This privacy notice sets out the way in which we will collect and use your personal information. For the purpose of this notice, “we” refers to CLB Direct Limited.
Galahad Legal & Financial Ltd “Galahad LF” is the Controller of your personal data, under the UK General Data Protection Regulation (UK GDPR). CLB Direct Limited is incorporated in England, company registration number 13064657.
You may contact Galahad LF to make requests, for example to exercise your data protection rights, to provide positive feedback or to make complaints by writing to us at:
or by emailing firstname.lastname@example.org
We process your personal data for the following purposes:
a. To assess whether you have a claim with the institutions who you may have taken out credit products with.
b. To receive newsletters, once you have chosen to complete the form on our website.
c. Progress your claims with the institutions who you may have taken out credit products with
d. To provide customer services, e.g. complaints management,
e. For due diligence relating to credit and financial products, sales and purchases
The legal basis for processing your personal data for purposes (a) and (b) above is consent.
The legal basis for processing your personal data for purpose (c) and (d) is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
The legal basis for processing your personal data for purpose (e) above is that the processing is necessary for the purposes of the legitimate interests pursued by the Controller.
The legal basis for processing your special personal data is that the processing is needed to pursue your legal claim.
We may receive your personal data and special categories of personal data from for the purposes set out above. The categories of personal data we process will vary depending upon the type of insurance product that is held by you or the insurance product provided to an organisation that you are contracted to. Personal data may include:
Personal Data Special Categories of Personal Data
First name, last name, email address, address, passport ID, other photo ID, financial information – account and policy details and DOB. Health data.
In addition to the above, we may require you to share a ‘credit check’ with us.
Within Galahad LF, only those members of the workforce who have a valid business ‘need to know’ will be granted access to your personal data. Further, individual team members will only be given access to the part of your data that they need to perform their roles. These members of our team:
• Provide general customer services to you
• Provide legal and claims handling services to your or to a company you are contracted to
• Provide payment processing for professional services
Externally, your data may be shared with the following types of organisations for the reasons set out below – specifically so that we can deliver our service to you. Wherever possible the data shared are either anonymised and/or minimised and only those with a valid business ‘need to know’ in the receiving organisation are granted access.
Your personal data may be shared with:
• Financial institutions and lenders, to progress your claim.
• Law firms to progress your claim, if we are no longer able to assist you.
• Our external IT company.
• Our web developers used to manage our newsletter delivery.
• Companies that provide accounting and payment processing services to us.
• Processors that may provide professional services, such as scanning and storage services.
We may be required to share your personal data with other agencies to prevent fraud.
We may share your data with potential investors, funders or purchasers for due diligence purposes relating to corporate investment, sales and purchases.
In the event of litigation, we may be required to share your information with professional service providers, e.g. lawyers.
If you wish to understand more about what which companies your personal data are shared with, please contact us at email@example.com
We may transfer your information to jurisdictions outside of the UK as necessary for the purposes described here, including to countries that may not provide the same level of data protection as your home country. To protect such information, transfers will be made as permitted by applicable law, including where necessary being subject to appropriate standard contractual clauses. Regardless of where we process your information, we protect it in the manner described in this privacy statement and in accordance with applicable law.
We will use this information to identify you, and to locate your products with the relevant financial institutions. A ‘credit check’ would be used solely for the purpose of identifying the products and institutions with which you may have held payment protection insurance policies.
We will not send you any marketing information on any product or service provided by Galahad LF or any other company, including any affiliates of Galahad LF.
We will ensure your data is stored securely and that this is only accessed by authorised persons for the purposes set out above. As far as possible we will hold all records electronically. All data will be held and accessed in accordance with the UK General Data Protection Regulation and Data Protection Act 2018.
You can find further information on GDPR below and on the website of the Information Commissioner’s Office at www.ico.org.uk.
We will not keep your information for any longer than is necessary in the context of your engagement with us. We may be required to keep your information after our engagement has ended; for example to support any future complaints or to maintain our financial records.
We will not retain your data when there is no longer an adequate reason to do so. In all instances we will not retain data for longer than a 24-month period following conclusion of your case or termination of our engagement under any other circumstances (such as cancellation by you). Once this data is no longer required this will be disposed of securely without prejudicing any of your confidential information in accordance with the UK GDPR.
Please contact us via email or phone to inform us of any change to your contact details.
It is very important that the details we hold are kept up to date.
You can request a copy of the information which we hold about you by submission of a Subject Access Request. This request can be made verbally, or in writing to our registered office address. We will respond within one month and provide copies of all personal data we hold.
Except in exceptional circumstances (for example where the request involves excessive and extraordinary administration) you will not need to pay any fee for this service.
Further information on how to submit a Subject Access Request can be found on the Information Commissioner’s Office website at www.ico.org.uk.
You have the right to exercise the following rights under UK data protection law. Please contact us using the contact details set out below if you wish to exercise any of these rights:
● Transparency – we must provide you with all the information set out in this privacy notice in a concise, transparent, intelligible and easily accessible form, using clear and plain language, so that you may understand how and why we process your data and what your rights are. We must keep you informed in a timely manner about our progress in responding to requests from you to access your rights under data protection law.
● Rights of access by the data subject – you have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, to have access to the personal data and associated information.
● Right to rectification – you have the right to have the personal data concerning yourself rectified without undue delay if it is not accurate. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
● Right to erasure (‘right to be forgotten’) – In some limited circumstances, you may have the right to obtain from us the erasure of your personal data without undue delay, when and if:
a. Processing your personal data is no longer necessary in relation to the purposes for which your data were collected
b. Where you withdraw consent for processing, but only if consent was the legal basis relied upon for that processing
c. You object to processing and there are no overriding legitimate grounds for the processing or where you withdraw your consent to marketing
d. Your personal data has been unlawfully processed
e. Your personal data has to be erased to comply with a legal obligation to which the Controller is subject
f. Your personal data has been collected in relation to the offer of information society services to children
● Right to restriction of processing – In some limited circumstances you have the right to request that the processing of your personal data is restricted, in some cases for a limited time only, specifically when:
a. You are contesting the accuracy of your personal data while we verify its accuracy or correct it.
b. The processing is unlawful and you oppose the erasure of your data.
c. Where we no longer need your personal data for the purposes for which it was obtained but where you require the data for the establishment, exercise or defence of legal claims.
d. Where you have objected to the processing of your data pending the verification of whether legitimate grounds of the Controller override your interests.
You have the right to be informed by the Controller before the restriction of processing is lifted.
● Notification obligation regarding rectification or erasure of personal data or restriction of processing – We will let you know when the following things happen, unless is proves impossible or disproportionate to do so:
a. When we have rectified your data
b. When we have erased your personal data
c. When we have restricted the processing of your personal data
d. When we intend to lift any restriction to the processing of your personal data
We will also advise you about any recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort
● Right to data portability – Upon your request and where the legal basis for processing your personal data is ‘consent’ or ‘contract’, we will provide you with a copy of your personal data that you have provided to us and which are processed by automated means, in a structured, commonly used and machine-readable format. Upon your request and where technically feasible, we will also transmit those data to another data controller.
● Right to object – In some limited circumstances, you have the right to object to our processing of your personal data. When certain conditions are met we, as Controller, will no longer process your personal data. This right can be exercised only when:
a. Either the processing is necessary for the performance of a task carried out in the public interest or processing is necessary for the purposes of our legitimate interests (including profiling), but where we cannot demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or where processing is necessary for the establishments, exercise or defence of legal claims.
b. Processing for direct marketing purposes, including profiling.
c. When personal data are processed for scientific or historical research purposes or statistic purposes unless the processing is necessary for the performance of a task carried out for reasons of public interest.
● Automated decision-making, including profiling – You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significant effects. At the current time, we do not perform automated decision making or profiling.
You can contact us to request to exercise these rights at any time by email (firstname.lastname@example.org) or post.
If we choose not to action your request we will explain to you the reasons for our refusal.
In cases where we are processing your personal data on the basis of our legitimate interest (for example where data has been retained to resolve a service complaint), you can ask us to stop for reasons connected to your individual situation.
We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.
We do not currently perform automated decision making or profiling.
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact the Information Commissioner’s Office directly by: calling 0303 123 1113 or online at www.ico.org.uk/concerns or
The Information Commissioner’s Office
Tel: 0303 123 1113 (local rate)
or online at www.ico.org.uk/concerns
Please contact us via email if you have any questions in relation to the information which we collect and how it is used. Should you wish to complain about the way in which your data has been used, further details on our complaints process can here.
If you would like to speak to someone about what we do and how we can help, we will be happy to answer any questions you have. Please contact us via email or using the form below.
“Freed from over £70,000 of debt in just 1 year! The whole process was easy… Galahad & Co. gave me the chance to finally be debt free.
A huge relief.” – Angela Kelly
“We in debt are vulnerable. Galahad & Co. put an end to years of stress and sleepless nights with creditors looming over me.
Excellent and very personal service. Recommend them heartily!” – Raheela Salim
“I cannot explain the deep relief you feel when your debt has disappeared.
There are no real words to say thank you when you have been set free.” – Susan Yeo
“I’m so glad I found Galahad & Co.! For 15 years I was struggling in debt management and going nowhere.
Thanks to Galahad & Co., I was completely freed from over £250,000 of debt in just one year!” – Luke Thomas
“This changed my life! Galahad & Co. sorted all my debts and gave me back my life. I’ll be forever grateful.” – Mrs Thomas