Hoist Finance AB (publ) Netherlands (“HOFI”) is the data controller for the data we hold about you in relation to the processing activities set out in the table below. Your account is owned by HOFI, but all matters relating to debt collection, debt administration and the exercise of the lender’s rights in relation to your account are managed by either Vesting Finance B.V. (for Dutch customers) or Intrum NV (for Belgian customers), who are separate Data Controllers for all processing activities in relation to the debt collection.
All communication with you is managed by the relevant partner, including but not limited to handling complaints, delivering notices, and accepting and managing written correspondence relating to your debt.
For further information on how our partners process your personal data, please refer to their websites:
- Vesting Finance B.V. (Netherlands)
- Intrum NV (Belgium)
What information do we store, why do we process it, and how long do we keep it?
HOFI uses your data primarily for the purposes of managing, steering and administrating the outsourced debt collection. Additionally, and in accordance with the General Data Protection Regulation (GDPR), the Dutch Personal Data Protection Act 2018 and good debt collection practices, your personal data will be used by HOIST to collect and update documentation necessary to comply with applicable legislation, such as anti-money laundering legislation, Dutch tax legislation, accounting legislation, etc.
In order to pursue the above purposes and to act lawfully, transparently and fairly, we process the following types of information, always subject to strict controls, such as encryption, internal access rights and audits, to keep your information secure:
Processing activities in the debt collection process
Categories of data |
Purpose of the processing |
Legal basis for processing |
Data retention |
|
Contact details and account information, such as your name, home address, date of birth, national identification number, telephone number and details of previous communications with us, including emails and letters |
We process this data so that we can, , and generally maintain a complete and up-to-date picture of your circumstances and your dealings with us. This is necessary to handle your case fairly and in your best interests. |
The legal basis for processing this information is to which you are a party, a legitimate interest, or a legal obligation that we are required to comply with. Once your account has been closed, we will retain your data in order to comply with relevant regulations, such as anti-money laundering regulations, tax laws, accounting laws, etc. |
5 years (AML) and 7 years (Tax) from the date on which the complaint or legal proceedings were closed. |
|
Payment details, such as your bank account number, transaction history, financial information, etc. |
To provide accounting, AML and tax reports to the relevant authorities and to comply with our legal obligations. We also process this data to produce analytical and performance reports, which are used to improve the way we interact with our customers and to train our staff. |
Where do we get the information from?
We initially receive the information from the previous owner of the claim as part of the sale and transfer to us.
We may also receive and process personal data from third parties – means the above stated service providers Vesting Finance and Intrum – to ensure accuracy of the data we hold.
Disclosure of your information
We do not disclose your information except in the following limited circumstances:
- We may share your personal information within the Hoist Finance group of companies, to which we belong. For example, our IT infrastructure is managed at group level. This helps to keep our systems operational and secure so that we can provide you with the best possible services. The sharing of personal data is subject to security and privacy requirements laid down by law and our internal governance documents .
We may also share your personal data with carefully vetted organizations, who must comply with our strict contractual security and privacy requirements and follow our guidelines, for the following purposes:
- To help us manage your account and/or maintain the accuracy of the information we hold about you or when we engage a third party to collect or manage a debt on our behalf
Finally, we may also disclose your personal information to third parties:
- In the event that we sell or buy a business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such businesses or assets.
- If we are required to disclose or share your personal data to comply with a legal obligation, or to enforce or apply our terms of use, or to protect our rights, property or safety. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction, or with authorities for the purposes of tax reporting or anti-money laundering.
- Your data is generally stored within the EU/EEA or in countries deemed by the European Commission to offer an adequate level of protection; data may be transferred to other countries only for limited purposes and on a temporary basis. This is particularly the case when we require 24/7 technical support to maintain our IT infrastructure and when our service providers’ support teams are located outside the EU/EEA
- In all cases, however, we have technical, organizational, and contractual protections in place to keep the information safe and to ensure an adequate level of protection. Contractually, transfers outside the EU/EEA to countries without an adequacy decision by the European Commission will be based on standard data protection clauses adopted by the European Commission.
Processing activities in the recruitment process
When you apply for a job at Hoist Finance AB or another company within the Hoist Group, either directly via our website or through external recruitment agencies, we need to process your personal data. The purpose of processing your personal data is to manage applications received and to select suitable candidates for vacancies at Hoist Finance or any other company within the Hoist Group.
In order to fulfil the above-mentioned purposes properly, the following categories of personal data are processed:
Categories of data |
Purpose of the processing |
Legal basis for processing |
Data retention |
|
Contact details , such as name, title, home address, telephone number, personal email address, contact details of referees CV details, such as employment history, date of birth, gender, qualifications, nationality, occupation, professional memberships, educational achievements, degrees, transcripts, languages, computer skills, identification number, cover letter. |
Processing job applications and selecting suitable candidates for vacancies at Hoist Finance |
Performance of a contract |
5 years after the end of the recruitment process (successful candidates), 2 years after the end of the recruitment process (successful candidates) |
|
Reference data, ie all data provided to us by your reference |
To ensure that the job applicant is suitable for the applied position |
Performance of a contract |
5 years post end of recuritment (successful candidates), 2 year post end of recruitment (unsuccesful candidates) |
|
Background data, such as a national insurance number, CV verification, tax information and internet searches, credit information, information from law enforcement agencies, information on business obligations and assets, as well as information on civil proceedings and tax surcharges |
To ensure that the job applicant is suitable for the applied position |
Performance of a contract, legitimate interest |
Recruitment closed
|
How we use particulary sensitive personal data
We will use your sensitive personal data only in so far as we are permitted by law to do so:
- We will use information about your disability status to consider whether we need to make reasonable adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview.
- We will use data regarding your nationality or ethnicity to assess whether a work permit and a visa are required for the role.
Where do we obtain the information from?
We collect personal data about candidates from the following sources:
- You, the candidate.
- Your named referees, from whom we collect the following categories of data: full name, periods of previous employment, and performance during previous employment.
- From publicly available sources, such as LinkedIn etc., where we collect your full name, email address, employment history and other details from your profile.
- From third parties (such as recruitment agencies) who have referred you to us, or you may have applied directly via their website for a vacancy at our company. These third parties are data controllers for the data they collect and process for their own purposes. Further information on how they process your personal data can be found in their respective privacy statements on their websites.
- From third parties (such as pre-employment screening companies) who screen candidates in the final stage of the recruitment process .
Disclosure of your data
We will only share your personal data within the Hoist group of companies, including subsidiaries and affiliates, if necessary to finalize the recruitment process.
All our external service providers and other entities within the group are required to implement appropriate security measures to protect your personal data in accordance with data protection legislation, and data processing is restricted to the EU/EEA area. Should transfers outside the EU/EEA or to countries without an adequacy decision by the European Commission take place in the future, these will be contractually based on standard data protection clauses adopted by the European Commission .
Data Protection
We have implemented appropriate technical and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised manner, altered or disclosed. Furthermore, we only grant access to your personal data to employees, contractors and other third parties who have a business relationship with us on a ‘need-to-know’ basis.They process your personal data only on our specific instructions and are subject to a duty of confidentiality.
We have put procedures in place to deal with suspected personal data breaches and will notify you and any relevant authority of a suspected breach if we are legally obliged to do so
Your rights as a data subject
- Right of access:
You have the right to request a copy of the information we hold about you. If you would like a copy of some or all of your personal data, please contact us. We will respond to your request within one month. - Right to rectification:
We want to ensure that your personal information is accurate and up to date. You can ask us to correct or delete information that you believe is incorrect. We may ask you to provide reasonable evidence to verify your request. - Right to restrict processing:
If you believe that the personal data we hold is inaccurate or unlawful, or that we have no legitimate interest in processing it, you may request that we restrict processing until this has been rectified. - Right to object to processing:
Where your particular situation requires that we no longer process your data for the performance of a task carried out in the public interest or on the basis of our legitimate interest, you have the right to object to the processing. - Right to data portability:
This right allows you to obtain the information you have provided to us in a structured, commonly used format, to reuse it for your own purposes, and to have it transferred directly to other services. This applies only to information we process on the basis of your consent or a contractual basis. - Rights relating to automated decision-making and profiling:
You have the right to safeguards against the risk of potentially harmful decisions being made without human intervention. This right applies when a decision is based solely on automated processing and has legal or similarly significant effects. If this is the case, we must ensure that you can obtain human intervention, put forward your point of view and have the opportunity to challenge the decision. We will also explain the logic behind the decision.
Profiling is defined as any form of automated processing intended to evaluate certain personal aspects relating to a natural person in order to analyse or predict aspects of their personal circumstances, behaviour or capabilities. The processing must be fair and transparent, use appropriate mathematical or statistical procedures, employ appropriate safeguards to minimise inaccuracies, and protect personal data.
We do not use such automated individual decision-making . - Right to erasure (“right to be forgotten”):
You may ask us to erase the information we hold about you where it is no longer necessary for the purpose for which it was collected; where you withdraw your consent to its processing; where you object to our processing of it (see above); or where our processing is unlawful. Please note, however, that we are also subject to certain legal obligations that prevent us from deleting all your data immediately. For example, we are legally obliged to retain certain data for anti-money laundering purposes for at least five years. Data that we are not permitted to delete will, however, be blocked and, once we are no longer required to retain it, deleted. - Right to lodge a complaint:
You have the right to lodge a complaint with the Dutch data protection supervisory authority, the Autoriteit Persoonsgegevens: https://www.autoriteitpersoonsgegevens.nl/
Changes to this Privacy Notice
We review this Privacy Notice regularly. We will notify you two weeks in advance of any significant updates that affect you. Minor changes to the policy, such as clarifications, will be implemented without notifying you directly.
This privacy statement was last updated on 08 May 2026 .
How to contact us
Please contact us if you have any questions about our privacy policy, the information we hold about you, or the basis on which we process such information:
Hoist Finance AB (publ), Netherlands
PO Box 70150, NL 1007 KD – Amsterdam
privacyNL@hoistfinance.com
