Privacy and data protection – summary of our approach and FAQs

A privacy notice explains how we process your personal information when you contact us or bring a complaint to our service. It’s quite detailed so we’ve also put together this summary page, that includes a short video, to help outline what our full privacy notice covers.

Personal data means information that is about an individual or that can identify them in some way. We refer to this information as personal data.

The amount and type of personal data we process varies depending on the individual circumstances of the complaint and why we are processing the personal information, it could include:

• Name and contact details
• Date of birth
• Complaint details
• Financial details
• Family matters

Some personal data requires higher levels of protection – data protection law refers to this as ‘special category data’. This could include information about your health conditions, ethnic origin, disabilities, or accessibility needs. We may also process sensitive information about criminal convictions.

We use your personal information to investigate and resolve individual complaints and help prevent unfairness. We also analyse complaints data to make our services and processes more effective for you and others. More detail is set out in the ‘Why we process your personal information’ section of our privacy notice.

We process the personal information of our customers on a ‘public task’ basis. This basis is mostly used by public authorities and other organisations that carry out tasks in the public interest, and simply means we’re processing data in order to carry out our official functions. 

We think that public task is an appropriate fit for most of our processing of consumer data – given that this processing is primarily for the purposes of carrying out our statutory function of resolving complaints quickly and with minimum formality.

While public task is the main basis for most of our processing of complainant data – for certain purposes, we may rely on a different lawful basis. We have to consider the best fit for each purpose of our processing. Whilst it is likely to public task in most cases – sometimes we may rely on a different basis such as the legitimate interests or legal obligation bases. Details about this are set out in our privacy notice.

As a small business it is likely the amount of personal data we process about you is much smaller as a lot of the information is about the business itself. Types of personal data we typically process are name, personal contact details, reasonable adjustments for the person who is bringing the complaint on behalf of the business or details about the personal life of an employee if the complaint refers or relates to the impact the event may have had on an individual personally.

Yes, all calls to our case handlers are recorded. If you are yet to send a complaint to us, and don't want your calls recorded, you can let us know on your complaint form - but we won’t be able to speak to you over the phone about your complaint. We will contact you by post or by email instead.

If you have previously told us that you don’t want your calls to be recorded we respect that choice and will not speak to you over the phone. This is recorded in your customer record and we will use an alternate means of contacting you.

We still need to confirm that you want us to investigate a complaint you have submitted and it’s important that we have a declaration from you that confirms that what you have submitted to us is accurate and true.

In order to investigate a complaint, we need to share information with both parties to the complaint to get both sides of the story. We also have an inquisitorial remit, which means looking at the whole picture, not just what the consumer or financial business has said.

Regardless of the lawful basis we rely upon we adhere to the data protection principles when sharing and processing personal data. We share personal data when it is reasonable and relevant for us to do so and where it relates to our processing. The privacy notice on our website sets out the categories of when and why we might need to share personal data with a financial business or third party.

So that we remain independent and impartial we can’t allow any party to a complaint to dictate what information we can or cannot consider or share as part of an investigation. It’s for our investigators and ombudsmen to decide what information they feel is material and relevant to the complaint and what information they rely upon to reach a decision. If you are concerned about sharing a piece of information given its sensitive nature, then please do speak to your case handler, they'll be able to explain why we might need the information and how we'll keep it safe.

Publication of our decisions has never required the consent of people who complain to us ('complainants'). Publication of our decisions is something we have a legal obligation to do, so it wouldn’t be appropriate to obtain consent for that. 

We send out surveys to customers to ask them about the service they received. It is your choice whether or not you want to take part in the survey when we contact you. If you want to, you can opt out of receiving surveys. If you’ve already received a survey, then you can click on the unsubscribe link in the email telling you about a survey and this will unsubscribe you automatically. 

If you haven’t yet received a survey and don't want to, then you can if you have a specific person you’ve been liaising then please get in touch with them in the first instance and they’ll be able to update our systems. If you have haven’t yet been assigned an investigator, then you can read more about how to contact us.

We understand that data security is important to us all and we are committed to doing all that we can to keep your data secure.

We take steps to ensure that personal information is stored securely, both physically and electronically, in accordance with the internal policies that we have in place for the effective and secure processing of your personal information. For example, we protect your data using varying levels of encryption. We also make sure that any third parties that we deal with keep all personal data they process on our behalf secure.

We make every effort to keep your personal information accurate and up to date, but in some cases we are reliant on you as the data subject to notify us of any necessary changes to your personal data. If you tell us of any changes in your circumstances, we can update the records with personal data you choose to share with us.

Yes, you can make a subject access request. Details about your data subject rights and how you can exercise your rights are set out in detail in our privacy notice.

You can also request a copy of the information we’ve relied upon to reach our decision on your complaint by contacting the individual handling your complaint. More information is set out in our Data Protection and SARs page.

Our privacy notice provides you with greater transparency about how your data is shared and processed. In practice, our main reasoning for processing your personal data will be to communicate with you about the complaint you are representing.