Privacy notice

1.1. This privacy notice (the “Privacy Notice”) applies to all personal information processing activities carried out by the Money and Pensions Service (MaPS). The Money and Pensions Service was set up as an independent body with responsibility for improving people’s money management in May 2018. 

1.2. The legislation that enacts this is the Financial Guidance and Claims Act 2018Opens in a new window MaPS replaced three providers of government-sponsored financial guidance; the Money Advice Service, the Pensions Advisory Service and Pension Wise. The legislation brings together the support and services of these three organisations and is covered by this privacy policy. MaPS provides the free MoneyHelper service, offering one destination for debt advice, money guidance and pensions guidance.

1.3. MaPS delivers free and impartial financial guidance, and a more streamlined service to members of the public providing easier access to the information and guidance. MaPS became a legal entity on 1 October 2018 and took on its delivery functions from January 2019. 

1.4. The objectives of the Money and Pensions Service are:

• to improve the ability of members of the public to make informed financial decisions,

• to support the provision of information, guidance and advice in areas where it is lacking,

• to secure that information, guidance and advice is provided to members of the public in the clearest and most cost-effective way (including having regard to the information provided by other organisations),

• to ensure that information, guidance and advice is available to those most in need of it (and to allocate its resources accordingly), bearing in mind, in particular, the needs of people in vulnerable circumstances, and

• to work closely with the devolved authorities as regards the provision of information, guidance and advice to members of the public in Scotland, Wales and Northern Ireland. 

1.5. The Money and Pensions Service must have regard to its objectives when it exercises its functions. 

1.6. In this section “information, guidance and advice” means:

• information and guidance on matters relating to occupational and personal pensions,

• information and advice on debt, and 

• information and guidance designed to enhance people’s understanding and knowledge of financial matters and their ability to manage their own financial affairs. 

1.7. In order to carry out this function, we collect, process and store personal and sensitive data on an ongoing basis. Our lawful basis for processing personal data is, to carry out our public task set out above. Exceptions to this will be on the lawful basis of consent from our customers. We have a responsibility to protect this information and ensure its confidentiality, integrity and availability.  

1.8. This privacy statement describes why and how we collect and use personal data. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.   

1.9. MaPS is a data controller in respect of personal information that we process in connection with our business. In this notice, references to “we”, “us” or “our” are references to MaPS.

1.10. Our principal address is Bedford Borough Hall, 138 Cauldwell Street, Bedford, MK42 9AB and our contact details are at https://maps.org.uk/en/about-us/contact-usOpens in a new window

More information about MaPS can be found at https://maps.org.uk/enOpens in a new window

1.11. We respect individuals’ rights to privacy and to the protection of personal information. The purpose of this privacy notice is to explain how we collect and use personal information in connection with our business. “Personal information” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information). 

1.12. We may update our privacy notice from time to time. When we do, we will communicate any changes to you and publish the updated privacy notice on our website. We would encourage you to visit our website regularly to stay informed of the purposes for which we process your information and your rights to control how we process it.

2.1. Personal data - means any information relating to an identifiable living person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people. 

2.2. Your information is made up of all the personal information we hold about you. It includes:

• information you give us – you may give us information by filling in the tools on our site or by corresponding with us by phone, email or otherwise. The information you give us may include your name, address, email address and phone number;
• information collected by organisations we fund which provide debt services and assist members of the public with the management of debt;
• information that we learn about you through our relationship with you;
• information we gather from the technology which you use to access our services, for example
• location data from your mobile phone, an Internet Protocol (IP) Address used to connect your device to the internet, your login information, browser type and version, operating system and platform; and
• Full Uniform Resource Locators (URL) clickstream to, through and from our site, items viewed or searched for on our site, page response times, length of visit or page interaction information.

2.3. “Sensitive” and “Special Categories” of personal information.  

• In this notice, we also talk about “Sensitive” and “Special Categories” of personal information. This means personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying someone, information concerning health or information concerning someone’s sex life or sexual orientation.  

• Under data protection law, these types of information are treated differently because they are so sensitive. Under UK law, it is also expected that information relating to criminal convictions and offences or related security measures will also be treated as if it is sensitive/special category information.

• We may collect information about your ethnicity in order to provide quantitative and qualitative insight on our service for our own use– in this case, we anonymise the data so that personal data is not shared, and you cannot be identified. 

• Our lawful basis for collecting special category data comes under research purposes Schedule (1) Part 1 (4) for research purposes.  Where we also commission services we will process special category data under the Substantial Public Interest Schedule (1) Part 2 (6) Statutory etc and government purposes and (8) Equality of opportunity or treatment.

3.1. We want to make sure you are aware of your rights in relation to the personal information we process. We have described those rights and the circumstances in which they apply below. If you wish to exercise any of these rights, if you have any queries about how we use your personal information that are not answered here, or if you wish to complain to our Data Protection Officer, please contact us at dpo@maps.org.uk or 020 7943 0500.

3.2. Access – You have a right to get access to the personal information we hold about you. If you would like a copy of the personal information we hold about you, please write to:  Data Protection Officer, The Money and Pensions Service, Bedford Borough Hall, 138 Cauldwell Street, Bedford, MK42 9AB. Or contact us at 020 7943 0500.

For more information on how to get access to your information and the documents, we need you to submit or to make a formal Subject Access Request (SAR) please complete the SAR formOpens in a new window (PDF, 162KB) and submit either via email dpo@maps.org.uk or by post.

3.3. Rectification – You have a right to rectification of inaccurate personal information and to update incomplete personal information. If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.

3.4. Erasure – You have a right to request that we delete your personal information. You may request that we delete your personal information if you believe that:

• we no longer need to process your information for the purposes for which it was provided;

• we have requested your permission to process your personal information and you wish to withdraw your consent; or

• we are not using your information in a lawful manner. 

3.5. Restriction – You have a right to request us to restrict the processing of your personal information. You may request us to restrict processing your personal information if you believe that:

• any of the information that we hold about you is inaccurate;

• we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims; or

• we are not using your information in a lawful manner.

3.6. Objection – You have a right to object to the processing of your personal information. You have a right to object to us processing your personal information (and to request us to restrict processing) for the purposes described in Schedule A – Purposes of Processing (below), unless we can demonstrate compelling and legitimate grounds for the processing, which may override your own interests or where we need to process your information to investigate and protect us or others from legal claims. Depending on the circumstances, we may need to restrict or cease processing your personal information altogether, or, where requested, delete your information.

3.7. Withdraw consent – You have a right to withdraw your consent. Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.

3.8. Lodge complaints – You have a right to lodge a complaint. If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter and report back to you. 

Email: dpo@maps.org.uk  

Post: The Money and Pensions Service, Bedford Borough Hall, 138 Cauldwell Street, Bedford, MK42 9AB.

Telephone: 020 7943 0500

3.9. We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO). For more information, visit  ico.org.uk

4.1. We may change this notice from time to time, in whole or part, at our sole discretion or to fulfil a legal obligation. We encourage you to check our website to view the most recent version of this notice. You may also request a copy of the most recent version by contacting us.

5.1. We will only use and share your information where it is necessary for us to lawfully carry out our business activities.  We want to ensure that you fully understand how your information may be used. We have described the purposes for which your information may be used in detail in Schedule A – Purposes of Processing.

5.2. We share your personal information with other organisations within the MaPS Group, all of which provide the same high level of security and protection.  We have Group-wide policies to make sure your personal information is protected, no matter which organisation in the MaPS Group holds that information.

5.3. We collect personal data so that we can understand your situation and provide you with personalised information and guidance. We use the data that we store to help us to ensure that we continually give a high-quality service that is accurate and clear and in line with the current UK and/or EU legislation; and provide quantitative and qualitative insight on our service for our own use and third parties.

5.4. If you want us to stop using personal information we’ve collected via cookies on our websites, you should change your cookie settings. In some cases, we might decide to keep information, even if you ask us not to. This could be for legal or regulatory reasons, so that we can keep providing our products and services.  We will always tell you why we keep the information.

6.1. We will not share your information with anyone outside MaPS except:

• where we have your permission;

• where we are using an external processor for data analysis for quality assurance purposes

• where required for your engagement with and involvement in the Financial Capability Strategy and/or What Works programme;

• where we are required by law and to law enforcement agencies or government entities;

• where required for a reorganisation, transfer or other transaction relating to our business;

• in anonymised form as part of statistics or other aggregated data shared with third parties; or

• where permitted by law, it is necessary to fulfil our statutory objectives or those of a third party, and it is not inconsistent with the purposes listed above. 

6.2. We will only share your information with third parties on a limited basis following due diligence and in accordance with our internal procedures.

6.3. MaPS will not share your information with third parties for their own marketing purposes.

7.2. If you change your mind about how you would like us to contact you or you no longer wish to receive this information, you can tell us at any time by contacting us at contact@maps.org.uk.  

7.3. We may monitor or record calls, emails, text messages or other communications in accordance with applicable laws for the purposes outlined in Schedule A – Purposes of Processing.

8.1. When contacting our Telephone Service, we create records that contain your information. Records can be held on a variety of media (physical or electronic) and formats.

8.2. We manage our records to help us to serve our customers well (for example for operational reasons, such as dealing with any queries relating to Debt Advice, Money or Pensions Guidance) and to comply with legal and statutory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.

8.3. Retention periods for records are determined based on the type of record and the nature of the activity. We normally keep customer account records for up to five years after your relationship with The Money and Pensions Service ends, whilst other records are retained for shorter periods, for example 90 days for CCTV records or 12 months for call recordings. Retention periods may be changed from time to time based on business or legal and regulatory requirements.

8.4. We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies. Additionally, due to their nature we are also required to keep records relating to Pension Safeguarding Guidance appointments for up to six years, to align our policy with the Pensions Ombudsman. This is intended to make sure that the organisation will be able to produce records as evidence, if they’re needed.

8.5. If you would like more information about how long we keep your information, please contact us at dpo@maps.org.uk or 020 7943 0500.  

9.1. We are committed to maintaining and enhancing the privacy and confidentiality of your personal data. We take various steps to protect the information you provide from loss, misuse, and unauthorised access or disclosure by; ensuring only authorised persons can access your data and running website scanning and penetration test activities. These steps take into account the sensitivity of the information we collect, process and store, and the current state of technology. 

9.2. If a security breach causes an unauthorised intrusion into our system that materially affects you or the privacy of your data we will notify you as soon as possible. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

9.3. We are committed to ensuring that your information is secure with us and with the third parties who act on our behalf. For more information about the steps we are taking to protect your information please contact us at dpo@maps.org.uk or 020 7943 0500.

10.1. We will only use and share your information where it is necessary for us to carry out our lawful business activities. Your information may be shared with and processed by members of the Money and Pensions Service (MaPS). 

10.2. We will process your information where it is our statutory obligation to do so (public task) and without prejudicing your interests or fundamental rights and freedoms. We want to ensure that you fully understand how your information may be used. We have described the purposes for which your information may be used in detail below:

• We’ll send you information about the services we provide by phone, post, email or text message. We also use the information we have about you to personalise these messages wherever we can as we believe it is important to make them relevant to you. We also check that you are happy for us to send you information by text or email before we do so. In each message we send, you also have the option to opt-out.
• This includes processing your information to:
  
  • develop, test, monitor and review the performance of services, internal systems and security arrangements offered by MaPS;     
  • assess the quality of our service to customers and to provide staff training;
  • comply with legal and statutory obligations;
  • provide you with information on the Financial Capability or What Works programme in general (e.g. newsletters);
  • issue surveys to assist with stakeholder feedback for Financial Capability evaluation and programme improvements; 
  • let you know about opportunities to take part in PR activities such as FinCap Week; Talk Money Week or What Works Funding.
• We’ll use your personal information to create aggregated and anonymised information. Nobody can identify you from that information.  We’ll use it to run management and corporate reporting, research and analytics, to improve the services we provide; and provide other organisations with aggregated and anonymous reports.
• To develop our service(s) and build a better understanding of what our customers want. This means we’ll:
  • maintain, develop and test our network (including managing the traffic on our network), products and services, to provide you with a better service;
  • train our people and suppliers to provide you with services (but we make the information anonymous beforehand wherever possible);
  • create a profile about you to better understand you as our customer;
  • share personal information within the MaPS Group for administrative purposes, such as sharing contact details, so we can get in touch with you; and 
  • run surveys and market research.

10.3. What is Pension Wise?

• Pension Wise is a free and impartial government service, from MoneyHelper, which helps you understand your defined contribution pension options. 
• The service is provided in partnership with Citizens Advice.

10.4. How we use your information - booking a Pension Wise appointment 

• When you use our online booking system or call our booking phone line, you will be asked to provide your name, telephone number, email address, date of birth, and pension type which will be stored on our system and used for the purpose of checking eligibility and booking you an appointment slot at your desired time/location with one of our guidance specialists. We may use the telephone number you provide to send you a text to remind you that your appointment is coming up. We may also store data about any reasonable adjustments you may require to help you to access the appointment. 
• If you have no further contact with the Pension Wise service after booking an appointment (for example if you subsequently cancel the appointment and do not re-book), your personal data will be stored in our booking system for a maximum of 2 years from the date the booking was made and then deleted. Calls to our booking line are recorded and stored for 6 months. 
• For eligibility webchat with MoneyHelper, your transcript is stored for a period of 12 months before being deleted. 
• The lawful basis for MaPS processing personal data for this purpose is set out in Article 6(1)(e) of the UK General Data Protection Regulations.

10.5. How we use your information - guidance appointments 

• Face to face and telephone appointments are delivered through Citizens Advice and MoneyHelper. During a Pension Wise guidance appointment questions will be asked about your personal and family affairs, financial arrangements and plans and general state of health to inform the discussion with the guidance specialist. 
• Details of these will be stored on our systems as part of the record of your appointment.

10.6. Legal basis for processing

• The lawful basis for MaPS processing this data for the delivery of appointments in conjunction with our delivery partner (the Citizens Advice network) and storing your data securely for a maximum of 2 years, is set out in Article 6(1)(e) of the UK General Data Protection Regulations; “performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” For telephone appointments with MoneyHelper and Citizens Advice, key details from your appointment are stored, and calls are recorded and stored, for two years before being deleted. 
• For appointments delivered by the Citizens Advice network, they will ask for your consent to store key details from your appointment for a period of six years, in line with their organisational retention policy. This is to respond to any comments/complaints that arise within the 6-year statute of the limitation period. The lawful basis for this is set out in Article 6(1)(a) of the UK General Data Protection Regulations; “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
• For appointments delivered by Citizens Advice Scotland, key details from your appointment will be stored for 6 years, in line with their organisational retention policy. This is to respond to any comments/complaints that arise within the 6 year statute of limitation period. The lawful basis for this is set out in Article 6(1)(f) of the UK General Data Protection Regulations; “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” 

Consent can be withdrawn at any time by contacting Citizens Advice directly, or by emailing contact.pensionwise@moneyhelper.org.uk. 

10.7. Health data

• For face to face appointments delivered by Citizens Advice England and Wales, any basic health data you provide when requesting an appointment online and during the appointment will be stored in general terms as part of the record of appointment, where it is relevant to your pension options (for example a health condition may entitle you to an enhanced annuity). Where this occurs, processing and retention of this data for a maximum of 2 years is in accordance with Article 9(2)(g) of the UK General Data Protection Regulations, in reference to Schedule 1, Part 2(6)(1 and 2) of the Data Protection Act 2018. Citizens Advice will ask for your consent to store any basic health data discussed in your appointment for a period of six years, in line with their organisational retention policy. This consent process is in accordance with Article 9(2)(a) of the UK General Data Protection Regulations. 
• Citizens Advice Scotland does not keep a written record of health data relating to Pension Wise appointments. However, special category data that you disclose during a telephone appointment will be stored on an audio recording for 2 years. You will be reminded of this at the start of the call and advised that you are under no obligation to disclose any special category data.

Consent can be withdrawn at any time by contacting Citizens Advice directly, or by emailing contact.pensionwise@moneyhelper.org.uk.

10.8. How we use your information – appointment summary 

• After your appointment, we will send you a standard document that summarises the core content of a Pension Wise appointment. We will ask for your postal address and/or email address to send this to you. We also use your postcode to understand the spread of where our appointment customers are located across the UK.

10.9. How we use your information – complaints

• If you have a live complaint we will store your booking and appointment data for longer than our standard retention period if it is necessary to effectively respond to the complaint and deal with any subsequent appeals. Any complaints will be stored for 2 years from the date of resolution.