Privacy notice.
How we collect, process, and protect personal data. Written to comply with the UK GDPR and the Data Protection Act 2018.
Last updated: 24 April 2026
Data controller
Rafferty & Maze Ltd, a company incorporated in England and Wales (company no. 15000000), is the data controller for personal data processed in connection with its commercial debt recovery services.
Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
Data protection enquiries: privacy@raffertymaze.com.
ICO registration number: ZB000000.
Personal data we process
We process limited categories of personal data about three groups of data subjects.
- Creditors and their representatives. Name, business email, business telephone, role, company name, correspondence records.
- Debtors and their officers. Company name, registered number, director names (from Companies House), business addresses, business email addresses where supplied, details of the debt, and records of communication.
- Website visitors. Data collected by necessary technical cookies only. No analytics or advertising identifiers are set without consent.
Legal bases for processing
We rely on the following lawful bases under Article 6 of the UK GDPR.
- Contract (Article 6(1)(b)), for processing necessary to perform the creditor‑facing services described in our Terms of Engagement.
- Legitimate interests (Article 6(1)(f)), for processing debtor data in order to pursue the creditor's lawful commercial debt, including identifying responsible company officers and communicating demands. Our assessment is that this interest is compatible with the rights and freedoms of the data subjects, given the limited data involved and the commercial context.
- Legal obligation (Article 6(1)(c)), for retaining records required by accountancy, anti‑money‑laundering, and tax law.
How we use personal data
- To assess and accept or decline instructions.
- To identify the debtor, compute amounts due under the Late Payment Act, and address correspondence to the correct legal entity and officers.
- To communicate with the creditor and with the debtor through the recovery sequence.
- To process payments into a designated client account and remit funds to the creditor.
- To refer matters to our panel solicitor where litigation is authorised.
- To maintain records of the matter for audit, regulatory, and tax purposes.
Sharing
We share personal data with a small number of service providers acting on our instructions as processors or joint controllers, including our IT providers, our bank, our accountant, and panel counsel where litigation is instructed. We do not sell personal data and do not share it for marketing purposes.
International transfers
Personal data is processed within the United Kingdom and the European Economic Area. Where a processor operates infrastructure outside those regions, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or other safeguards recognised by the UK GDPR.
Retention
We retain matter files for six years after the matter is closed, in line with professional and tax requirements. Correspondence relating to a concluded dispute is retained for six years from the date of settlement or final communication, whichever is later.
Your rights
Subject to conditions and exemptions under the UK GDPR, you have the right to request access to, rectification of, or erasure of personal data we hold about you. You may also object to processing based on legitimate interests and request restriction of processing in certain circumstances. To exercise any of these rights, write to privacy@raffertymaze.com.
Complaints
If you are not satisfied with how we have handled your data, you may complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.
Changes
We keep this notice under review. Material changes will be posted on this page with a revised date.