Privacy Statement

This privacy statement provides an overview of the CSA’s commitment to privacy and data protection. It explains important information about our collection and use of your personal data, particularly when using our website. If we have your personal data as part of a complaint, or because you are involved with one of our training programmes, or because we are contacting you about our work as a trade body, you can find more specific information about our use of your personal data in the applicable privacy notice below:

The CSA group of companies comprises the Credit Services Association Limited and CSA (Services) Ltd, both of which process personal data. We respect your privacy and are committed to protecting your personal data.

This notice is intended to help you understand our processing of personal data and your rights when we process it. It sets out how we are going to use that personal data, including how long we’ll hold it for and the reason we are processing it. But if you have any questions about the processing that this document doesn’t answer, please feel free to contact us using the details given at section 1.4 of this notice.

Section 1: Who we are

Section 2: What is personal data

Section 3: The personal data we process about you

Section 4: Why we process your personal data

Section 5: What we do with your personal data

Section 6: Automated decision-making and profiling

Section 7: Your data protection rights

Section 8: Making a complaint

Section 9: Changes to this notice

1. Who we are

1.1 This notice is issued on behalf of the CSA group of companies - Credit Services Association Limited and CSA (Services) Ltd (collectively “the CSA”). Throughout this notice, references to “the CSA”, “we”, “us” or “our” are references to the CSA group of companies.

1.2 Credit Services Association Ltd is the only national UK trade association for the debt collection and debt purchase industry. We represent the industry to key stakeholders, including regulatory bodies and government, set out best practice for the industry and provide guidance and support to member companies.

1.3 CSA (Services) Limited is a wholly-owned subsidiary of Credit Services Association Ltd which provides training and development services to both member and non-member companies in relation to debt collection, debt purchase and associated activities.

1.4 The CSA can be contacted at the following details:

Credit Services Association
2 Esh Plaza
Sir Bobby Robson Way
Great Park
Newcastle-upon-Tyne
NE13 9BA

0191 271 0775
info@csa-uk.com
www.csa-uk.com

1.5 The CSA does not have a data protection officer, but you can speak to our Compliance Manager, Daniel Spenceley, if you have any questions in relation to this notice or concerns about any data protection issues. You will find more details about your data protection rights in section 7 of this notice.

2. What is personal data

2.1 Personal data is information about a living person, by which that living person can be identified, either directly (i.e. the information itself identifies the person) or indirectly (i.e. whoever holds the data can identify the person by combining the information with another piece of information to which they have access).

2.2 In addition to personal data, there are also special categories of personal data, which demand stronger protection measures. These include data relating to a living person’s health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, membership of a trade union, and genetic or biometric data.

2.3 When it comes to processing special categories of personal data, we will only process this where:

we have your explicit consent to process the data
we must process the data to carry out a legal obligation
we must process the data for reasons of substantial public interest
you have already made the data public

2.4 In circumstances where we have asked for your consent to process special category personal data, we will be clear about precisely what we intend to use the data for.

2.5 When we ask for consent, you have full control over the decision to give or withhold consent; furthermore, you will continue to have control afterwards too and can withdraw it at any time. If you decide to withdraw consent, please be aware that this could impact our ability to provide the applicable service or product.

3. The personal data we process about you

3.1 We may process the following types of personal data about website users:

Types of personal data
Identification	Name, date of birth, gender
Contact	Address, e-mail address, telephone number (work and/or personal)
Technical information	Internet Protocol (IP) address used to connect your computer to the Internet; login information; browser type and version; time zone setting; browser plug-in types and versions; operating system and platform
Use of website	Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products viewed or searched for; page response times; download errors; length of visits to certain pages; page interaction information (such as scrolling, clicks and mouse-overs); cookies; methods used to browse the page

3.2 We may also process some special categories of personal data (see sections 2.2 and 2.3 of this notice for more information about special categories of personal data). This may include:

Special categories of personal Data
Health information / documentation	Disability information; information about medical / mental health issues (only where supplied as part of a query submitted via the website)

3.3 In the vast majority of cases, we will collect this data from you - for example, when you contact us with your query or complaint.

3.4 We may also collect data from third parties who have appropriate authority to share information about you.

4. Why we process your personal data

4.1 We process the personal data of website users for several purposes. We have set out below the different purposes for which we may process your personal data.

4.2 Where this involves special categories of personal data, we have underlined references to this type of data, for ease of reference.

Purposes of processing
Communication	To communicate with / respond to you.
Record keeping	To maintain adequate and up-to-date records.
Legal and regulatory requirements	To meet all legal and regulatory requirements – including data protection.
Improving services	To monitor and improve our products and services.
Accessibility and support	We may process special category personal data (e.g. health information) to ensure we make any necessary adjustments for those with disabilities.
Dietary requirements	We may process some special category personal data (e.g. health information) to ensure that any allergies or dietary requirements are taken into account at events, meetings or training courses.
Presentation	We may process some technical personal data to ensure that content from our website is presented in the most effective manner for you and your computer or device. This is in line with our cookies policy.

4.3 Where we plan to process personal data for a purpose other than those set out above, and which you would not reasonably expect, we will notify you before any processing for that new process occurs.

4.4 When we process personal data, we will always have legal grounds to do so. Data protection law sets out the different legal grounds that allow companies to process personal data, which include:

processing in order to perform or fulfill a contract we have with you
processing where we have a legal duty
processing which is within our legitimate interests
processing where there is a public interest reason
processing where you have given us your consent

4.5 As outlined at sections 2.3 and 3.2 of this notice, we may process some special categories of personal data. Where we process this type of data, we need to have a stronger legal basis for that processing. In most cases, we will rely on one of the following legal grounds for processing this type of personal data:

We have a legal obligation to process the personal data
The processing is required in the public interest, such as for equal opportunities monitoring
We have your explicit consent for the processing – this will set out clearly what we will do with the personal data and, as with ordinary consent, you will have the right to withdraw consent
The processing is necessary to protect you or another person from harm

4.6 Below we have set out our legal basis for processing the personal data of website users.

Legal basis for processing

Consent

When you contact us with a query through our online form, we will process the information on the basis of consent. By contacting us, we will take this as consent to process any personal data provided within the query.

For certain cookies on our website, we will ask for your consent. You can read more about our use of cookies in our cookies notice.

You can withdraw consent at any point by contacting us on the details at 1.4.

5. What we do with your personal data

5.1 The CSA will not sell, loan or otherwise exchange your details with third party companies for marketing purposes.

5.2 We will only share your information where:

We need to for the purposes of providing you with the services you have requested
We have a public or legal duty to do so e.g. complying with the law
We have a legitimate reason for doing so
We have asked for your permission to share it and you have agreed e.g. for the investigation of complaints by a member company

5.3 We may occasionally share your data with trusted third parties to help us deliver efficient and quality services, which may include:

Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you, and to support the delivery of our services, including the provision of our website(s), storage of personal data and responding to communications
Fraud and crime prevention agencies who will use it to prevent fraud and money laundering
Analytics and search engine providers that assist us in the improvement and optimisation of our website(s).

5.4 We have set out below further details of our data sharing arrangements and some of the organisations with which we have a data sharing relationship.

data sharing

Data concerning website use may be shared with third parties (e.g. analytics providers; search engine providers) to understand and improve our website – you can read more about this in our cookies policy.

5.5 Where we share data with third parties or where we use third party systems to store data, we will take necessary precautions to ensure that the third parties have appropriate data protection measures in place.

5.6 We have detailed below a non-exhaustive list of some of the organisations with whom we share data or who provide services to us that involve the processing of personal data. Please note that the links to external privacy notices are correct as at the date of this notice.

data sharing relationships
Organisation	Service	Privacy notice
Your Membership	Website provider	Your membership: Privacy notice

5.7 The majority of personal data we hold is stored either on our own internal server in the UK or on cloud-based storage. We also store some hard copy data in our office in the UK.

5.8 The CSA, or some of our partners or service providers, may pass information outside of the UK and the European Economic Area (EEA) into jurisdictions where privacy laws, obligations and rights may vary. In such cases, we will always ensure that appropriate assurance checks and measures are put in place to protect your privacy and that transfers are limited to countries which are recognised as providing an adequate level of protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights.

5.9 The below table outlines whether your data may be stored outside the UK or the EEA and, where this is the case, the protections in place.

Data storage

Some data will be stored on our customer relationship management system provided by Your Membership, whose servers are based in the US. To ensure that this data receives an adequate level of protection, we have put in place contractual arrangements with the organisation using the European Commission approved Standard Contractual Clauses.

5.10 The following table explains how long we will keep processing your personal data.

Data retention

Personal data supplied through the CSA website(s) as part of a query will be retained in order to respond to the query. Unless requested to remove the personal data, it will be retained for the duration of the on-going communication or your use of our services and for up to six years beyond.

6. Automated decision-making and profiling

6.1 The CSA does not make automated decisions, nor do we carry out profiling.

7. Your data protection rights

7.1 The individuals whose personal data we process have several rights. This includes the right of access to the personal data we process.

7.2 Where we process your data on the basis of consent or the performance of a contract, we may be required to provide some of your personal data to you in a portable format, or to another data controller on your behalf. Only data that you have provided to us is subject to this right. If you would like to exercise this right, please contact us by e-mail, in writing or on the telephone.

7.3 You also have other rights including:

The right to have inaccurate data corrected. If you know or believe that we are processing inaccurate information about you, you have the right to have that corrected.
The right to object to our processing. This will depend on whether we have a valid legal basis to process your data.
The right to request that we restrict the data we process, or even have it deleted. Again, this will depend on the circumstances – we are not always required to delete your data or restrict our processing, if we can demonstrate we have a valid legal basis for processing it.

7.4 If you wish to exercise any of your data protection rights, please contact us so that we can act on your request or explain why we will be continuing to process the data we hold. You can contact us with your request by email, in writing or by telephone using the details given at section 1.4 of this notice.

7.5 These rights are subject to some exemptions. Where we cannot act on your request, we will provide a relevant explanation about our processing of your personal data in a timely manner.

8. Making a complaint

8.1 If you would like to complain about our data processing, please contact us by e-mail, in writing or by telephone with details of your complaint.

8.2 Data protection is regulated in the UK by the Information Commissioner’s Office (ICO). You can complain to the ICO about our processing, but we would always welcome the opportunity to address any concerns with you first.

8.3 If you want to know more about data protection, or if you want to complain about our processing of personal data, you can contact the ICO via the details below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113

8.4 You can also report concerns about companies’ use of your personal data to the Information Commissioner’s Office here: https://ico.org.uk/concerns/

9. Changes to this notice

9.1 From time to time, we will review this document, for example, where there are changes to laws or regulations, or where we make substantial changes to our processes, procedures or systems.

9.2 In such cases, we will update this notice to reflect the relevant changes and we will make reasonable efforts to contact and update those affected, if the changes are substantial in nature.