely on the UK-US data bridge where the provider is certified under it. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
9.3 You can ask us for further information about the safeguards we use for a particular transfer by emailing [email protected]. We will explain the route relied on, and we will give you a copy of the relevant contractual terms where we can do so without disclosing information that is confidential to us or the provider.
10.1 We keep personal data only for as long as we need it for the purposes in this notice. For debtor contacts, we keep data while the debt is open and for 12 months after the case closes or after our last contact with you, and then delete it. For prospects we have contacted, the period is 12 months after our last contact, and for prospects we have not contacted it is 12 months after we collected the data.
10.2 Client records, signed terms, invoices and related legal records are kept for the term of the contract plus 6 years, which reflects the period within which claims can normally be brought and the period for which accounting and tax records must be retained. We may keep records of a particular matter for longer than the standard period only where needed for the law, a complaint, a fee dispute or a claim, and only for as long as that need lasts.
10.3 Suppression records, which consist of an email address only, are kept indefinitely. This is because deleting the record would mean that we could no longer make sure that we do not contact you again. The record is used for no other purpose. When a retention period ends, we delete the data or irreversibly anonymise it, and we ask our providers to do the same where they hold it for us.
11.1 We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted connections between your browser and our website, access to our systems restricted to those who need it, password protection and additional sign-in checks on the accounts we use where providers offer them, and keeping personal data within the providers listed in this notice.
11.2 We limit the data that is placed in any system, we avoid sending personal data to free online services, and we choose providers that offer reasonable security commitments. Anyone who works for us and has access to personal data is required to keep it confidential. No system is completely secure, but we review our measures regularly. If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours where required, and we will tell you where the law requires it.
12.1 You have a right of access. You can ask us to confirm whether we hold personal data about you and to give you a copy of it, together with information about why we hold it, where it came from, who receives it and how long we keep it. We will normally provide this free of charge, and we may need to ask you for information to confirm who you are.
12.2 You have a right to rectification, which allows you to ask us to correct personal data that is inaccurate and to complete data that is incomplete. You also have a right to erasure, sometimes called the right to be forgotten, which allows you to ask us to delete your data in certain circumstances, for example where we no longer need it or where you have successfully objected to our use of it. These rights are not absolute, and we may need to keep data to meet legal obligations or to deal with a claim.
12.3 You have a right to restrict our use of your data in certain circumstances, for example while we check its accuracy or consider an objection you have made. You have a right to data portability, which applies where we use your data on the basis of consent or contract and by automated means, and which allows you to receive it in a structured, commonly used and electronic format.
12.4 You have a right to object to our use of your data where we rely on legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. You have an absolute right to object to direct marketing, and we will always act on that. You also have the right to ask for human review of any decision as explained in section 6.
12.5 To use any of these rights, email [email protected] and tell us what you would like us to do. We will respond within one month of receiving your request. If your request is complex or we receive a number of requests from you, we may extend that period by up to two further months, and if so we will tell you within the first month and explain why. If we decide not to act on your request, we will tell you why and tell you about your right to complain.
13.1 Our website does not set any non-essential cookies. We do not use advertising cookies, analytics cookies that track you across sites, social media tracking or similar technologies. We therefore do not display a cookie consent banner, because consent is required only for non-essential cookies and similar technologies.
13.2 Our hosting and security providers may use technically necessary mechanisms to deliver the website and to protect it from attack. These do not track you for advertising or build profiles, and they are exempt from the consent requirement under PECR. If we ever decide to introduce non-essential cookies, we will first update this notice and ask for your consent before setting them.
14.1 Our service is for businesses and our website is not directed at children. We do not knowingly collect personal data from anyone under the age of 18, and we do not market to them. The people we deal with are directors, officers and employees of companies.
14.2 If you believe that we have collected personal data about a child, please contact us at [email protected] and we will review the matter promptly and delete the data if it should not have been collected.
15.1 If you are unhappy about how we have used your personal data, please tell us first at [email protected]. Our Complaints Procedure applies. We will acknowledge your complaint in writing within 2 working days and send a final written reply within 15 working days, unless we tell you before then that we need longer and give you a date.
15.2 You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time. You do not have to complain to us first. You can make a complaint at ico.org.uk/make-a-complaint or call the ICO helpline on 0303 123 1113. Making a complaint will not affect how we treat you.
16.1 We may update this notice from time to time, for example if we change the way we use personal data, add a new category of provider, or the law changes. The current version is always published on our website, with its version number and the date it was last updated shown at the top.
16.2 If we make a material change that affects how we use data we already hold about you, we will tell you in a way that is suitable for how we are in contact with you, for example by a note in our next email to you or by a notice on our website. Earlier versions are available on request from [email protected].