Privacy policy

The Financial Ombudsman Service is the data controller for any personal information that we process unless we state otherwise. If you wish to contact us, you can find details on our website.

Analytics

When you visit www.financial-ombudsman.org.uk we use third-party services, Google Analytics and Hotjar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google or Hotjar to make, any attempt to find out the identities of those visiting our website.

If we do collect personal information through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.

Cookies

You can read about how we use cookies on our website.

Security and performance

We use a third-party web application firewall from Cloudflare to help maintain the security and performance of our website. The service checks that traffic to the site is behaving as would be expected. The service will block traffic that is not using the site as expected. To provide this service, Cloudflare processes site visitors’ IP addresses.

We rely on the Privacy Shield Framework to transfer this information to Cloudflare servers which are located in the US. They hold the information for up to seven days.

Amazon Web Services hosts our website in the UK and Ireland and holds traffic information for 12 months.

Search Engine

Our website search is powered by Amazon Elastic Search. Search queries and results are logged anonymously to help us improve our website and search functionality. No identifiable personal information is collected by us or Amazon Elastic Search.

Purpose and legal basis for processing

The reason we do all of the above it so maintain and monitor how our website is performing and to make improvements to the site and the service that we offer to our website users.

The legal basis we rely on for cookies is consent. The legal basis we rely on for analytics, security and performance and our search engine is that it is necessary for the purposes of our or your legitimate interests.

We monitor publicly available social media data, using a commercially available automated social media monitoring tool which gathers information and monitors content about topics related to our functions through publicly available information on platforms such as Twitter, Facebook, Instagram and LinkedIn. 

We currently use the social media analytics tool, Orlo. 

What we need

We may collection personal information of social media users if users comment on or post about the Ombudsman Service or related topics or send a direct message to the Ombudsman's own social media channels in order to communicate directly with us. 

The data gathered through tools may include social media handles and content from posts which are publicly available. 

Our legal basis

Our legal basis for collecting this personal information is that it is in our legitimate interest to monitor public sentiment, pick up on developing trends and communicate with customers. 

We do not actively collect special category personal data in our social media monitoring, but we may process such data in monitoring social media content where such data is included in social media posts. Special category data includes information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, sex life or sexual orientation. Our lawful basis for processing this information is: 

• processing is necessary for reasons of substantial public interest, and
• the processing relates to personal data which are manifestly made public by the data subject

What we do with it

The data we obtain through social media monitoring is used to help us respond to posts and messages and to monitor overall engagement with our content as well as mentions of our organisation, and related topics.

Insight reports will be prepared for internal use and will generally use aggregated data. However, individual quotes may be captured as examples and used to describe the general attitude towards the Ombudsman Service, financial services or related topics. 

Data may have been subject to automated decision-making to identify it as falling within in a search description or sentiment. 

We do not have any influence on the scope of data that is collected by social networks through their sites. If you use them, you should check the policies of the relevant platforms to understand how they protect your data. 

How long we keep it

We will from time to time retain identifiable information that is downloaded from our social media monitoring in order to compile reports. Personal data will be stored for a maximum of up to two years on our social media analytics tool and will then be deleted. 

Who we share your personal information with

Orlo processes your publicly available personal information on our behalf. We have a contract in place with Orlo and they are required to comply with law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure. 

Any personal information downloaded from monitoring tools onto our IT systems will be shared with our IT suppliers who provide email, and document management and storage services. 

When you contact us to make an enquiry through Twitter or Facebook, we collect information including your personal information – such as your social media handle and enquiry details – so that we can respond to it and fulfil our regulatory responsibilities. 

We may collect, use and retain some information that you provide, or which is otherwise obtained via social media channels if it is relevant to an enquiry or a complaint. You can find out more about how we handle your information for an enquiry and also see our privacy notice for consumers for information on how we use your personal information when you refer a complaint to us about a financial business. 

Please see our privacy notice for candidates. 

Please see our privacy notice for consumers for information on how we use your personal information when you refer a complaint to us about a financial business.

Our online complaint form is hosted and maintained by a third party – Egress. Egress hold the personal information you submit through the online form for 30 days after you submit it – this will include your name, contact details, complaint details and any other information you provide in making your complaint. Egress holds this information for 30 days to ensure that all submissions have been received as expected.

Our main legal basis for processing your personal information here is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies, including that we need to process your personal information in the exercise of our official authority to resolve complaints.

Our online complaint form is hosted by Egress Software Technologies Ltd (Egress), who processes your personal information on our behalf. We have a contract in place with Egress and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission, and to keep your personal information secure.

What we need

When you contact us to make an enquiry we collect information including your personal information – your name, email address, phone number and enquiry details – so that we can respond to it and fulfil our regulatory responsibilities.

Why we need it

We'll use the information you supply to allow us to deal with your enquiry and any subsequent issues that may arise and to check on the volume of enquiries we receive and the level of service provided.

Our legal basis

Our main legal basis for processing your personal information here is that you have given us your consent. Where you have provided consent, you can withdraw it at any time. Occasionally there may be another legal basis that applies, including that we need to process your personal information in the exercise of our official authority to resolve complaints.

What we do with it

If your enquiry relates to a new financial complaint we'll set up a record of your enquiry on our case management system and keep a record of our response and any subsequent ongoing correspondence. You can find out more about how we handle your personal information when you raise a complaint in our privacy notice for consumers. If your enquiry is not case related, we will keep a record on the relevant internal system.

How long we keep it

If your enquiry is about a financial complaint, you can find out more about how we handle your personal information when you raise a complaint in our privacy notice for consumers.

If your enquiry relates to any other part of our service, we will retain your information in line with our retention schedule. Our retention varies greatly depending on the type of enquiry you have made e.g. if it’s an enquiry about a case, recruitment or procurement etc. If you would like to know what the retention is for your particular enquiry please contact [email protected].  

Our online enquiry form is hosted by Egress Software Technologies Ltd (Egress), who process your personal information on our behalf. Egress hold your personal information for 30 days from the date you submit the enquiry form.

Who we share your personal information with

Our online enquiry form is hosted by Egress Software Technologies Ltd (Egress), who process your personal information on our behalf. We have a contract in place with Egress and they are required to comply with the law, only act on our instructions, to not share it with others unless we give permission and to keep your personal information secure.

What personal information we need

If you sign up to attend one of our outreach events, we ask you for your contacts details (full name, email address, contact phone number), your organisation’s name and whether you have any accessibility or communication requirements.

Why we need it

We need this information to organise and facilitate the event, to respond to you and to provide you with a good service. 

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

If you are given a place on our event, we’ll contact you to let you know and add you to the list of attendees.

If you are not given a place on our event, we’ll also contact you to let you know. We will hold your details on a reserve list in case a place becomes available.

If you have given us consent to do so when signing up for the event, we may also contact you to let you know about future events that you may be interested in and to ask you for feedback on events that you have attended.

How long we keep it for

Your information is kept by us for up to six years.

Your information is kept by a third party, Eventbrite, for as long as you are registered to use their services. You can access Eventbrite’s privacy notice on their website.

Who we share your personal information with

We use Eventbrite to manage our event registration and ticketing. Eventbrite process your personal information on our behalf. You can access Eventbrite’s privacy notice on their website. 

If we host an event jointly with another organisation, they will also have access to your personal information.

What personal information we need

If you sign up to one of our webinars, we ask you to provide your contact details (full name and email address) and your organisation.

Why we need it

We need this personal information to help facilitate the webinar and provide you access to it.

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

We use your personal information to:

• Log that you are attending the webinar
• Provide you with access to the webinar
• Keep you updated with information about the webinar for example, any changes in time, content, or log in details
• Invite you to other similar webinars
• Invite you to provide your feedback through a survey

How long we keep it for

We use Cisco Systems Inc (trading as Webex) to manage our webinar registration and provide the webinar platform. Webex process your personal information on our behalf. You information is kept in the Webex platform until the end of the webinar.

Who we share your personal information with

We use Cisco Systems Inc (trading as Webex) to manage our webinar registration and provide the webinar platform. Webex process your personal information on our behalf. You can access Webex’s privacy notice on their website.

If we host an event jointly with another organisation, they will also have access to your personal information.

What personal information we need

If you sign up to Ombudsman News, we ask you to provide your email address and whether you’re a business, a consumer or another type of reader. 

Why we need it

We need your email address to send you each edition of Ombudsman News.

We ask what kind of reader you are so we can make sure we’re including interesting and useful information in the newsletter. You don’t have to provide this information in order to sign up to receive Ombudsman News.

Our legal basis

We rely on your consent to process this personal information. You can withdraw your consent at any point.

What we do with it

We use your personal information to:

• Add you to our mailing list for Ombudsman News
• Email you new editions of Ombudsman News
• Let you know about anything important affecting your subscription, such as your right to unsubscribe
• Ask you for your feedback about Ombudsman News so we can make sure it’s useful to our readers – but only if you give us separate consent for this
• Understand what content consumers, businesses and other readers engage with in Ombudsman News, so we can provide more of it

How long we keep it for

We will keep the information you give us for as long as you remain an active subscriber.

Who we share your personal information with

We use Forth Communication Ltd. to manage our Ombudsman News mailing list, to send the latest editions of Ombudsman News, to host the newsletters and to provide analytics on the engagement with the newsletters. Forth Communication Ltd. process your personal information on our behalf. You can access Forth Communication Ltd. privacy notice on their website.

You have a number of rights under data protection laws which we have set out below. These rights don’t always apply and sometimes there are exemptions we can and might apply:

• Right to access – you have the right to ask us for a copy of your personal information.
• Right to rectification – you have the right to ask us to correct personal information that you think is wrong and to complete personal information that you think is incomplete.
• Right to erasure – you have the right to ask us to erase your personal information.
• Right to restriction of processing – you have the right to ask us to restrict the processing of your personal information.
• Right to object to processing – you have the right to object to us processing your personal information.
• Right to data portability – you have the right to ask that we transfer the information you have given us to another organisation or to give it to you.

Normally, you won’t have to pay anything to exercise these rights and we will have one month to respond to you. If you wish to make a request, please contact us at [email protected].   

Our data protection officer (DPO) is Michelle Goddard. You can also contact our DPO at [email protected]. Michelle or a colleague on her behalf will help deal with your concern.

If you’re unhappy with our response, you can contact the Information Commissioner's Office at www.ico.org.uk, [email protected] or 01625 545 745.