Privacy policy.

Privacy notice.

Ombudsman Services takes your privacy seriously. This privacy notice tells you what to expect when Ombudsman Services collects personal information from you. It also explains how we will store and handle that data, and keep it safe.

We know that there is a lot of information, but we want you to be fully informed about your rights, and be aware of how Ombudsman Services uses your data.

Our privacy notice applies to information we collect about:

  • Visitors to our website.
  • Complainants, third parties, and other individuals in relation to the complaints Ombudsman Services has been asked to investigate.
  • People who call us with telephone enquiries.
  • Job applicants, current and former employees.

We will only use the personal information you provide to administer your complaint and to provide the services you have requested from us. The information you provide will also help us direct your enquiries.

The types of data that we collect are only those details necessary for the consideration of your complaint about a Participating Company.

To ensure that the information we hold is accurate and up-to-date, please ensure that we are promptly informed of any relevant change to your contact details.

We sometimes supply your personal data to a third party for example, the named Participating Company to which your complaint relates, one of our regulators such as Ofcom or Ofgem, or where the transfer is to a secure data processor who carries out data processing operations on our behalf.

Ombudsman Services is registered on the "public register of data controllers" which can be seen online on the Information Commissioner Officer’s website.

Ombudsman Services has the registered address of 3300 Daresbury Park, Daresbury, WA4 4HS.

The Data Protection Officer as assigned by Ombudsman Services is also based at 3300 Daresbury Park, Daresbury, WA4 4HS.

We hope the following sections will answer any questions you have but if not, please do get in touch with us.

Data protection law.

All your personal Information will be held and used in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Data Protection Act 2018, any legislation that replaces it in whole or in part and any other legislation relating to the protection of personal data.

These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.

How we collect and process information from you.

Checking your identity.

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

Website.

All your personal Information will be held and used in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Data Protection Act 2018, any legislation that replaces it in whole or in part and any other legislation relating to the protection of personal data.

These rules apply regardless of whether data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.

When someone visits ombudsman-services.org, we automatically collect and store the following information about your visit:

  • the Internet domain (for example, 'domain.com' or 'isp.com' if you use a private Internet access account) and IP address (an IP address is a number, ‘xxx.xxx.xxx.xxx', that is automatically assigned to your computer whenever you are surfing the web) from which you access our website.
  • The type of browser software and operating system used to access our site.
  • The date and time you access our site.
  • The pages you enter, visit and exit our site from.
  • If you linked to the server's domain from another website, the address of that website.

We use this information to help us identify click stream patterns, to improve our website, to learn about the number of visitors to our website and the types of technology our visitors use. This is statistical data about browsing actions and patterns and does not identify you as an individual.

We also use a third party services, Google Analytics and Hotjar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.

We may collect information about your computer, including where available your IP address, operating system and browser type, this is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users' browsing actions and patterns and does not identify any individual.

Please note: We are not responsible for any use of your personal information you provide to third-party websites that may be accessed via our website or websites. We recommend that you review the privacy policy of any third-party applications or websites that you use.

Cookies.

A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet. Each website can send its own cookie to your web browser if your browser's preferences allow it. Many websites do this whenever a user visits their website in order to track online traffic flows.

For further information about what a cookie is and how Ombudsman Services uses them, please see the ‘cookie settings’ page of this website.

Reasons and purposes for processing information.

When you ask us to consider a complaint about one of its Participating Companies, Ombudsman Services will only request you provide the personal information that is needed to process your complaint details. We require your data to pursue our legitimate interests in a way that might reasonably be expected as part of for the complaint investigation work Ombudsman Services undertakes.

When you ask us to review a complaint about a Participating Company, you will need to provide us with personal details, including your name, address, email address, contact number and any relevant account numbers. Ombudsman Services will also request you provide authority for us to approach the Participating Company to obtain the details of your account.

It is necessary to share your personal information with the company that is the subject of your complaint. This company will be asked to provide us with its response to your complaint, this will include any data from any accounts and/or complaint files that the company has opened about you or the complaint.

Ombudsman Services may also ask you to provide further information that would be relevant to your complaint, for example, the relevant contract, timeline of events, or relevant bank statements.

Ombudsman Services only uses the information you provide to:

  • Respond to your enquiry or enquiries.
  • Investigate your complaint or complaints.
  • Comply with regulator reporting requirements.
  • Help us to improve the quality of our services including IT improvements.

Should you wish to withdraw your complaint, you should by contact us by emailing DPO@Ombudsman-Services.org

In some specific circumstances, you have the right to request that we stop processing your personal data. For example; when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.

Please note that if your complaint is active when you ask to withdraw your complaint or object to the processing of your personal data, Ombudsman Services will not be able to continue to process your complaint.

Monitoring and recording of telephone calls.

Ombudsman Services use a third party called Puzzel, a cloud based contact centre, to provide our call management services. We record and monitor incoming and outgoing telephone calls. Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint. Recordings may also be used for staff training exercises, to improve the quality of our services.

The telephone calls that we record will be kept secure and subsequently deleted in a structured and organised manner. Recorded calls are kept for a period of 12 months. If a call recording provides useful information or evidence that supports your complaint we may keep this as part of your case for a period of six years.

Ombudsman Services also collects Calling Line Identification (“CLI”, also known as “caller ID”) when you contact us by telephone. This means that we will be provided with, and will record, the telephone number that you have used to contact us unless you have taken steps to withhold the number.

Monitoring and recording of emails.

Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law. Ombudsman Services uses MailChimp for processing some reminder emails. MailChimp’s privacy policy can be found on the Mailchimp website. We will not share your data with this third party where it is not necessary to do so.

Monitoring and recording of contacts via social media.

You are able to contact us via Twitter or Facebook. Please note that we have no influence on the scope of data that is collected by these social networks through their sites. The data use policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.

We may retain some information provided via social networks if it is relevant to your complaint.

Your rights over your personal data.

Your rights include:

The right to be informed. Ombudsman Services aims to be transparent within our privacy policy over how we use your personal data. The privacy policy will also confirm how long Ombudsman Services will retain your data for.

Right of access.

You have the right to request a copy of any information that Ombudsman Services holds about you. For those requesting a ‘subject access request’, it will be provided free of charge in most cases and within one month. Please see the section ‘Right of access to personal information’, for further information.

The right to rectification.

You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete. Some corrections can be completed via your access to the portal. You can also contact us by emailing YourRights@Ombudsman-Services.org and we can amend inaccurate personal data, however please note that in some circumstances we may ask for the documentary proof that the amendment is necessary. Any changes to personal data will have to be communicated to each recipient to whom the personal data has been disclosed (likely to be the Participating Company of your complaint), unless it is impossible or disproportionate.

The right to erasure.

You can request the erasure of your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by Ombudsman Services is required by law to be held for a period of time. You can contact Ombudsman Services by emailing YourRights@Ombudsman-Services.org if you wish to make a request.

The right to restrict data.

You can request that we restrict the processing of your personal data. This can be done in circumstances where we need to verify the accuracy of personal data, if you do not wish to have personal data erased or you object to the processing and we are considering this request.

The right to data portability.

You can request a copy of the personal data you provided to us in a machine readable format or you have the right to ask that this data be transferred another third party.

The right to object.

You can stop the processing of your personal data for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. Where your details are used for marketing you can opt out at any time. You are able to adjust these settings within the portal, or you can contact Ombudsman Services via YourRights@Ombudsman-Services.org

Automated decision making and profiling.

You can request that a member of the Ombudsman team review any decision made solely on automated processing of your data. (i.e. where the decision has been made by a solely automated process). You will be notified if Ombudsman Services makes a solely automated decision which produces a legal effect or significantly affects you.

Right of access to personal information.

Ombudsman Services tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a subject access request.

You have a right to obtain confirmation that your personal data is being processed by Ombudsman Services, and have access to your personal data.

Should you wish to obtain a copy of the personal data that we hold on you, please send an email to YourRights@Ombudsman-Services.org

It will assist us to process your request efficiently if you include:

  • Any Ombudsman Services reference numbers contained in correspondence we have sent to you.
  • The names of any Ombudsman Services staff who you have been in contact with.
  • A summary of the information you would like us to provide.
  • Verification of identity.

There will be no fee for the first copy of information provided in response to a subject access request, and we will usually send a copy of all the personal data that we hold concerning you within 30 days.

Please note that a subject access request does not entitle you to be provided with specific documents or an entire file, but rather, it entitles you to be provided with your personal data in a clear and permanent form.

Ombudsman Services will provide the requested information via email unless you request another means. Ombudsman Services may extend the timescale by a further two months if your request is particularly complex.

How and why we manage your data.

The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.

In specific situations, we can collect and process your data with your consent, for example, when you tick a box to receive email newsletters or complete a survey.

When collecting your personal data, we will always make clear to you which data is necessary in connection with the particular activity.

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.

Contractual obligations.

In certain circumstances, we need your personal data to comply with our contractual obligations.

If the law requires us to, we may need to collect and process your data. We also have regulatory requirements, which means we may pass details of complaints to Ofgem and Ofcom.

Legitimate interest.

In order to consider your complaint we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

Retention of information.

We will only retain your Information for as long as is necessary for the purpose or purposes for which we have collected it. If you send Ombudsman Services paper documents, disks or USB’s containing information about your complaint, we will uploaded these securely to a digital format. The originals will then be destroyed within one month of receipt, unless you explicitly request that they be returned.

We will exercise discretion when necessary in destroying original documents, and may keep them longer if they are not readable in a digital format.

In all cases, we will retain your complaint file for a period of up to six years after the case has been closed. The retention period is set at six years for the following reasons:

  • To ensure we have dealt with all aspects of your enquiry or complaint.
  • To assist us should you or the Participating Company contact us again about the matter in the future.

You have a right to contact Ombudsman Services at any time during this period to correct or amend any information you have provided to us.

We may record and/or retain anonymised information about your complaint in order to document and/or measure our own performance or the performance of our Participating Companies. We may also pass anonymised information about your complaint to regulatory bodies who oversee us or our Participating Companies. Any such reports will contain no personal data about you or any information from which you or your third parties could be identified.

All personal information that we hold will be deleted at the end of a six year period, or earlier if requested, in a structured and organised manner.

If someone opens a case to tell us about a complaint but we do not investigate it, we will keep the information for three years after the case has been closed.

If someone contacts us as part of an initial enquiry and does not open a case, we will keep the information for a period of six months.

Other information and rentention periods.

Website information:

This includes internal domain, IP address, brower software, date and time accessed site and further website info

  • Retained for 6 months.

Telephone recordings

  • Retained for 12 months.

Social media contacts

  • Retained for 6 months (unless forms part of the complaint details).

Paper documents, disks or USB’s

  • Originals kept for a period of one month unless explicitly request that they are returned during this time. Please note that we may keep them longer if they are not readable in a digital format.

Complaint file

  • Retained for 6 years

Survey

  • Ombudsman Services has anonymised results returned to it.

Unsuccessful candidates for Ombudsman Services roles

  • Retained for 12 months.

Security measures in place.

Ombudsman Services has a number of protections in place to ensure that your personal data is kept secure.

All of our employees understand the content of this privacy policy and are appropriately trained in data protection legal requirements.

We have been independently tested to verify our security systems and Ombudsman Services meets the requirement standards of Cyber Essentials and Cyber Essentials plus.

This is the standard set by the Government, having worked together with the industry, to improve standards for cyber security. Cyber Essentials Plus offers a higher level of assurance through the external testing of Ombudsman Services’ cyber security approach.

We would recommend that if you are sending us USBs or disks containing information, you consider encryption and/or passwords that you can provide to us separately to enable us to access the information.

How and why we share your data.

Disclosure of your personal information to third parties.

In order to process your complaint, we will ordinarily need to disclose the personal information you send us to the company you have complained about.

We may also need to disclose it to a third party. For example; an independent expert or interpreters that help us with our investigation.

We are obliged by law to disclose some information to the regulatory bodies and will sometimes need to pass details of complaints to industry regulators. For example; Ofcom and Ofgem.

If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

To help us process our work, we have contracts with companies who provide us with services such as IT support or translation services (if English is not your first language).

We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. Our contracts with third parties makes it clear that they must hold it securely, abide by the principles and provisions of data protection, and only use it as we instruct them to. If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Where your personal data may be processed.

Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area, such as the USA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the European Economic Area. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact our Data Protection Officer.

Any transfer of your personal data will follow applicable laws and we will follow the guiding principles of this Privacy Notice.

Profiling and automated decision making.

When complaints are accepted by Ombudsman Services, the investigation will be undertaken by a designated Investigation Officer. However, the complaint can be progressed via an automated procedure. For example; reminder emails at significant points within the investigation process.

Some decisions are wholly automated decisions. For example, the acceptance of a complaint when registered via the website or web form.
If your case is progressed using an automated process, it is only done so using an appropriate mathematical and statistical procedure, for the purposes of considering your complaint and progressing it through our process.

Ombudsman Services has implemented the technical and operational measure appropriate to ensure that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised.

Ombudsman Services will advise you if your complaint is to be dealt with wholly by automated means. In instances where your complaint is wholly undertaken by automated means, you have the right to ask that an employee reviews any decisions made.

Marketing.

Ombudsman Services uses a third party called ‘BMG Research’ to conduct satisfaction questionnaires about your experience using our services. You can read BMG Research’s privacy policy here

Ombudsman Services will ask you whether you wish to partake in satisfaction surveys. Should you wish to complete any surveys you must opt in.

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels at any time. We must always comply with your request to stop direct marketing activity.

Job applicants.

When individuals apply to work at Ombudsman Services, the information they supply is used to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau, we will not do so without informing the candidate beforehand unless the disclosure is required by law.

Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed. It will then be destroyed or deleted. We do retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data. You can read our Candidate privacy notice here.

Once a person has taken up employment with Ombudsman Services, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Ombudsman Services has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it after a period of seven years.

How we can help more.

Reviews and updates to this notice.

Ombudsman Services endeavours to keep the privacy notice up-to-date by reviewing it at intervals of no more than six months. We additionally seek to ensure it is updated promptly if we make a materially relevant alteration to our processes or practices. Ombudsman Services encourages visitors to frequently check this page for any changes to its Privacy Policy.

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.

If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:

For further information on the Data Protection please visit the The Information Commissioner Office (ICO) website.

The Information Commissioner Office regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113 or visit the website

The Freedom of Information Act 2000.

The Freedom of Information Act 2000 places additional obligations, over and above those set out within the Data Protection Legislation, upon organisations and entities that are typified as being public authorities.

Ombudsman Services is not defined as a public authority within the meaning of the Freedom of Information Act 2000 and is therefore not subject to the obligations set out within it.