Website Privacy Notice
If you have been referred to this page when applying for services or finance, or in the context of being employed by or working for an organisation, then please go to the Fair Processing Notices for Cifas' Databases page instead.
1. Introduction and general terms
This website is operated by Cifas, a company registered in England and Wales under company number 02584687 and with our registered office at 6th Floor Lynton House, 7-12 Tavistock Square, London WC1H 9LT (“Cifas”, “we”, “us” or “our” in this policy). Where we decide the purpose and means for which personal data you supply through this website is processed, we are the “data controller.”
If you have any questions or comments about this privacy policy please contact our data protection officer:
Cifas
6th Floor, Lynton House
7 - 12 Tavistock Square
London
WC1H 9LT
or use our general enquiry form.
Cifas is committed to safeguarding your personal information when you visit our website. This privacy policy relates to our use of any personal information you provide to us through this website and any other electronic communications networks such as emails.
This privacy policy explains the following:
- What information Cifas may collect about you;
- How Cifas will use information we collect about you;
- When Cifas may use your details to contact you;
- Whether Cifas will disclose your details to anyone else;
- Your choices and rights regarding the personal information you have provided to us;
- The use of cookies on the Cifas website and how you can reject these cookies.
Whenever you provide personal information, we are legally obliged to use your information in line with the General Data Protection Regulation and the Data Protection Act 2018 (referred to collectively in this privacy policy as “data protection legislation").
This website contains hyperlinks to websites owned and operated by third parties. These third party websites have their own privacy policies, including cookies, and we urge you to review them. They will govern the use of personal information you submit or which are collected by cookies whilst visiting these websites. We do not accept any responsibility or liability for the privacy practices of such third party websites and your use of them is at your own risk.
2. What information will Cifas collect about me?
We collect and process the following information which may include your personal data.
Information about your use of our services
When you contact us regarding one of our services, such as Training or Speakers for Events, the forms you complete may include information about you. This can include your name as the contact point for an organisation, your email address and the organisation's address.
- We process this to provide services you request under an agreement between us, or to take steps you request prior to entering such an agreement;
- If you don’t provide all relevant information, we may not be able to provide you with the services you request;
- We only process this to take such steps, or providing such services;
- We delete this information 6 years after we finish supplying any services, or after 12 months if you decide not to take up any services.
Job applications
When you submit a job application through our website, the application forms we ask you to complete include personal data about you.
- We process this to take steps you request prior to entering into an employment contract with you (if you are successful);
- We only process this for the purpose of your application;
- If you don’t provide all relevant information, we may not be able to process your job application;
- We delete this information 6 months after your application is received, if you are not offered a role or do not wish us to keep hold of your details in case future opportunities arise.
If you are successful, we will retain the information in accordance with your employment contract and our internal data protection policies, which will be notified to you in the course of the application process.
Your enquiries
When you email us for further information on topics such as Internal Fraud or Protective Registration, you will be providing us with your email address and any other information you include in the message.
- We only process this in order to pursue our legitimate interests in supplying you with information about fraud prevention and the services we offer;
- We delete this information 6 years after we have finished supplying you with any services, or after 12 months if you do not take up any services.
How you use our website (analytics)
Our website provider uses cookies to collect standard internet log information, such as internet protocol (IP) addresses, and responses to polls we might post on the website, to help analyse how visitors use the site and to compile statistical reports on website activity. Our site also uses Google Analytics and you can find out more about "How Google uses data when you use our partners' sites or apps". To learn how to opt out of Google Analytics please visit Google Analytics Opt-out Browser Add-on or your Google Ads Settings.
- We process this information to understand how visitors use our website and to compile statistical reports regarding that activity (for example, your IP address is used to approximate the country from which you access our website, and we aggregate this information together so we know that, for example, most of the visitors to our website come from England);
- This processing is necessary for us to pursue legitimate interests in improving our website, and providing a better service and source of information to visitors;
- This information is not used to develop a personal profile of you. All such information is stored anonymously. We use the masking setting within Google Analytics to anonymise IP addresses;
- Where any cookies can be used to single-out your device when you are using our website, that identifier is deleted (at the end of each day).
We may use third party analytics providers, in particular, Google Analytics. Before we do so, we will ask for you to give your consent.
Financial transactions
All our website financial transactions are handled through our payment services provider, Protx, a division of Sage (UK) Limited.
- We need to process this personal data in order to provide you with services you have requested under an agreement between us, or in order to take steps you have requested prior to entering into such an agreement;
- We process this personal data by sharing it with Protx only to the extent necessary for the purposes of processing payments you make via our website;
- When payment is taken, no details are held in session storage or cookies. Card details are sent directly to the bank clearing process via a secure link and only responses (i.e. “success” or “failure” regarding your payment) are recorded;
- We keep these transaction records for 6 years.
All content you submit to us
If you send offensive, inappropriate or objectionable content to cifas.org.uk, or otherwise engage in any disruptive behaviour on cifas.org.uk, Cifas may process your personal data as might be included in such message to stop such behaviour.
- We only process personal data in this way for the legitimate interests of ensuring that use of our website is lawful, does not disrupt the operation of our website, does not harass our staff or other individuals, and to enforce our legal rights and to comply with our legal obligations;
- Where Cifas reasonably believes that you are or may be in breach of any of the laws of England or Wales (for instance, because content you have sent may be defamatory), Cifas may use your personal information to inform relevant third parties such as your email/internet provider or law enforcement agencies about the content.
Cifas will not (and will not allow its website provider to) use the information and/or any statistical analytics tool to track or to collect any personally identifiable information about visitors to our site. We will not associate any data gathered from this site with any personally identifying information from any source.
Where Cifas proposes using your personal information for any other uses we will ensure that we notify you first. You will also be given the opportunity to withhold or withdraw your consent for uses other than those listed above.
3. Your rights in relation to personal data which we process relating to you
You have the following rights over the way we process personal data relating to you. We aim to comply without undue delay, and within one month at the latest.
(i) to ask for a copy of data we are processing about you and have inaccuracies corrected
- Data protection legislation gives you the right to request a copy of the personal information we hold about you and to have any inaccuracies corrected;
- Our Data Subject Access Request page explains how to make a request to us;
- We will use reasonable efforts to the extent required by law to supply, correct or delete personal information held about you on our files (and with any third parties it has been disclosed to);
- Please address questions about this website privacy policy to using our general enquiry form.
(ii) to object to us processing data about you
You can ask us to restrict, stop processing, or to delete your personal data if:
- You consented to Cifas processing the personal data, and have withdrawn that consent;
- Cifas no longer needs to process that personal data for the reason it was collected;
- If Cifas is processing that personal data because it is in the public interest or in order to pursue a legitimate interest of Cifas, you don’t agree with that processing, and there is no overriding legitimate interest for us to continue processing it;
- If the personal data was unlawfully processed;
- If you need the personal data to be deleted in order to comply with a legal obligations;
- If the personal data is processed in relation to the offer of a service to a child;
- In which case, you can let us know by email to general enquiry form.
(iii) to obtain a machine readable copy of your personal data, which you can use with another service provider
- If we are processing data in order to perform our obligations to you, or because you consented, if that processing is carried out by automated means, we will help you to move, copy or transfer your personal data to other IT systems;
- If you request, Cifas will supply you with the relevant personal data in a format which is readily accessible by most IT systems (CSV format). Where it is technically feasible, you can ask Cifas to send this information directly to another IT system provider if you prefer;
- To make a request let us know by email to general enquiry form.
(iv) to make a complaint to the Information Commissioner’s Office
- If you are unhappy with the way Cifas is processing your personal data, please let us know;
- Or, if you do not agree with the way we have processed your data or responded to your concerns, an alternative is to submit a complaint to the Information Commissioner’s Office, through their website or by post or live chat. Find out more.
3. Will Cifas share my personal information with anyone else?
We keep your information confidential, but may disclose it to any of our employees, officers, agents, suppliers or subcontractors insofar as it is reasonably necessary for the purposes as set out in this privacy policy.
We will share information with our payment services provider, Sage Pay Europe Limited, and Google, Inc., as described in section 2.
In addition, we may disclose your information to the extent that we are required to do so by law (which may include to government bodies and law enforcement agencies); in connection with any legal proceedings or prospective legal proceedings; and in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention).
Except as provided above, we will not provide your information to third parties.
4. What if I am aged 16 or under?
If you are aged 16 or under, please get your parent/guardian's permission beforehand whenever you provide personal information through the Cifas website. Users without this consent are not allowed to provide us with personal information.
5. How long will Cifas keep my personal information?
We will hold your personal information on our systems for as long as is necessary for the relevant service, or as otherwise described in this privacy policy.
6. Security of my personal information
We will take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.
7. Changes to Cifas's privacy policy
This privacy policy may be updated from time to time so you may wish to check it each time you submit personal information through the website. The date of the most recent revisions will appear on this page.
8. Information about cookies
A cookie is a small piece of information sent by a web server to a web browser, which enables the server to collect information from the browser.
Find out more about the use of cookies.
We use cookies to identify you when you visit this website.
Most browsers allow you to turn off cookies or to receive a warning before a cookie is stored on your hard drive.
Please refer to your browser instructions or help screen to learn more about how to do this. If you decide to disable any cookies we place on your computer, you may not be able to use certain services or facilities on the website.
For details of how Cifas uses cookies, please read the Cookie Notice.
9. Information about calls
Cifas records calls on the basis of our legitimate interests in staff training, security, and maintaining the quality of service. The recordings are stored in the UK and will be kept for 30 days as standard. Recordings are only accessible to Cifas and our advisors where necessary. We also keep a log of the phone number you’re calling from along with the date and duration of the call. You have rights in relation to the processing of personal data, including the right to complain to the ICO.
Last updated: June 2022
