Privacy Policy

Last updated: 24 August 2026

1. Who we are

The data controller is PencilBox Property LTD (trading as Debits Direct), company number 11273945, registered office 123 Cross Lane East, Gravesend, Kent, DA12 5HA. ICO registration number: ZC230227. Contact: support@debitsdirect.co.uk.

2. What we collect

• Account and order data: your name, email address, the products you buy, and payment status.
• Payment data: your bank account details (for Direct Debits) and card details are collected and stored by our FCA-regulated payment providers — not by us. We receive only references, statuses, and the last digits needed to identify a mandate or payment.
• Hotlist data: your email address, if you join the offers hotlist.
• Technical data: privacy-friendly, cookieless analytics (page views, referrers). We do not run advertising trackers.

3. Why we use it (legal bases)

• To provide the service — contract performance: processing payments, sending mandate confirmations, receipts, switch-timeline and deadline emails.
• Offer hotlist emails — consent (free hotlist sign-ups) or legitimate interests under the "soft opt-in" (existing customers, who are told at checkout and can opt out there and in every email).
• Legal obligations — accounting and tax record-keeping, fraud prevention.

4. Marketing

When you buy from us, we may email you about new bank switch offers — the core thing our customers buy the service for. You can opt out at checkout, via the unsubscribe link in every email, or by emailing us. Free hotlist subscribers have opted in and can unsubscribe the same way. We never sell or share your details for third-party marketing.

5. Who we share data with

Our payment providers (to collect your payments), our email delivery provider (to send you service and hotlist emails), and our hosting providers. Each acts under contract and only on our instructions, except payment providers, which are independent controllers for the payment data they collect. We do not sell personal data.

6. Retention

Order and payment records: 6 years (tax law). Hotlist emails: until you unsubscribe. Cancelled account data: deleted or anonymised within 12 months of cancellation, except records we must keep by law.

7. Your rights

You have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent at any time. Email support@debitsdirect.co.uk and we'll respond within one month. You can complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with our response.

8. International transfers

Some providers (for example, email or hosting) may process data outside the UK; where they do, transfers are covered by UK adequacy decisions or standard contractual clauses.