Privacy Notice

Debt Advice Foundation is committed to protecting your personal information. This privacy notice sets out how we obtain, record and use your personal information, in accordance with the General Data Protection Regulation (GDPR).  This notice also describes your rights regarding the information we hold about you.

Who we are

Debt Advice Foundation Registered office address – 1 Anchor Court, Commercial Road, Darwen BB3 0DB Registered charity in England and Wales (no. 1148498) Company limited by guarantee (no. 08039416) Authorised and regulated by the Financial Conduct Authority (no. 692492).

Also trading as; Debt Aware (the charity’s financial education arm – www.debtaware.org). Registered office as above.

Why do we have a Privacy Notice?

Debt Advice Foundation is a “Data Controller”.  This means we are responsible for collecting, storing and using your personal information in accordance with the General Data Protection Regulation (GDPR). This notice applies to all clients and prospective clients and does not form part of any contract with you. Debt Advice Foundation may change this Privacy Notice from time to time.

Data protection principles

GDPR sets out sets out seven key principles:

• Lawfulness, fairness and transparency; which means we must have a valid lawful basis in order to process your personal data
• Purpose limitation; which means any data we collect must be for a specified, explicit and legitimate purpose
• Data minimisation; which means the data we collect must be relevant and limited to what is necessary for the collection purpose
• Accuracy; which means we must take all reasonable steps to make sure the information we hold about you is accurate and up to date
• Storage limitation; which means data should be kept in a form which permits identification of data subjects for no longer than is necessary for the collection purpose
• Integrity and confidentiality (security); which means data should be processed in a manner that ensures appropriate security of the personal data
• Accountability; which means that the data controller must take responsibility for complying with the principle

The information we hold about you

Personal data refers to any information that can identify an individual.  It does not include data from an anonymous individual. The provision of debt advice is a regulated activity.  Debt Advice Foundation may require certain information in order to lawfully assist you with your enquiry.  This includes the following types of data:

• Personal and contact information
• Financial information such as income, expenditure, debts and assets
• Socio-demographic information such as your nationality and profession
• Consent to pass your details to a third party to assist you with your chosen debt solution

We may also collect and process other types of data including:

• Communications information such as date, time or method you wish to be contacted by us
• Technical information which we collect through cookies on our website (please see our Cookie Policy for more information)
• Marketing preferences

There is also a special category of data, which is more sensitive and requires more protection.  Where we ask for special data, we will ask you for your explicit consent to obtain and record the data.  Information we may ask you for which requires additional consent includes:

• Information about your health and wellbeing

How do we collect your personal information?

• When you call our telephone advice helpline
• When you request a call back from us
• When you use our website
• When you provide us with feedback about our service
• When you ask us to send you information

Who is responsible for my data?

Debt Advice Foundation is a “Data Controller”. This means that the charity is responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

At times Debt Advice Foundation acts as a “Data Processor”. The charity processes personal information about you on another Data Controller’s behalf and instruction. We will only do so where the Data Controller has explicit consent to share your information with us for a specified purpose(s).

How we will use your information

We will only use your personal information for lawful purposes.  This means that the data we collect about you must be processed on one of the following lawful bases:

• Where the data is required to perform a contract we have entered into with you.
• Where we need to comply with a legal obligation, such as a court order or to maintain regulatory compliance.
• Where the information is necessary for our legitimate interests.  This lawful purpose relates to the processing of your data in a way that you would reasonably expect us to, for example, the provision of debt advice.
• Where you have given your explicit consent for us to process your information in a particular way, such as opting to receive specific direct marketing communications from us.
• Where we need to protect your vital interests
• Where it is needed in the public interest

Sharing of your data

We may share your data with third parties. Any third party we share data with must take appropriate security measures to protect your personal information and must only process your data the express purpose we have agreed.

Which third parties do you share data with?

• Solution providers that you have consented to speak with
• For auditing and regulatory purposes (from time to time, we may be required to share data with official bodies such as the Charity Commission, the Financial Conduct Authority and the Information Commissioner’s Office)
• For quality management purposes
• To compile statistics and undertake research

Transferring information outside the EEA

We do not routinely transfer personal information outside of the European Economic Area (EEA).  If circumstances required us to do so (to contact you whilst located outside of the EEA for example), we will consider all appropriate security measures to ensure you data remains protected.

How long do we keep your data for?

We will hold your information for as long as is necessary to satisfy the purpose(s) it was collected it for.  This length of time will also take into account any relevant legal, contractual or reporting requirements. Details of our retention periods are available in our retention policy which is available from [email protected]. In accordance with the charity’s data retention policy, our data is anonymised so that we can continue to undertake important research and monitor trends.

Protecting your data

We have in place appropriate measures to protect your information, which includes both network integrity and data transmission security. Where we can reasonably be expected to disclose specific security arrangements, details are available upon request from [email protected]. We have a procedure to deal with suspected security breaches and will notify both you and the appropriate regulatory body where we are legally required to do so.

Your rights

You have the following rights relating to the information we hold about you:

• Data portability – you have the right to request a copy of the data we hold about you in a machine readable format so that you are able to transfer it to another party.  If you want to request a copy of the information we hold about you, please contact [email protected] detailing your request.  We will aim to provide this information to you within 28 days of receiving your request.
• Request erasure – you have the right to request that we delete your personal information where there is no legal reason for us continuing to process it.  In accordance with the charity’s data retention policy, our data is anonymised so that we can continue to undertake important research and monitor trends.  If you want to request that we erase the information we hold about you, please contact [email protected] detailing your request.
• Object to processing – you have the right to of object to Debt Advice Foundation processing your personal information where there is no legal basis for continuing to do so.  This includes the processing of any information for direct marketing purposes.  If you want to request that we discontinue processing your information, please contact [email protected] detailing your request.
• Request rectification – you have the right to make sure all information we hold about you is accurate and up to date.  If you want to provide us with updated information, please contact [email protected] detailing your request.
• Request access – you have the right to access the information we hold about you.  If you want us to provide you with a copy of the information we hold about you, please contact [email protected] detailing your request.
• Restrict processing – you have the right to suspend the processing of your information.  This is could be used in situations where further investigation into a data request is required such as establishing the accuracy of your data or an objection to processing request has been made.
• Withdraw consent – you have the right to withdraw consent for us process your data, where you have given explicit consent, at any time.  Once we have received your withdrawal notice, we will discontinue processing of your data unless we have a lawful basis to continue doing so.  If you want to withdraw consent for processing your information, please contact [email protected] detailing your request or click unsubscribe on any direct marketing email we have sent you if your consent related to receiving direct marketing email communications from us.

We will not charge any fees relating to your rights prescribed in this notice.

Data Protection Officer

In accordance with Information Commissioners Office guidance, Debt Advice Foundation is not required to appoint a Data Protection Officer (DPO) to monitor data protection compliance.  This does not affect the information contained within this notice nor your rights regarding your data. Any queries relating to Debt Advice Foundation’s Privacy Notice can be sent to [email protected]. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). The ICO can be contacted on 0303 123 1113.