Privacy policy

About us

The Financial Ombudsman Service is the data controller for any personal information that we process unless we state otherwise. If you wish to contact us, you can find details here.

Where we get information from

Most of the personal information that we process is given to us directly by you when you visit our website and when you use one of its services e.g. to register for a webinar or outreach event.

Visiting our website

Analytics

When you visit www.financial-ombudsman.org.uk we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

If we do collect personal information through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.

Cookies

You can read about how we use cookies here.

Security and performance

We use a third-party web application firewall from Cloudflare to help maintain the security and performance of our website. The service checks that traffic to the site is behaving as would be expected. The service will block traffic that is not using the site as expected. To provide this service, Cloudflare processes site visitors’ IP addresses.

We rely on the Privacy Shield Framework to transfer this information to Cloudflare servers which are located in the US. They hold the information for up to seven days.

Amazon Web Services hosts our website in the UK and Ireland and holds traffic information for 12 months.

Search Engine

Our website search is powered by Amazon Elastic Search. Search queries and results are logged anonymously to help us improve our website and search functionality. No identifiable personal information is collected by us or Amazon Elastic Search.

Purpose and legal basis for processing

The reason we do all of the above it so maintain and monitor how our website is performing and to make improvements to the site and the service that we offer to our website users.

The legal basis we rely on for cookies is consent. The legal basis we rely on for analytics, security and performance and our search engine is that it is necessary for the purposes of our or your legitimate interests.

Accessibility – Recite Me

We offer the accessibility tool – Recite Me – on our website. Recite Me allows visitors to our site to customise it in a way that works for them. In order to use the functionality offered by Recite Me, the tool needs to add cookies to your computer – and these are kept for up to 12 months. Aside from IP addresses, no other identifiable personal information is collected by us or Recite Me. 

Recite me provides us with analytics showing how the tool is being used – we use these to help improve the service we offer and to monitor performance of the tool. This information is only collected when you interact with the tool.  We do not use this information to make any automated decisions about you or to profile you.

We are a public authority and provide services to the public. As such we have a legal duty to comply with the Equality Act 2010. What this means is that we need to make service adjustments for anyone with a disability to help them access our service. Our legal basis for processing your personal information is that we have a legal obligation to comply with the Equality Act 2010.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice doesn’t cover how those organisations may use your personal information. You should refer to their privacy notices to check how your information will be used. 

Applying for a job with us

Please see our privacy notice for candidates. 

Using our online complaint form

Please see our privacy notice for consumers for information on how we use your personal information when you refer a complaint to us about a financial business.

Our online complaint form is hosted and maintained by a third party – Egress. Egress hold the personal information you submit through the online form for 30 days after you submit it – this will include your name, contact details, complaint details and any other information you provide in making your complaint. Egress holds this information for 30 days to ensure that all submissions have been received as expected.

Our main legal basis for processing your personal information here is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies, including that we need to process your personal information in the exercise of our official authority to resolve complaints.

Our online complaint form is hosted by Egress Software Technologies Ltd (Egress), who processes your personal information on our behalf. We have a contract in place with Egress and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure.

Using our online form to make an enquiry

What we need

When you contact us to make an enquiry we collect information including your personal information – your name, email address, phone number and enquiry details – so that we can respond to it and fulfil our regulatory responsibilities.

Why we need it

We'll use the information you supply to allow us to deal with your enquiry and any subsequent issues that may arise and to check on the volume of enquiries we receive and the level of service provided.

Our legal basis

Our main legal basis for processing your personal information here is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies, including that we need to process your personal information in the exercise of our official authority to resolve complaints.

What we do with it

If your enquiry relates to a new financial complaint we'll set up a record of your enquiry on our case management system and keep a record of our response and any subsequent ongoing correspondence. You can find out more about how we handle your personal information when you raise a complaint in our privacy notice for consumers. If your enquiry is not case related, we will keep a record on the relevant internal system.

How long we keep it

If your enquiry is about a financial complaint, you can find out more about how we handle your personal information when you raise a complaint in our privacy notice for consumers.

If your enquiry relates to any other part of our service, we will retain your information in line with our retention schedule. Our retention varies greatly depending on the type of enquiry you have made e.g. if it’s an enquiry about a case, recruitment or procurement etc. If you would like to know what the retention is for your particular enquiry please contact [email protected].  

Our online enquiry form is hosted by Egress Software Technologies Ltd (Egress), who process your personal information on our behalf. Egress hold your personal information for 30 days from the date you submit the enquiry form.

Who we share your personal information with

Our online enquiry form is hosted by Egress Software Technologies Ltd (Egress), who process your personal information on our behalf. We have a contract in place with Egress and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission and to keep your personal information secure.

Taking part in a procurement process

What personal information we need

If you take part in one of our procurement processes, then we collect your information, including your personal information. This includes your contact details – including in your capacity as a representative of a business – and other information you supply as part of the process, such as CVs. 

Why we need it

We need your personal information to allow you to engage in our procurement process and to ensure we can facilitate the procurement process. 

Our legal basis

Our legal basis for processing your personal information is that we need it to take certain steps (e.g. allow you to bid) before entering into a contract with you.

What we do with it

We use your personal information to set up an account on our procurement portal for you. On this portal you can view current and past tender opportunities, bid and view contracts. We also use your personal information to assess and decide whether to accept your bid.

How long we keep it for

Information received as part of a tender application – whether successful or unsuccessful – is retained for six years from the end date of the contract which arose from the tender process in question.

Who we share your personal information with

Our procurement portal is hosted by BravoSolution UK Limited (Bravo), who process your personal information on our behalf. We have a contract in place with Bravo and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure.

Buying our consumer leaflets

What personal information we need

When you buy our consumer leaflets we need some personal information including your full name, email address, your organisation and payment details.

Why we need it

We need your personal information to process your order.

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

We use your personal information to process your order, including payment, and to then send the leaflets to you.

How long we keep it for

We keep your information for six years.

Who we share your personal information with

Our consumer leaflet ordering microsite is hosted and maintained by Software Logistics, who process your personal information on our behalf. Software Logistics use Magento E-Commerce to process payments made through the microsite. We have a contract in place with Software Logistics and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure.

Signing up to attend one of our outreach events

What personal information we need

If you sign up to attend one of our outreach events, we ask you for your contacts details (full name, email address, contact phone number), your organisation’s name and whether you have any accessibility or communication requirements.

Why we need it

We need this information to organise and facilitate the event, to respond to you and to provide you with a good service. 

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

If you are given a place on our event, we’ll contact you to let you know and add you to the list of attendees.

If you are not given a place on our event, we’ll also contact you to let you know. We will hold your details on a reserve list in case a place becomes available.

If you have given us consent to do so when signing up for the event, we may also contact you to let you know about future events that you may be interested in and to ask you for feedback on events that you have attended.

How long we keep it for

Your information is kept by us for up to six years.

Your information is kept by a third party, Eventbrite, for as long as you are registered to use their services. You can access Eventbrite’s privacy notice here.

Who we share your personal information with

We use Eventbrite to manage our event registration and ticketing. Eventbrite process your personal information on our behalf. You can access Eventbrite’s privacy notice here. 

If we host an event jointly with another organisation, they will also have access to your personal information.

Signing up to one of our webinars

What personal information we need

If you sign up to one of our webinars, we ask you to provide your contact details (full name and email address) and your organisation.

Why we need it

We need this personal information to help facilitate the webinar and provide you access to it.

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

We use your personal information to:

• Log that you are attending the webinar
• Provide you with access to the webinar
• Keep you updated with information about the webinar for example, any changes in time, content, or log in details
• Invite you to other similar webinars
• Invite you to provide your feedback through a survey

How long we keep it for

We use Cisco Systems Inc (trading as Webex) to manage our webinar registration and provide the webinar platform. Webex process your personal information on our behalf. You information is kept in the Webex platform until the end of the webinar.

Who we share your personal information with

We use Cisco Systems Inc (trading as Webex) to manage our webinar registration and provide the webinar platform. Webex process your personal information on our behalf. You can access Webex’s privacy notice here.

If we host an event jointly with another organisation, they will also have access to your personal information.

Signing up to Ombudsman news

What personal information we need

If you sign up to ombudsman news, we ask you to provide your email address. 

Why we need it

We need your email address to send you each edition of ombudsman news.

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

We use your personal information to:

• Add you to our mailing list for ombudsman news
• Email you new editions of ombudsman news
• Let you know about anything important affecting your subscription, such as your right to unsubscribe
• Ask you for your feedback about ombudsman news so we can make sure it’s useful to our readers – but only if you give us separate consent for this

How long we keep it for

We will keep the information you give us for as long as you remain an active subscriber.

Who we share your personal information with

We use E-Search Limited (trading as Newsweaver) to manage our ombudsman news mailing list, to send the latest editions of ombudsman news, to host the newsletters and to provide analytics on the engagement with the newsletters. Newsweaver process your personal information on our behalf. You can access Newsweaver’s privacy notice here. 

Who we share your personal information with

We do not share your personal information with third parties for the purposes of direct marketing.

We do use data processors that process personal information on our behalf. We have contracts in place with our data processors and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure.

Where possible we keep your personal information within the European Economic Area. If that’s not possible, we take appropriate steps to keep your personal information safe.

In some circumstances, we are legally obliged to share information. This is rare. For example, if a court orders us to or we are required to share information with a regulatory body such as the Financial Conduct Authority.

We may also share information with other regulatory bodies to help them or us further their or our objectives. Again this is rare and we will only do so where we are allowed to by law. 

Your rights

You have a number of rights under data protection laws which we have set out below. These rights don’t always apply and sometimes there are exemptions we can and might apply:

• Right to access – you have the right to ask us for a copy of your personal information.
• Right to rectification – you have the right to ask us to correct personal information that you think is wrong and to complete personal information that you think is incomplete.
• Right to erasure – you have the right to ask us to erase your personal information.
• Right to restriction of processing – you have the right to ask us to restrict the processing of your personal information.
• Right to object to processing – you have the right to object to us processing your personal information.
• Right to data portability – you have the right to ask that we transfer the information you have given us to another organisation or to give it to you.

Normally, you won’t have to pay anything to exercise these rights and we will have one month to respond to you. If you wish to make a request, please contact us at [email protected].   

What if I'm unhappy with how you’ve handled my information?

Our data protection officer (DPO) is Michelle Goddard. You can also contact our DPO at [email protected]. Michelle or a colleague on her behalf will help deal with your concern.

If you’re unhappy with our response, you can contact the Information Commissioner's Office at www.ico.org.uk, [email protected] or 01625 545 745.