Who we are
This is the privacy statement of Carter Clark, Insolvency Practitioners (“we”, “us” or “our”). For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Carter Clark acts as the data controller in respect of personal data processed in connection with insolvency appointments and related services. This privacy statement explains how we collect and use personal information about you.
What Is Personal Data?
Personal data is defined by the UK GDPR and the Data Protection Act 2018. This may include special category personal data and criminal offence data where this is necessary in connection with an insolvency appointment or related statutory duties.
What personal information we collect
The personal information we collect on you will depend on whether you are the insolvent entity or your relationship with the insolvent entity with which we are dealing.
If you are the insolvent entity we will obtain information concerning your creditors, obtain documentation to verify your identity and obtain information generally relating to your financial affairs.
Personal data will also be obtained from directors and shareholders who own more than 25% of the issued share capital of the company. This data will include personal data sufficient to identify in accordance with any legal requirement, your address and the number of shares you hold in the company. We will also obtain details of your financial dealings with the insolvent entity.
As an employee of an insolvent entity we will obtain your name and address, age, information relating to your employment, your National Insurance number, details of the wages or salary paid to you and your bank details. This may include special category personal data where necessary, for example in relation to redundancy, statutory claims or health-related information.
We will also obtain personal data relating to creditors of an insolvent entity. Typically, this will include a creditors name and address, the amount owed to them by the insolvent entity and any additional evidence required to substantiate the creditors claim.
Where we collect personal information from
Our primary source of personal data is generally the insolvent entity or from the financial records of the insolvent entity. Other sources from which data is received include yourselves, statutory bodies, public registers, and others dealing with your data in connection with the insolvency process.
How we use your personal information
Your personal data will only be utilised in conjunction with the insolvency process in which it was obtained. Within the relevant insolvency process, your personal data will be used to prepare the Statement of Affairs for the insolvent entity, processing of any claims made to the Redundancy Payments Office and generally in carrying out the statutory duties of an insolvency office holder.
Lawful Basis for Processing
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018. In most cases, personal data is processed on the basis that it is necessary for compliance with a legal obligation; necessary for the performance of a task carried out in the public interest or in the exercise of official authority as an insolvency office holder necessary for our legitimate interests in administering insolvency proceedings, provided those interests are not overridden by your rights; or necessary for the performance of a contract where applicable. We do not generally rely on consent as the lawful basis for processing personal data in insolvency appointments.
The purposes for which personal information is processed may include any or all of the following (the list is non-exhaustive)
- deliver services and meet legal responsibilities
- verify identity, where this is required
- communication by post, email or telephone
- maintain records
- process financial transactions
- prevent and detect crime, fraud or corruption and other forms of financial crime
- authenticating registered users uploading data to our portals or website.
Who we share your personal information with
During the course of an Insolvency assignment there are a variety of persons and organisations with whom we may share your personal data. All persons and organisations with whom it is shared will either receive the information to further the objects of the insolvency process or because of a statutory or professional obligation to provide the information to third parties. Typically, information will be shared with the following persons, organisations and classes of people listed below:
- Other creditors
- Companies House
- The Redundancy Payments Office
- The Director Disqualification Unit of the Insolvency Service.
- HMRC
- Any agents instructed by us to market the business or its assets
- Prospective purchasers of the business or assets and their advisors.
- Where necessary any professional advisers instructed on behalf of the office holder.
- Parties that provide support to the firm with anti-money laundering, client conflicts and independence checks
- Our regulator, the Institute of Chartered Accountants for England and Wales and The Insolvency Service as the ultimate regulator of licensed insolvency practitioners.
- Parties that support us to provide our services (e.g. providers of telecommunication systems, mailroom and postal support, archiving services, cloud-based software services)
Automated Decision Making and the Use of Artificial Intelligence (AI)
We do not use personal data to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals.
We may use Artificial Intelligence (AI) tools to support administrative efficiency, document review, research and analysis. AI tools are used only as decision-support mechanisms and do not make decisions that produce legal or similarly significant effects on individuals without human involvement.
Where AI tools are provided by third parties, personal data may be processed in accordance with the terms and privacy policies of those providers. We do not intentionally submit personal data for the purpose of training AI models, and we take reasonable steps to minimise the personal data shared with such tools.
All material decisions affecting individuals are made or reviewed by a human decision-maker exercising professional judgement. This may include analysing data to improve your interactions with us, streamline operations and provide assistance or tailored content. This information is used in line with applicable regulations and laws. Any data processed by an AI system is handled in accordance with our commitments to privacy fairness and transparency.
If you do not provide your personal information
As an insolvent individual or a director of an insolvent corporate entity statute requires that you give full and frank disclosure of information relating to you or the corporate entity of which you are a director.
In the case of an individual insolvency, if your personal data is not provided it is unlikely that a formal insolvency process can be undertaken for you. If incomplete personal information is given this can potentially enable creditors to apply to court to overturn any approval of certain insolvency processes. Giving misleading or deliberately false information is also an offence under the Insolvency Act 1986.
The Insolvency Act 1986 imposes on a director of an insolvent corporate entity an obligation to provide information to the Insolvency office holder. Not providing this information, even if it is personal data, is a potential criminal offence under the Insolvency Act 1986. Failure to provide information would also be treated as non-cooperation with the office holder and is a reportable matter under the Director Disqualification Act 1986
As a creditor or employee of the insolvent entity, if you do not provide the personal information requested, we will not be able to process your claim, and this could result in you not receiving money to which you are entitled. You will also not be able to vote on any decision process within the insolvency.
How long we retain your personal information for
We are required to hold the books and records of the company for 12 months following the dissolution of the company at the end of the insolvency process. Dissolution occurs approximately two months after the formal conclusion of the final insolvency process affecting the insolvent entity. If personal information is held on our case file, we are required to retain our case files for 6 years following formal closure of the insolvency appointment, reflecting statutory obligations, regulatory requirements, and applicable limitation periods.
International Transfers
We do not routinely transfer personal data outside the United Kingdom. Where personal data is processed using cloud-based systems or IT service providers, appropriate safeguards are in place, including UK adequacy decisions or approved international data transfer agreements.
Using our website
We use our website to upload case documents so that they are available to creditors. When logging on to the website to download documents, we receive details of the fact that you have logged on to the website and the email address you used to download the documents. We may use external parties for this practice.
Your rights
Access to your information – You have the right to request a copy of the personal information about you that we hold.
Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Deletion of your information – You have the right to ask us to delete personal information, subject to our statutory and regulatory obligations, which may require us to retain personal data notwithstanding such a request.
Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don’t want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Automated processing – If we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision. This right only applies where we use your information with your consent or as part of a contractual relationship with you.
Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website, and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. Paper copies of the privacy statement may also be obtained by contacting us by telephone on 020 8524 1447 or by emailing recovery@carterclark.co.uk
This privacy statement was last updated on 20 January 2026.
This Privacy Policy applies only to your use of Our Site. Our Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.
Contact information and further advice
We have appointed a Data Protection Officer on a voluntary basis to oversee data protection compliance.
If you have any questions or comments about this Privacy Notice or how we handle personal data, please contact our data protection officer, detailed below. We aim to respond within 30 days from the date we receive privacy related communication.
Our data protection officer is:
Paul Higley
Carter Clark
Recovery House
Units 1 & 2, 15-17 Roebuck Road
Hainault Business Park
Ilford
Essex
IG6 3TU
email: paul.higley@carterclark.co.uk
Complaints
We seek to resolve directly all complaints about how we handle personal information, but you also have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details are as follows:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone – 0303 123 1113 (local rate) or 01625 545 745
Website – https://ico.org.uk/concerns
