Privacy Notice

About us

Harpenden Money Advice Centre (HMAC) is a confidential, free, face-to-face debt advice centre working in association with Community Money Advice (CMA). HMAC is authorised and regulated by the Financial Conduct Authority (FCA). HMAC is committed to protecting and respecting your privacy and complies with the requirements of the General Data Protection Regulation (GDPR).

This Privacy Notice explains how we collect, use and store your personal data. It sets out the basis on which any personal information provided will be processed.

The person responsible for Data Control within HMAC is: Richard Payne. Contact details as above.

What is personal data?

Personal data is defined as any information relating to an identified or identifiable natural person (the ‘data subject’). The processing of personal data is governed by the GDPR.

The lawful basis for processing your personal data

All organisations need a lawful basis to collect and use personal data. In accordance with GDPR, we can legally process your personal information because you have given us your consent to collect, process and store your personal data by signing a contract with us.

Processing your personal data

We collect personal data in order to be able to offer the best advice for your circumstances. We will only use any personal information you have chosen to provide to us, for the purpose that you provided it for. We will also sometimes collect additional information from third parties, with your consent, in order to provide the best advice for your circumstances. For example, credit reference agencies, creditors and debt recovery agencies.

We will not use your personal data for any other purpose without your consent. We will not disclose your personal data to any third parties without your consent, except where we are required to do so by law. We will never sell or receive payment for licensing or disclosing your personal information.

Statistics gathered to monitor the service for the purposes of identifying any policy issues and to support funding applications will be anonymised to prevent identification of individual users.

Data protection principles

We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate measures are in place to protect personal data. You can find more information about how we protect and store your personal data in our Security Policy and File Retention and Destruction Policy.

Our purpose for processing your personal data including special category data

In order to comply with the Financial Conduct Authority’s Consumer Credit Sourcebook Regulations we are required to obtain all relevant data in order to be able to offer you the best advice based on your circumstances. This may include processing Special Category Data such as health information or other data of a sensitive nature.

We will only collect Special Category Data if there is a clear reason for doing so, such as where we need this information to ensure that we provide appropriate advice or support to you. We will only use sensitive information for the purposes for which it is provided.

Your data rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

a) Your right of access

You have the right to ask us for copies of your personal information. There are some exemptions, which mean you may not always receive all the information we process. You can read more about this on the ICO website: https://ico.org.uk/your-data-matters/your-right-of-access/

b) Your right to get your data corrected

You have the right to ask us to correct any information we hold about you which you think is inaccurate. This is also known as the ‘right to rectification.’ You also have the right to ask us to complete information you think is incomplete. You can read more about this right here: https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected/

c) Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. This is known as the right to erasure. This is also known as the ‘right to be forgotten’. You can read more about this right here: https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/

d) Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here: https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/

e) Your right to object to processing

You have an absolute right to stop the processing of your personal data for direct marketing purposes. However, we may still be able to legitimately continue using your data for other purposes. You can read more about this right here: https://ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data/

f) Your right to data portability

You have the right to ask that we transfer the information you gave us to another organisation, or give it to you. This right to only applies to electronically held data that you have provided to us and we are processing with your consent. You can read more about this right here: https://ico.org.uk/your-data-matters/your-right-to-data-portability/

Your right to withdraw consent

Where we are using your personal information based on your consent, you have the right to withdraw that consent at any time by contacting our Data Controller, verbally or in writing.

Your right to complain

You have the right to be confident that we will handle your personal information responsibly and in line with good practice. If you have concerns about the way we are handling your information, please contact our Data Controller, in the first instance as we have a dedicated complaints procedure.

If you are unhappy with how your complaint has been handled by us or if we have failed to resolve your information rights concern, you can raise the matter with the Information Commissioner’s Office by calling them on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or by writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

Exercising your rights

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is considered to be ‘manifestly unfounded or excessive’. Alternatively, we may refuse to comply with the request in such circumstances. You will be informed of this in writing, where this is the case.

We have one month to respond to your request. In certain circumstances we may need extra time to consider your request and can take up to an extra two months. If we are going to do this, we will let you know within one month that we need more time and why.

Please contact our Data Controller, if you wish to make a request to access your personal informational held by HMAC.

Retention periods for personal data

We remove personal data from our systems in line with the data retention periods quoted in Appendix 1. The length of time each category of data will be retained will vary on how long we need to process it, the reason it is collected, and in line with any statutory requirements. After this point the data will either be deleted or rendered anonymous.

Sharing your information with third parties

Your personal data will be treated as strictly confidential and will only be shared with {name of centre} staff/volunteers and members of the Community Money Advice (CMA) team who are responsible for reviewing client files for audit purposes. Your personal data will only be sent to third parties with your consent. The only exception to this is if information is requested for legal reasons. We will never share your information with third parties for the purposes of direct marketing.

Changes to this Privacy Notice

We reserve the right to review the way we process your personal information and will update this Privacy Notice if ther