Privacy and your data
Who we are
The Money Advice Trust “The Trust” is a charity founded in 1991 to help people across the UK tackle their debts and manage their money with confidence. The Trust’s main activities are giving advice, supporting debt advisers and improving the UK’s money and debt environment.
We give advice and information to people concerned about their debts through our Business Debtline service.
The Trust is registered with the Information Commissioners Office (ICO). Our registration number is Z270290X.
The Trust is committed to good practice in the handling of personal data and careful compliance with the requirements of the Data Protection Act (2018).
The Trust is a "Data Controller". This means that we are responsible for deciding how we hold and use personal information about you. The Trust looks after the information it holds about you and respects your privacy.
This privacy notice explains how we will treat your information, what your rights are, and how we will ensure that your data is kept safe, secure and in your control.
Please contact us if you require a copy of this privacy notice in writing.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We make sure that:
- the information we hold is as accurate as possible;
- we do not hold more information than we need; and
- we do not hold it longer than we need to.
Processing your data
Our lawful basis for processing your data is consent.
Some of our funding for debt advice in England is provided by the Money and Pensions Service (MaPS). MaPS is a government body and is the largest single funder of free debt advice in England and also works alongside partners across the UK to make debt advice easier and quicker to access. MaPS also works to improve standards and quality across the sector.
Part of this arrangement involves us sharing data with MaPS to help with the important work they undertake. Their lawful basis for processing this data is it enables them to carry out their “public work” function which involves reviewing, assessing and improving the services being offered. If you would like further information or would like to object about how the Money and Pensions Service use your data, please visit https://moneyandpensionsservice.org.uk/privacy-notice/
How we use the information you have given us
The main reason we ask for your information is to understand and help you with your situation.
We only access your information for other reasons if we really need to. For example:
- for training and quality purposes;
- to investigate complaints;
- to get feedback from you about our services; and
- to help us improve our services.
All staff accessing data have had data protection training to make sure your information is handled sensitively and securely.
Contacting us with questions about how we use your data
We have a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact DPO@moneyadvicetrust.org.
How we keep your data secure
The Trust is committed to good data management in order to protect people from harm. This means we take appropriate security precautions to prevent your information being lost, used or accessed in an unauthorised way, inappropriately altered or disclosed. In addition, we limit access to your personal data to those employees and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We regularly review our information collection, storage and processing practices, including physical security measures.
What information do we collect?
We collect the following data that is provided by you.
- Personal identification information (name, email address, postal address, phone number).
- Details of your situation as described to us by you. This includes any debts you may have.
- Some data is automatically collected from your computer. You can read more about this below.
We will always explain how we use your information.
How do we collect your information?
You directly provide us with the information we collect. We collect information and process it when you do the following.
- Talk to one of our Business Debtline advisers on the phone.
- Use our Business Debtline webchat services.
- Email Business Debtline for advice.
- Provide feedback to us on the Business Debtline website.
On the phone
As part of the advice process we will ask for your consent to set up a case record. This record will be completely confidential. With your permission, we will take details of your circumstances and give you advice on your options to deal with your debt. We will give you a unique reference number which means you can call back and get more advice from us without having to repeat your details.
If you would prefer, we are also able to set up an anonymous record which means you can still call back for follow on advice by quoting the reference number and the memorable password you give us. However, this will mean that we will be unable to post any information out to you (unless you provide us with your email address) but we can signpost you to relevant and appropriate fact sheets and information on our websites.
We hold your records for six years after the last contact. After this time, your details are anonymised. You can withdraw your consent and ask to remove your details from the record at any time, either by calling us or writing to us.
Calls are recorded for training and quality purposes and are stored for three years before they are deleted.
When you use our webchat service we will not set up a client record for you. If you have an existing record, we will not update this following a webchat. Any advice we give you will be based only on the information you share with the webchat adviser and nothing else. When you start a webchat you will be told that chats are recorded and may be used by us and third parties for training and quality purposes. Chat records are stored by us for three years on an internal encrypted database before they are deleted.
You can choose to use our email service. When you email us for advice you will be asked to opt in or out to us creating a record and recording details of your email and any advice and information provided. If you opt out, a reply will be sent to you and then the record will be anonymised. If you opt in, a record will be created which means you can contact us for follow on advice at any time. Emails received and the replies are saved on our confidential database for six years. After this time, your details are anonymised. You can withdraw your consent and ask us to remove your details from the record at any time, either by calling us or writing to us.
The feedback tab
You can use the feedback tab on our website to give us feedback on our website or service.
If you are making a complaint and you give us contact details we will respond to you. We keep details of complaints for six years before they are deleted. For more details please refer to our complaints policy. If you share any personal data we will only use it to understand your feedback and take action if we need to. You will not receive any marketing.
Information we automatically collect from your computer
When you visit the Business Debtline website our web server automatically records your IP address. This IP address is not linked to any of your personal information. We use IP addresses to help us administer the site, to collect demographic information and to find out such things as how many people are visiting particular pages on our site.
Our website may also use a website recording service which may record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Data collected by this service is used to improve our website usability. The information collected is stored and is used for aggregated and statistical reporting and is not shared with anybody else.
We may also gather other non-personal information (from which we cannot identify you) such as the type of internet browser you use so that we can provide you with a more effective service.
How will we use automatically collected information from your computer?
We will use some of this information to:
- carry out marketing analysis and make general improvements to our site; and
- analyse how users are making use of the site.
We may collect anonymous data which is shared with our partner agencies, funders and the government. This enables us to demonstrate demand and use of the site.
Budget tool on our website
If you complete a budget on our website (this is different to an online account), this will produce a copy that you can use with your creditors. We will not store any of the financial or personal information you enter on the budget form. If you are completing a joint budget, then you must have obtained permission from the person you are doing the budget with.
Special category data and explicit consent
‘Special categories’ of particularly sensitive personal information require higher levels of protection under the Data Protection Act. This sort of information includes the following.
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Genetic data
- Trade Union membership (where you are recording the actual name of the union)
- Physical or Mental health or condition
- Sex life or sexual orientation
If we need to ask you for this information and record it to help us give you advice, we will ask for your explicit verbal consent (this is additional consent to keep a piece of special category data) at the time. We will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.
If you provide this information using your online account or webchat then we will assume that you have provided your consent for us to record this information. You can request to remove this information from our records at any time by calling or writing to us.
Your personal data rights
We do our best to be open and transparent about how we use your personal data and, where possible, give you choice over what data is held and how it is used.
The Data Protection Act (2018) sets out the rights you have over how organisations should treat an individual’s data. These are as follows.
- Right to be informed
- Right of access
- Right to rectification
- Rights to object to, and restrict the use of your data
- Right to erasure
- Right to data portability
- Rights in relation to automated decision making and profiling
- Rights relating to direct marketing
Right to be informed
The Trust will ensure that all individuals understand why their data is being obtained, how it is being used and how they can access it. We shall provide this information in a manner that is concise, transparent, intelligible and easily accessible. This information is provided for all ways in which you may communicate with us.
Right of access
You have the right to find out what personal data we hold about you, and to receive a copy of that data. This is commonly known as a ‘Data Subject Access Request’. Please refer to the subject access request section below if you want further information on how to access your data. We will always ensure that you can access your data quickly and easily.
Right to rectification
In order to provide advice that is comprehensive, accurate and tailored to the circumstances of each person that we help, the Trust wishes to hold accurate data about you. If you believe that your personal data is inaccurate or incomplete then we will ensure that this is rectified. If the Trust has disclosed the personal data in question to third parties it will inform them of the rectification where possible.
Rights to object to, and restrict the use of your data
You can withdraw your consent at any time if you object to or wish to restrict any processing of your data. However, this does not affect the lawfulness of any processing carried out before you notify us that you have withdrawn your consent.
We have no obligation to stop using your data if your data is required for legal proceedings or the establishment, exercise or defense of legal rights.
Right to erasure
The Trust wants you to be comfortable about the data that we hold about you. Therefore, you have a right to have your personal data deleted in the following circumstances:
- you gave us consent to process your data but have now changed your mind;
- you object to the use of your data and we have no overriding reason to keep it;
- we no longer need your data for the original reason is was collected for;
- we have collected your data unlawfully; or
- you successfully object to its processing.
The Trust can refuse to comply with your request for deletion of your data only in certain limited circumstances.
The Trust has a policy of anonymising your data six years after last contact. These records are used for statistical purposes by the Trust. Anonymised records will be held indefinitely.
Right to data portability
Should you wish for your data to be provided to you in a machine readable format (e.g. CSV file) so that another organisation can process this data, then the Trust will facilitate this where possible. Please contact the DPO@moneyadvicetrust.org for more information.
Rights in relation to automated decision making and profiling
The Trust does not used automated decision making in any of its processes.
Rights relating to direct marketing
The Trust only uses personal data for direct marketing in the following instances.
- Stakeholder contact details for email marketing to promote our commercial Training and Consultancy services.
- Contact details for advisers for email marketing to promote our (free) WiserAdviser courses.
Permission will be obtained when the contact details are provided together with details of how your details will be processed. The Trust must stop processing personal data for direct marketing purposes as soon as it receives an objection. There are no exemptions or grounds to refuse. The request must be dealt with immediately and be free of charge.
Do you share or disclose my personal data with third parties?
We do not share your data with anyone without your permission except in the following circumstances.
- When we believe it is the only way to prevent harm to you or other people such as a risk to life. If we do disclose information without your permission in these exceptional circumstances, this is authorised by a senior member of staff, and we will explain our reason to you at the earliest opportunity.
- We will disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order for us to comply with any laws, regulations or good governance obligations, or in order to enforce or protect our rights, property or safety, or that of our clients or other persons with whom we have a business relationship. These parties will include (without limitation) the Charity Commission, the Financial Conduct Authority (FCA), the police, Action Fraud, The National Crime Agency, HMRC, HM Treasury and the Department of Work and Pensions.
Transferring your information outside of Europe
We do not routinely transfer personal information we collect outside of the European Economic Area (EEA). However, in the event that we needed to, we would ensure that your personal information was adequately protected. We will put in place protective measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respect the UK and EU laws on data protection.
How secure is my information with third-party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. A data sharing agreement that sets out how we expect third parties to handle any data we share with them is required to be in place before we share any data. Ongoing checks are carried out on these arrangements at regular intervals.
Appropriate specific protective measures include for example, model clauses in data sharing contracts and ongoing security assessments. If you require further information about these measures you can request it from DPO@moneyadvicetrust.org.
Subject access requests
Business Debtline is fully committed to respecting your right to access personal information that is held about you in accordance with the Data Protection Act (DPA).
A subject access request (SAR) is a request you can make to find out what personal information (data) we hold about you.
You are entitled to a copy of all information held about you and to be:
- told whether any personal data is being processed;
- given a description of the personal data, the reasons it is being processed and whether it will be given to any other organisations or people;
- given a copy of your personal data; and
- given details of the source of the data (where this is available).
You are only entitled to your own personal data, and not to information relating to other people unless you are acting on behalf of that person. In these circumstances, that person’s written consent will be required.
How to make a subject access request
You can make a subject access request by calling us or by email to:
You can complete the subject access request form to ensure we identify all of the relevant information and documentation.
In order to make a valid subject access request the following information must be provided.
- Personal details: your name, address, date of birth and any previous addresses detailed on the record.
- Proof of identity: two forms of identification will be required. One of these must be something like a driving licence, passport or birth certificate (see request form for a full list), and the other, a form of address verification dated in the last 3 months (see the request form for acceptable forms of ID).
- Representative details: only applicable if you are applying for a subject access request on behalf of someone else.
Business Debtline will comply with requests for access to personal information as quickly as possible but will ensure that the information is provided within one month, as required by the Data Protection Act.
Is there a fee?
There is no fee for a subject access request. However, we can charge a ‘reasonable’ fee when a request is excessive or particularly repetitive.
What happens if some of the information we hold is incorrect?
You are entitled to have your personal data rectified if it is inaccurate or incomplete. We will respond to any requests for rectification within one month. This can be extended to two months where the request for rectification is complex. If we decide not to take any action to rectify the data we will explain why and inform you of your right to complain to the Information Commissioner’s Office (ICO).
You also have a right to request deletion or removal of your personal data where there is no compelling reason for its continued processing.
- Where the personal data is no longer accurate or when you withdraw your consent.
- When you object to the processing and there is no overriding legitimate interest for continuing to process it.
- The personal data was unlawfully processed.
- The data has to be erased in order to comply with a legal obligation.
What if I want to complain?
If you are unhappy with the way the subject access request has been handled or how your personal data has been handled, you can make a formal complaint. Please refer to our Complaints Policy.
If you are still dissatisfied with the outcome of your complaint after following our process then you can lodge a complaint with the Information Commissioners Office who will investigate the matter.
For more information on data protection and subject access requests, please visit www.ico.org.uk.
How to contact us
The Data Protection Officer for the Trust is the Head of Compliance and Risk. You can contact them by emailing DPO@moneyadvicetrust.org.