Do our creditor clients have to approve a vendor that receives their account data?

The answer sits in your placement agreements

Whether a creditor must approve, or be told about, a vendor that receives its account data is set by your placement agreement with that creditor, and agreements differ. Read the clauses on vendors, subcontractors and where account data may go, and have your counsel decide what each creditor needs before any of its accounts are in scope. BestPair does not provide legal or compliance advice.

Settle it before you sign. The Floor Assessment fee is paid before any data moves and is not refundable, so a creditor approval that arrives late holds up the work you have already paid for. The Order Form lists the campaigns in scope, so a campaign can be left out while its creditor decides. Adding it later needs its own Order Form.

What BestPair’s contracts say about your clients

• BestPair is your sub-processor. The Data Processing Addendum says that where your agency processes personal information for its own clients, such as creditors or healthcare providers, BestPair acts as your agency’s sub-processor. Your agency is responsible for making sure its instructions to BestPair are consistent with its agreements with those clients.
• Your agency confirms the rights. In the Standard Terms, your agency confirms it has obtained all rights, notices and consents needed for BestPair to process the data, including under its agreements with its own clients.
• The agreement is between BestPair and your agency. Your creditor clients are not parties to it, and no one else has rights under it.
• Collection activity stays with your agency, including compliance with your client agreements. BestPair does not contact consumers, and it does not decide whether an account is worked, what a consumer is offered or the terms of any collection.

What BestPair provides for a vendor file

CFPB Bulletin 2016-02 is the CFPB’s 2016 bulletin on how supervised companies manage the risk from their service providers. Which rules or policies a creditor’s vendor review follows is for the creditor and your counsel to say. Whatever its basis, this is what BestPair provides to your agency for the file. The review and audit rows are your agency’s rights under the Data Processing Addendum, not a creditor’s own:

What a security review asks, and how BestPair answers.

What a reviewer will see about the data

The data is pseudonymised only. BestPair never asks for consumer names, Social Security numbers, phone numbers, email or street addresses, or bank or card details. Account IDs are your own, so BestPair cannot tell who a consumer is. The account fields are balance, days delinquent, placement date, consumer age band, state and ZIP code, alongside call and payment history and an agent roster.

Files arrive by encrypted SFTP to a folder BestPair provides, never by email. The data is stored and processed on AWS in the United States; the founder and R&D team in Australia may access it remotely from company-managed devices. It is encrypted in transit (TLS 1.2 or higher, and SFTP) and at rest (AES-256). BestPair does not sell or share it, use it outside the service or try to re-identify anyone.

At the end of the contract the data is deleted within 30 days and backups roll off within 90 days. Models trained on the data belong to BestPair and may be kept after the contract ends. What happens at contract end.