Ombudsman Services takes your privacy seriously. We know that there is a lot of information so use the quick links below to read different sections of our policy:
Ombudsman Services takes your privacy seriously. This privacy notice tells you what to expect when Ombudsman Services collects personal information from you. It also explains how we will store and handle that information and keep it safe.
We know that there is a lot of information, but we want you to be fully informed about your rights and be aware of how Ombudsman Services collects and processes your personal data.
Our privacy notice applies to the personal information we collect about:
We will only use the personal information you provide to administer your complaint and to provide the services you have requested from us. The information you provide will also help us direct your enquiries.
The types of personal information that we collect are only those necessary for the consideration of your complaint about a Participating Company. We also collect data that helps our understanding of our customers and providing the highest levels of service.
To ensure that the personal information we hold is accurate and up-to-date, please ensure that we are promptly informed of any relevant change to your contact details.
We sometimes share your personal information with a third party, for example the named Participating Company to which your complaint relates, one of our regulators such as Ofcom or Ofgem, or where the transfer is to a secure data processor who carries out data processing operations on our behalf.
Ombudsman Services is registered on the "public register of data controllers" which can be seen online on the Information Commissioner Officer’s website.
Ombudsman Services has the registered address of 3300 Daresbury Park, Daresbury, WA4 4HS.
The Data Protection Officer as assigned by Ombudsman Services is also based at 3300 Daresbury Park, Daresbury, WA4 4HS.
We hope the following sections will answer any questions you have but if not, please do get in touch with us.
All your personal Information will be held and used in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 and any other legislation relating to the protection of personal data.
These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
When someone visits ombudsman-services.org, we automatically collect and store the following information about your visit:
We use this information to help us identify click stream patterns, to improve our website, to learn about the number of visitors to our website and the types of technology our visitors use. This is statistical data about browsing actions and patterns and does not identify you as an individual.
We also use a third party services, Google Analytics and Hotjar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.
We may collect information about your computer, including where available your IP address, operating system and browser type, this is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users' browsing actions and patterns and does not identify any individual.
A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet. Each website can send its own cookie to your web browser if your browser's preferences allow it. Many websites do this whenever a user visits their website in order to track online traffic flows.
For further information about what a cookie is and how Ombudsman Services uses them, please see the ‘cookie settings’ page of this website.
When you ask us to consider a complaint about a Participating Company, Ombudsman Services will only request you provide the personal information that is needed to process your complaint details. We require your data to pursue our legitimate interests in a way that might reasonably be expected as part of the complaint investigation work Ombudsman Services undertakes.
When you ask us to review a complaint about a Participating Company, you will need to provide us with personal details, including your name, address, email address, contact number and any relevant account numbers. Ombudsman Services will also request you provide authority for us to approach the Participating Company to obtain the details of your account.
It is necessary to share your personal information with the company that is the subject of your complaint. This company will be asked to provide us with its response to your complaint, this will include any data from any accounts and/or complaint files that the company has opened about you or the complaint.
Ombudsman Services may also ask you to provide further information that would be relevant to your complaint, for example, the relevant contract, timeline of events, or relevant bank statements.
Ombudsman Services only uses the information you provide to:
In some specific circumstances, you have the right to request that we stop processing your personal data. For example; when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.
Please note that if your complaint is active when you ask us to stop processing your personal data or object to the processing of your personal data, Ombudsman Services will not be able to continue to process your complaint.
We record and monitor incoming and outgoing telephone calls (if it's not withheld). Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint. Recordings may also be used for staff training exercises, to improve the quality of our services.
The telephone calls that we record will be kept secure and subsequently deleted in a structured and organised manner. Recorded calls are kept for a period of 12 months. If a call recording provides useful information or evidence that supports your complaint we may keep this as part of your case for a period of six years.
Ombudsman Services also collects Calling Line Identification (“CLI”, also known as “caller ID”) when you contact us by telephone. This means that we will be provided with, and will record, the telephone number that you have used to contact us unless you have taken steps to withhold the number.
Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
You are able to contact us via Twitter or Facebook. Please note that we have no influence on the scope of data that is collected by these social networks through their sites. The data use policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.
We may retain some information provided via social networks if it is relevant to your complaint.
You have the right to request a copy of any information that Ombudsman Services holds about you. For those requesting a ‘subject access request’, it will be provided free of charge in most cases and within one month. Please see the section ‘Right of access to personal information’, for further information.
You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete. Some corrections can be completed via your access to the portal. You can also contact us by emailing DPO@Ombudsman-Services.org and we can amend inaccurate personal data, however please note that in some circumstances we may ask for the documentary proof that the amendment is necessary. Any changes to personal data will have to be communicated to each recipient to whom the personal data has been disclosed (likely to be the Participating Company of your complaint), unless it is impossible or disproportionate.
You can request the erasure of your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by Ombudsman Services is required by law to be held for a period of time. You can contact Ombudsman Services by emailing DPO@Ombudsman-Services.org if you wish to make a request.
You can request that we restrict the processing of your personal data. This can be done in circumstances where we need to verify the accuracy of personal data, if you do not wish to have personal data erased or you object to the processing and we are considering this request.
Under some circumstances you can request a copy of the personal data you provided to us in a machine readable format or ask that this data be transferred another third party.
In some circumstances you can stop the processing of your personal data for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. Where your details are used for marketing you can opt out at any time. You are able to adjust these settings within the portal, or you can contact Ombudsman Services via DPO@Ombudsman-Services.org
You can request that a member of the Ombudsman team review any decision made solely on automated processing of your data. (i.e. where the decision has been made by a solely automated process). You will be notified if Ombudsman Services makes a solely automated decision which produces a legal effect or significantly affects you.
Ombudsman Services tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a subject access request.
You have a right to obtain confirmation that your personal data is being processed by Ombudsman Services and have access to your personal data.
Should you wish to obtain a copy of the personal data that we hold on you, please send an email to DPO@Ombudsman-Services.org
It will assist us to process your request efficiently if you include:
There will be no fee for the first copy of information provided in response to a subject access request, and we will usually send a copy of all the personal data that we hold concerning you within 30 days.
Please note that a subject access request does not entitle you to be provided with specific documents or an entire file, but rather, it entitles you to be provided with your personal data in a clear and permanent form.
Ombudsman Services will provide the requested information via email unless you request another means. Ombudsman Services may extend the timescale by a further two months if your request is particularly complex.
The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.
In specific situations, we can collect and process your data with your consent, for example, when you tick a box to receive email newsletters.
When collecting your personal data, we will always make clear to you which data is necessary in connection with the particular activity.
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. In either case, just let us know. If you have received a direct marketing emails from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails or email email@example.com and put “unsubscribe” in the subject line.
In certain circumstances, we need your personal data to comply with our contractual obligations.
If the law requires us to, we may need to collect and process your personal information. We also have regulatory requirements, which means we may share details of complaints with Ofgem and Ofcom.
In order to consider your complaint we require your personal information to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.
We will only retain your Information for as long as is necessary for the purpose or purposes for which we have collected it. If you send Ombudsman Services paper documents, disks or USB’s containing information about your complaint, we will uploaded these securely to a digital format. The originals will then be destroyed within one month of receipt.
We will exercise discretion when necessary in destroying original documents, and may keep them longer if they are not readable in a digital format.
In all cases, we will retain your complaint file for a period of up to six years after the case has been closed. The retention period is set at six years for the following reasons:
You have a right to contact Ombudsman Services at any time during this period to correct or amend any information you have provided to us.
We may record and/or retain anonymised information about your complaint in order to document and/or measure our own performance or the performance of our Participating Companies. We may also pass anonymised information about your complaint to regulatory bodies who oversee us or our Participating Companies. Any such reports will contain no personal data about you or any information from which you or your third parties could be identified.
All personal information that we hold will be deleted at the end of a six year period, or earlier if requested, in a structured and organised manner.
If someone opens a case to tell us about a complaint but we do not investigate it, we will keep the information for three years after the case has been closed.
If someone contacts us as part of an initial enquiry and does not open a case, we will keep the information for a period of six months.
|Telephone recordings||12 months|
|Social media contacts||6 months (unless forms part of the complaint details)|
|Paper documents, disks or USB’s||Originals kept for a period of one month unless explicitly request that they are returned during this time. Please note that we may keep them longer if they are not readable in a digital format.|
|Complaint file||6 years|
|Survey||OS has anonymised results returned to it.|
|Unsuccessful candidates for OS roles||12 months|
Ombudsman Services has a number of protections in place to ensure that your personal data is kept secure. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We have been independently tested to verify our security systems and Ombudsman Services meets the requirement standards of Cyber Essentials and Cyber Essentials plus.
This is the standard set by the Government, having worked together with the industry, to improve standards for cyber security. Cyber Essentials Plus offers a higher level of assurance through the external testing of Ombudsman Services’ cyber security approach.
We would recommend that if you are sending us USBs or disks containing information, you consider encryption and/or passwords that you can provide to us separately to enable us to access the information.
In order to process your complaint, we will ordinarily need to disclose the personal information you provide us with to the company you have complained about. We may also share your personal information with another Participating Company if it becomes necessary when considering your complaint. For example, a different Participating Company previously provided services and information they hold would be useful in the consideration of your complaint.
We may also need to share your personal information with it to a third party. For example; an independent expert if that help us with our investigation.
We are obliged by law to disclose some information to the regulatory bodies and will sometimes need to pass details of complaints to industry regulators. For example; Ofcom and Ofgem.
If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.
To help us process our work, we have contracts with companies who provide us with services such as IT support or translation services (if English is not your first language).
We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Our contracts with third parties make it clear that they must hold information it securely, abide by the principles and provisions of data protection, and only use information as we instruct them to.
If we stop using their services, any of your personal information data held by them will either be deleted or rendered anonymous.
Sometimes we will need to share your personal information with third parties and suppliers outside the UK such as Europe and the USA.
If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the UK. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact our Data Protection Officer.
Any transfer of your personal information will follow applicable laws and we will follow the guiding principles of this Privacy Notice.
When complaints are accepted by Ombudsman Services, the investigation will be undertaken by a designated Investigation Officer. However, the complaint can be progressed via an automated procedure. For example; the acceptance of a complaint when registered via the website or web form, and reminder emails at significant points within the investigation process.
If your case is progressed using an automated process, it is only done so using an appropriate mathematical and statistical procedure, for the purposes of considering your complaint and progressing it through our process.
Ombudsman Services will advise you if your complaint is to be dealt with wholly by automated means. In instances where your complaint is wholly undertaken by automated means, you have the right to ask that an employee reviews any decisions made.
When individuals apply to work at Ombudsman Services, the information they supply is used to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau, we will not do so without informing the candidate beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed. It will then be destroyed or deleted. We do retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data. Read our candidate privacy notice.
Once a person has taken up employment with Ombudsman Services, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Ombudsman Services has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it after a period of seven years.
We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.
If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:
For further information on the Data Protection please visit the Information Commissioner Office (ICO) website.
The Information Commissioner Office regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113 or visit the website
The Freedom of Information Act 2000 places additional obligations, over and above those set out within the Data Protection Legislation, upon organisations and entities that are typified as being public authorities.
Ombudsman Services is not defined as a public authority within the meaning of the Freedom of Information Act 2000 and is therefore not subject to the obligations set out within it.