Lafferty Group - Data Privacy

Lafferty Holdings Ltd and its subsidiaries and affiliated companies, Retail Banking Institute Ltd, Lafferty Global Limited and Lafferty Research Limited,care about your privacy and are committed to processing your personal information in accordance with fair information practices and applicable data privacy laws.

Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller's possession or likely to come into such possession. The processing of personal data is governed by the Data Protection Act 1998 and the General Data Protection Regulation 2016/679 (the "GDPR").

In the case of a corporate contract involving registrations with more than one delegate/user/candidate, it is the responsibility of the client to share this data privacy notice with all the parties involved/registered to inform them of their rights and of how their data will be processed.

Who are we?

Lafferty Group will be what's known as the 'Controller' of the personal data you provide to us. We collect personal data about you which does includes name, address, email, phone number, bank details. This means Lafferty Group decides how your personal data is processed and for what purposes.

How do we process your personal data?

Lafferty Group complies with its obligations under the Data Protection Act / GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for the following purposes

For Contract customers

• To enable us to provide ongoing support to Candidates;
• To administer customer records;
• To maintain our own accounts and records.
• We also use your personal data
• To maintain, support and manage websites, access, and other related services that individuals have requested.
• To inform individuals of alerts and notifications related to their access to the websites; as applicable
• To contact individuals about their opinions of current services or of potential new services that may be offered.

What is the legal basis for processing your personal data?

• Processing is necessary for the performance of a learning/service agreement contract with the data subject;
• Processing is necessary for the provision of support and related services;
• Processing is necessary for compliance with a legal obligation;
• Processing is necessary to protect the vital interests of a data subject or another person;
• Processing is necessary for the performance of a task carried out in the customers interest or in the -exercise of official authority vested in the data controller;
• Processing is necessary for the establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity.
• The processing relates only to existing customers and there is no disclosure to a third party without consent (except in cases of legal intervention, where we are obliged by law to divulge such information).

Sharing your personal data

Your personal data will be treated as strictly confidential and will be shared only with contacts you have specifically asked us to share data with. We will only share your data with third parties outside of Lafferty Group with your consent.

Where do we store your data?

We store customer and related data in our CRM system, which is an application running on UK-based servers.

For the purposes of IT hosting, backups, cloud services and maintenance this information is located on secure servers in UK and Ireland.

We have a Data Protection regime in place to oversee the effective and secure processing of your personal data which will continue to be monitored.

Data access control

We have security arrangements in place to guard against unauthorised access, improper use, alteration, destruction or accidental loss of your personal information. Both hard and soft version of the documents containing personal information are safe, and their access is restricted based on our legal obligations, contract requirements and your consent.

We have previously implemented measures and will continue, to prevent our systems from being used by unauthorised persons. This is achieved by having:

• Individual and role-based user accounts.
• Centralised, standardised password management and password policies.
• Deactivation of user accounts after 3 failed login attempts.

Individuals that are granted access to our systems, are only able to access the data that is required to be accessed within their scope of responsibilities and to the extent covered by their respective access permission; and such data cannot be read, copied, modified or removed without specific authorisation. This is accomplished by:

• Authentication at operating system level.
• Segregation of duties and authorisations between users, administrators and system developers.
• Remote access only via VPN including appropriate authorisation and authentication
• Logging of system and network activities to produce an audit trail in the event of system misuse.

How long do we keep your personal data?

We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed if it is no longer required. Your information we use for marketing purposes will be kept with us until you notify us that you no longer wish to receive this information.

Your rights and your personal data

Unless subject to an exemption under the Data Protection Act / GDPR, you have the following rights with respect to your personal data:

• The right to request a copy of your personal data Lafferty Group holds about you;
• The right to request that Lafferty Group corrects any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for Lafferty Group to retain such data;
• The right to request that Lafferty Group provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable);
• The right to lodge a complaint with the Information Commissioners Office.

Contact Details

To exercise all relevant rights, queries of complaints please in the first instance contact the Data Protection Officer, Lafferty Group by email at: dataprotection@lafferty.com.

Data Breaches

All data breaches (accidental disclosures/losses of personal data) MUST be reported to the Data Protection Officer, dataprotection@lafferty.com as soon as the breach has been discovered so that appropriate measures can be taken to recover the data and limit any damage. The Lafferty Group is obliged to report any breaches to the Information Commissioner Office (ICO) within 72 hours.

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

Types of information collected on this website

The following kinds of information may be collected on this site in order to better understand your needs and to provide you with a better service:

a. Information about your computer, your visits and your use of this website. This may include your computer's IP address, its geographical location, your browser type and version, your computer operating system, the referral source, the length of visit, the number of page views and your navigation of the website.
b. Information relating to transactions carried out on this website including information relating to the purchase of goods or services.
c. Information that you provide for the purpose of registering to use services on this website and/or in order to subscribe to our website services such as email notifications and newsletters.
d. Any other information that you specifically choose to send to Lafferty Group.

Use of cookies

Certain areas of this website may use 'cookies'. These cookies are small text files that are stored on your computer when you visit this website. Most major websites use cookies. Cookies help Lafferty Group to track of your use of the site, help you to resume where you left off, remember your registered logins, preferences, and other customization functions and can be used to help show content that better matches your interests.

By using this website you are agreeing to this policy and you consent to our use of cookies in accordance with the terms of this policy. If you wish to use this site but do not wish to accept cookies used by Lafferty Group you can do so by adjusting your browser settings. Independent advice on managing cookies in your browser can be found at www.allaboutcookies.org/. Please note that if you try to use this website without accepting cookies that some parts of this website may not function correctly. If you accept Lafferty Group cookies, your experience of this website will be much improved and your choices and preferences can be saved for when you visit the site again.

This website may use 'session' cookies, 'persistent' cookies and 'third-party' cookies including 'Google cookies'.

a. Session cookies
Session cookies help Lafferty Group to track your use of this website as you navigate the pages. Session cookies are automatically deleted from your computer when you close your browser.

b. Persistent cookies
Persistent cookies enable Lafferty Group to recognise you when you make a return visit and may be used to register any preferences set on previous visits. Persistent cookies will remain stored on your computer until they are deleted or until they reach a specified expiry date.

c. Third-party cookies
Merchant suppliers and affiliate companies that feature on this website may add their own cookies when you click on their links to visit their websites. We will alert you when this is about to happen. Please note that the Lafferty Group privacy policy will not apply when you leave this website. Other companies will have their own privacy policies on the use of cookies and, if you have any concerns, you should check the privacy policy of the relevant website.

d. Google cookies
Lafferty Group may use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information through cookies stored on your computer when you use this website. The information generated is used to create reports on website use and is stored by Google. Google's privacy policy is available at www.google.com/privacypolicy.html.

Links to other websites

This website may contain links to other websites. Please note that Lafferty Group has no control over other websites and Lafferty Group cannot be held responsible for the protection and privacy of any information which you provide whilst visiting such sites.

Third-party websites will not be governed by this privacy policy statement. You should exercise caution and look at the privacy statement applicable to the website in question.