1. Who we are
1.1. This privacy notice (the “Privacy Notice”) applies to all personal information processing activities carried out by The Money Advice Service (MAS). The Money Advice Service was set up as an independent body with responsibility for improving people’s money management in April 2010.
1.2. We were initially known as the Consumer Financial Education Body, the name used in the Financial Services Act 2010 which sets out our statutory objectives. These are to:
- enhance the understanding and knowledge of members of the public of financial matters (including the UK financial system); and
- enhance the ability of members of the public to manage their own financial affairs.
Our statutory functions include, but are not limited to:
- promoting awareness of the benefits of financial planning;
- promoting awareness of the financial advantages and disadvantages in relation to the supply of particular kinds of goods or services;
- promoting awareness of the benefits and risks associated with different kinds of financial dealing, which includes informing the Financial Conduct Authority and other bodies of those benefits and risks;
- publishing educational materials or the carrying out of other educational activities; and
- providing information and advice to members of the public.
In April 2012 we took on additional responsibility for funding and improving the quality, consistency and availability of debt advice. Our statutory functions in relation to debt advice, as set out in the Financial Services Act 2012, are to:
- assist members of the public with the management of debt;
- work with other organisations which provide debt services, with a view to improving:
the availability to the public of those services;
- the quality of the services provided; and
- consistency in the services available, in the way in which they are provided and, in the advice given.
1.3. In order to carry out this function, we collect, process and store personal and sensitive data on an ongoing basis. Our lawful basis for processing personal data is, to carry out our public task set out above. Exceptions to this will be on the lawful basis of consent from our customers. We have a responsibility to protect this information and ensure its confidentiality, integrity and availability.
1.4. This privacy statement describes why and how we collect and use personal data. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.
1.5. MAS is a data controller in respect of personal information that we process in connection with our business. In this notice, references to “we”, “us” or “our” are references to MAS.
1.6. Our principal address is Holborn Centre, 120 Holborn, London EC1N 2TD and our contact details can be located at moneyadviceservice.org.uk ‘Contact us’. More information about MAS can be found at moneyadviceservice.org.uk ‘About Us’.
1.7. We respect individuals’ rights to privacy and to the protection of personal information. The purpose of this Privacy Notice is to explain how we collect and use personal information in connection with our business. “Personal information” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information).
1.8. We may update our Privacy Notice from time to time. When we do we will communicate any changes to you and publish the updated Privacy Notice on our website. We would encourage you to visit our website regularly to stay informed of the purposes for which we process your information and your rights to control how we process it.
2. How we obtain and process information
2.1. Personal data - means any information relating to an identifiable living person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
2.2. Your information is made up of all the personal information we hold about you. It includes:
- information you give us – you may give us information by filling in the tools on our site or by corresponding with us by phone, email or otherwise. The information you give us may include your name, address, email address and phone number;
- information collected by organisations we fund which provide debt services and assist members of the public with the management of debt;
- information that we learn about you through our relationship with you;
- information we gather from the technology which you use to access our services, for example
- location data from your mobile phone, an Internet Protocol (IP) Address used to connect your device to the internet, your login information, browser type and version, operating system and platform; and
- Full Uniform Resource Locators (URL) clickstream to, through and from our site, items viewed or searched for on our site, page response times, length of visit or page interaction information.
2.3. “Sensitive” and “Special Categories” of personal information.
2.3.1. In this Notice we also talk about “Sensitive” and “Special Categories” of personal information. This means personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying someone, information concerning health or information concerning a someone’s sex life or sexual orientation.
2.3.2. Under data protection law, these types of information are treated differently because they are so sensitive. Under UK law, it is also expected that information relating to criminal convictions and offences or related security measures will also be treated as if it is sensitive/special category information.
2.3.3. We may collect information about your ethnicity in order to provide quantitative and qualitative insight on our service for our own use– in this case, we anonymise the data so that personal data is not shared and you cannot be identified.
3. Your rights
3.1. We want to make sure you are aware of your rights in relation to the personal information we process about you. We have described those rights and the circumstances in which they apply below. If you wish to exercise any of these rights, if you have any queries about how we use your personal information that are not answered here, or if you wish to complain to our Data Protection Officer, please contact us at 020 7943 0500.
3.2. Access – You have a right to get access to the personal information we hold about you. If you would like a copy of the personal information we hold about you, please write to: Data Protection Officer, The Money Advice Service, Holborn Centre, 120 Holborn, London, EC1N 2TD. Or contact us at 020 7943 0500.
For more information on how to get access to your information and the documents we need you to submit or to make a formal Subject Access Request (SAR) please complete the SAR Form available on the Contact Us page of our website, or alternatively please download and complete a copy of the SAR Form which can be submitted via email SAR@moneyadviceservice.org.uk or post.
3.3. Rectification – You have a right to rectification of inaccurate personal information and to update incomplete personal information. If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.
3.4. Erasure – You have a right to request that we delete your personal information. You may request that we delete your personal information if you believe that:
- we no longer need to process your information for the purposes for which it was provided;
- we have requested your permission to process your personal information and you wish to withdraw your consent; or
- we are not using your information in a lawful manner.
3.5. Restriction – You have a right to request us to restrict the processing of your personal information. You may request us to restrict processing your personal information if you believe that:
- any of the information that we hold about you is inaccurate;
- we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims; or
- we are not using your information in a lawful manner.
3.6. Objection – You have a right to object to the processing of your personal information. You have a right to object to us processing your personal information (and to request us to restrict processing) for the purposes described in Schedule A – Purposes of Processing (below), unless we can demonstrate compelling and legitimate grounds for the processing, which may override your own interests or where we need to process your information to investigate and protect us or others from legal claims. Depending on the circumstances, we may need to restrict or cease processing your personal information altogether, or, where requested, delete your information.
3.7. Withdraw consent – You have a right to withdraw your consent. Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.
3.8. Lodge complaints – You have a right to lodge a complaint with the regulator. If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO). For more information, visit ico.org.ukopens in new window.
4. Changes to way we use your information
4.1. From time to time we may change the way we use your information. Where we believe you may not reasonably expect such a change we will notify you and will allow a period of at least 30 days for you to raise any objections before the change is made.
5. How we use and share your information
5.1. We will only use and share your information where it is necessary for us to lawfully carry out our business activities. We want to ensure that you fully understand how your information may be used. We have described the purposes for which your information may be used in detail in Schedule A – Purposes of Processing.
6. Sharing with third parties
6.1. We will not share your information with anyone outside MAS except:
6.2. where we have your permission;
6.3. where required for your engagement with and involvement in the FinCap or What Works programme;
6.4. where we are required by law and to law enforcement agencies or government entities;
6.5. where required for a reorganisation, transfer or other transaction relating to our business;
6.6. in anonymised form as part of statistics or other aggregated data shared with third parties; or
6.7. where permitted by law, it is necessary to fulfil our statutory objectives or those of a third party, and it is not inconsistent with the purposes listed above.
6.8. We will only share your information with third parties on a limited basis following due diligence and in accordance with our internal procedures.
6.9. MAS will not share your information with third parties for their own marketing purposes.
7. Communications with you
7.1. We will contact you with information relevant to the Money Advice Service or Financial Capability programme (including updated information about how we process your personal information), by a variety of means including via email, post and/or telephone. If at any point in the future you change your contact details you should tell us promptly about those changes.
7.2. If you change your mind about how you would like us to contact you or you no longer wish to receive this information, you can tell us at any time by contacting us at firstname.lastname@example.org
7.3. We may monitor or record calls, emails, text messages or other communications in accordance with applicable laws for the purposes outlined in Schedule A – Purposes of Processing.
8. How long we keep your information
8.1. When contacting the Money Advice Telephone Service we create records that contain your information. Records can be held on a variety of media (physical or electronic) and formats.
8.2. We manage our records to help us to serve our customers well (for example for operational reasons, such as dealing with any queries relating to Money Advice) and to comply with legal and statutory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.
8.3. Retention periods for records are determined based on the type of record and the nature of the activity. We normally keep customer account records for up to two years after your relationship with the Money Advice Service ends, whilst other records are retained for shorter periods, for example 90 days for CCTV records or 12 months for call recordings. Retention periods may be changed from time to time based on business or legal and regulatory requirements.
8.4. We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies. This is intended to make sure that the organisation will be able to produce records as evidence, if they’re needed.
8.5. If you would like more information about how long we keep your information, please contact us at 020 7943 0500.
9.1. We are committed to maintaining and enhancing the privacy and confidentiality of your personal data. We take various steps to protect the information you provide from loss, misuse, and unauthorised access or disclosure by; ensuring only authorised persons can access your data and running website scanning and penetration test activities. These steps take into account the sensitivity of the information we collect, process and store, and the current state of technology.
9.2. Your data is stored inside the EEA and will not be transferred outside the EEA.
9.3. If a security breach causes an unauthorised intrusion into our system that materially affects you or the privacy of your data we will notify you as soon as possible. We will also notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach.
9.4. We are committed to ensuring that your information is secure with us and with the third parties who act on our behalf. For more information about the steps we are taking to protect your information please contact us at 020 7943 0500.
10. Schedule A – Purposes of Processing
10.1. 10.1. We will only use and share your information where it is necessary for us to carry out our lawful business activities. Your information may be shared with and processed by members of the Single Finance Guidance Body (SFGB). We want to ensure that you fully understand how your information may be used. We have described the purposes for which your information may be used in detail below..
10.2. We may process your information where it is our statutory obligation to do so (public task) and without prejudicing your interests or fundamental rights and freedoms.
10.3. This may include processing your information to:
- develop, test, monitor and review the performance of services, internal systems and security arrangements offered by MAS;
- assess the quality of our service to customers and to provide staff training;
- comply with legal and statutory obligations.
- provide you with information on the Financial Capability or What Works programme in general (e.g. newsletters);
- issue surveys to assist with stakeholder feedback for Financial Capability evaluation and programme improvements;
- let you know about opportunities to take part in PR activities such as FinCap Week; Talk Money Week or What Works Funding.