How long can a company hold your card details for?

Clarkeys

Hi
We are a new business and since opening have been receiving countless calls from marketing agencies and the like offering their services. Some weeks ago, I agreed over the phone for an ad to be placed in a circular magazine/brochure type, and gave my card details. They then sent an email for confirmation which I approved.
A couple of days later the agency called and said that the payment hadn't been taken, due to their card machine not working and being due for replacement, and as (these were the caller's words) "they cannot keep card details for more than 7 days", could I either contact them again a few days later with the card details, or send them a cheque.
In the meantime, I had second thoughts over the advert, and decided I didn't want to pay out for something that in all likelihood would not generate the trade, and decided not to call back or send any subsequent payment, but (possibly foolishly) didn't contact the agency about my decision, since I was under the impression that no money could be taken.
Over 3 weeks later, I have just received confirmation that payment has since been taken from my account in the last few days, using the card details already given. Details I was advised they couldn't retain.
Can they do this? The transaction was 5 days ago, with the initial conversation about a month ago.

Many thanks for any advice, or being directed to the right place.

fluffnutter

It would come under the general rules about data in the Data Protection Act. The principle that would apply here (I believe) is regarding having to have a purpose to retain your data. The company would argue that this was still an uncompleted transaction, that you hadn't expressly told them you didn't want the service and hence it was legal to retain your details.

The seven day thing is a nonsense; there are time limits in the DPA but they're years, not days.

However, the company itself might have terms and conditions stating 'we won't hold your details for more than seven days' and if you've deemed to have entered into a contract with them by agreeing to their service, they could be in breach of contract by taking your payment after this period. This is a long shot and I doubt they have this, or that you have a copy of their T&Cs.

I don't think you have much redress, legally speaking. I assume they've actually run the ad? If not, then you do have grounds for complaint, i.e. non-delivery of service.

paddyrg

Clarkeys wrote: »

Hi
We are a new business and since opening have been receiving countless calls from marketing agencies and the like offering their services. Some weeks ago, I agreed over the phone for an ad to be placed in a circular magazine/brochure type, and gave my card details. They then sent an email for confirmation which I approved.
A couple of days later the agency called and said that the payment hadn't been taken, due to their card machine not working and being due for replacement, and as (these were the caller's words) "they cannot keep card details for more than 7 days", could I either contact them again a few days later with the card details, or send them a cheque.
In the meantime, I had second thoughts over the advert, and decided I didn't want to pay out for something that in all likelihood would not generate the trade, and decided not to call back or send any subsequent payment, but (possibly foolishly) didn't contact the agency about my decision, since I was under the impression that no money could be taken.
Over 3 weeks later, I have just received confirmation that payment has since been taken from my account in the last few days, using the card details already given. Details I was advised they couldn't retain.
Can they do this? The transaction was 5 days ago, with the initial conversation about a month ago.

Many thanks for any advice, or being directed to the right place.

Was it a JPC title?

Clarkeys

Thanks for the reply fluffnutter, I suspect I may be stuffed on this (their online T&C only refer to 7 days with regards to cancellation times, and getting a 10% discount for payment.

I may try and contact them, though I suspect that the call in question won't have been recorded for whatever reason.

paddyrg wrote: »

Was it a JPC title?

Imperialmedia are the agency.

bap98189

In all likelihood they shouldn't be storing your card details at all. Forget about the DPA, ask them if they are PCIDSS compliant. If they say yes, ask what control measures are in place to securely store credit card data. If the card details are stored on paper, at a bare minimum they should be in a secure, locked container at all times.