Last Updated: 20 March 2024
The LMA is committed to protecting and respecting your privacy. This notice describes how the LMA collects and uses personal data and the rights you have in relation to your personal data.
This notice was last updated on the above date and may be amended from time to time, so please do check for any amendments. Any significant changes to this notice will be clearly indicated on the homepage of the website.
Contact details
The Loan Market Association ("LMA") is registered at 13th Floor One Angel Court, London, United Kingdom, EC2R 7HJ. The LMA acts as a data controller with respect to the personal data provided to us. The LMA is registered with the UK Information Commissioner's Office ("ICO") under the following ICO registration number: Z5349255.
If you have any questions in respect of this notice, or would like to exercise your rights as stated in this notice, please contact us at: lma@lma.eu.com; or at our postal address: LMA, 10 Upper Bank Street, London E14 5JJ.
What personal data we collect
Our customers: We collect personal information about individuals who choose to register for our website and services. The personal data we collect consists of an individual's name, work email address, work telephone number, country of residence and job title. We also collect similar personal data on individuals who register to attend LMA events, speak at LMA events or take part in LMA projects as well as personal data consisting of passwords, social media account URLs, phone number(s), address, website details, biographies and profile pictures.
In addition we may collect profile photos and biographies for delegate booklets and/or our events apps. We also collect personal information about the contact within organisations whose details are listed in respect of bookings for LMA events. We may also collect personal information of the accounts teams within organisations whose details are used by the LMA in respect of the management of their accounts.
If you attend a virtual event or physical event at which we provide the option to interact with sponsors, exhibitors or other delegates via an app or online platform, we (or our service provider on our behalf) will collect details of who you have interacted with, any content you download or view and any questions answered.
Our suppliers: If you work for an organisation that provides goods or services to us, we may collect your contact details (including name, job title, email address, phone number and physical address) to enable us to manage our relationship with you and the organisation you represent.
How we collect personal data
Our customers: The LMA collects the personal data detailed above in relation to individuals who: (i) register for an individual LMA user account; (ii) subscribe to receive email alerts or newsletters from the LMA; (iii) register for LMA events; (iv) request or purchase LMA services (e.g. provision of documents to non-member individuals); (v) are referred to us by either our members or non-members (e.g. to speak at, or attend, an LMA event); or (vi) voluntarily provide information to us for other purposes (e.g. by providing business cards to LMA staff or filling in feedback forms for LMA events). Such data may be provided to us by you filling in the appropriate forms on our website or at our events. You may also provide us with personal information if you contact us by email, telephone, post or otherwise.
Our suppliers: The LMA collects the personal data detailed above directly from you or your colleagues at the time we start purchasing goods or services from you or your organisation, or from details published by your organisation in relation to its goods or services prior to us contacting your organisation to request the provision of such goods or services. We also store the contents of communications that you send to us.
How we use personal data
The LMA uses the personal data it holds to: (i) provide membership benefits and services to you; (ii) communicate with you about our services (e.g. alerts on new documents and events, or requests for feedback about our events); (iii) to send you newsletters or alerts that you have subscribed to (iv) to process and respond to requests, enquiries or complaints received from you; (v) to deal with account enquiries you may have; and (vi) fulfil our legal obligations.
The LMA only uses personal data for legitimate business purposes and in accordance with data protection legislation. In particular, we use the data we collect to deliver services (for example, we need to use your personal information in order to register you for an LMA event). We may not be able to provide you with some of the features and functionality provided by LMA membership (for example, access to documentation) without access to your personal data.
The LMA has a number of legal bases for processing personal data, primarily being the legitimate business interests of the LMA in the provision of membership services. We also process data for which you have given your consent and where the use and processing of data is necessary to perform a contract with you.
We only request information necessary for these purposes and use this in a proportionate manner. For example, we will only contact you with updates that you have elected to receive on registration (or as subsequently updated).
How to manage your email alerts and newsletter subscriptions
We may ask whether you wish to receive newsletters or email alerts from us and this will be presented to you as an option on the appropriate application form. We will not send you email alerts if you ask us not to.
Where you subscribe to newsletters or alerts, our legal basis for processing your personal data in connection with the provision of such newsletters and alerts is consent. If you have agreed to receive email alerts but you later change your mind and no longer wish to receive these emails, you can change your preferences at any time by amending your 'Personal Profile' on the website. Please note that you may also unsubscribe from LMA email alerts by clicking the 'unsubscribe' link at the bottom of any email alert sent to you by the LMA. You can also contact us directly at lma@lma.eu.com and request to be removed from our distribution lists.
Disclosure of personal data
Service providers
Your personal data may be disclosed to certain third party service providers (the " Service Providers") in order to allow us to deliver our membership services to you and to manage and maintain our IT systems and keep them secure. These Service Providers currently include:
Eudonet UK (who provide our membership database)
SmartImpact (who are our CRM/database provider)
Adestra (who provide our membership and subscription marketing email software)
Rackspace (who provide our servers for the website and membership database)
WorkCast (our webinar and virtual event provider; note that individuals provide this data directly to WorkCast when registering for LMA webinars and virtual events)
Kineo (our e-learning provider; note that individuals provide this data directly to Kineo when registering for the e-learning course)
Clifford Chance (who provide office and IT facilities to the LMA)
Cvent (who are our events management and services provider and who provide registration, on-site check-in and attendance management services and our events apps (which may include the ability for delegates at events to network)).
ServonDesign (our web design agency; information may be shared for the purpose of providing technical assistance to us – including but not limited to resolving technical issues with access to the LMA's website or other technical platforms that we may use from time to time, the set-up of the virtual events platforms and our use of social media platforms as a marketing tool)
YUDU (who provide ebook publishing services)
Design House Consultants Limited (who provide strategic brand and design agency services to the LMA)
Nanorisk (who provide cybersecurity consultancy services)
Wavenet (who provide cybersecurity, communications and technology managed services)
Google Analytics (who provide data-backed insights)
Microsoft (who provide software products)
ICA Consultancy (who provide cybersecurity and data protection services)
Foleon (who provide us with a content creation platform)
Landbot (who provide chatbot services including feedback forms for use at LMA events)
Miscellaneous venue providers (on whose property we may host events, for example hotels)
Please note that the above list is not exhaustive and we do our best to update this policy from time to time to capture additional Service Providers and/or change in scope of the services that they provide.
Your personal data may also be disclosed to LMA.Automate Limited, a company incorporated in England & Wales, (registered no. 12977361), whose registered office is at 13th Floor One Angel Court, London, United Kingdom, EC2R 7HJ, a wholly owned subsidiary of the LMA, in order to allow it to deliver document automation services to our members. Please click here to see a copy of the LMA.Automate privacy notice for more information about how they process your personal data.
In addition to the above named service providers, we may from time to time share your personal data with professional advisers, including our auditors (details for which can be found in our accounts) and external legal advisers if and when necessary to enable us to take advice on our rights and obligations and operate our business in compliance with the law. These third parties are subject to professional duties of confidentiality. They also operate their own privacy notices, which are available from their respective websites.
Your employer
Please note that personal data of individuals working at a particular LMA member organisation may also be disclosed to that organisation's nominated representative and any of its senior individuals represented on an LMA working party. This is to enable such nominated representative or appropriate senior individual to ascertain who in their organisation is an individual LMA member, which of them is on an LMA working party and which LMA events they have attended. Save as otherwise described in this policy, we do not share such data beyond an individual's organisation.
Sponsors, exhibitors. speakers and other delegates at events
Contact details of delegates are not shared with speakers, sponsors, exhibitors or other delegates, save as outlined in the following paragraphs.
If you register for one of our virtual or in-person conferences or events:
- we may disclose delegate lists (which contain job titles and institutions) to speakers, sponsors and/or exhibitors at that event in order to allow the speakers to ensure their sessions are appropriately tailored and to enable sponsors / exhibitors to know who is attending the event; and
- your name, email address, job title, organisation, biography, phone number(s), address, country of residence, website details, social media URL and profile picture (to the extent provided by you at registration or via the app) may be displayed to other delegates in order to allow other delegates to contact you, either in our online event platform (for virtual events) or in an event app (for in person events) or by other means. You may opt to remove your name and details from this delegate networking list at any time by changing the settings in your personal profile on the Workcast platform (for virtual conferences held on that platform) or in the Cvent Events app which you may download from a mobile device app store (for in-person events where the registration is managed by Cvent).
If you enrol for one of our virtual conferences or events, and you interact with our sponsors or exhibitors at those events, then we may pass the following information to those sponsors or exhibitors (as applicable): your name, job title, organisation, email address, country of residence, phone number, social media account URL and reports of how you have interacted with the sponsor at the online event. Such interactions may include watching sponsor demonstrations, clicking on links, downloading documents, time spent viewing a virtual stand, and whether you engaged in any online chat activity or other virtual interactions with the sponsor/exhibitors.
If you enrol for one of our in-person conferences or events, and you allow one of our sponsors or exhibitors at those events to scan your name badge using a badge scanner, then we may pass the following information to those sponsors: your name, job title, organisation, email address, country of residence, social media URL and phone number (if applicable).
Our sponsors/exhibitors are independent data controllers in their own right and you should refer to their privacy policies for further information on how they will process your personal data. In respect of virtual conferences, if you do not want reports summarising how you have interacted with our sponsors/exhibitors to be passed to those sponsors/exhibitors by us, then please contact us at lma@lma.eu.com as soon as possible, and by no later than the day after the date of the conference or event itself. In respect of in-person events, if you do not wish for your details to be shared with our sponsors or exhibitors using badge scanners, you may either opt-out at check-in on the day of the event or you may decline to have your badge scanned by sponsors/exhibitors at the event.
If you enrol for one of our conferences or events we may share your details with a third party service provider to ask you for feedback about the event.
Storage and processing of personal data
The information that we collect is stored and processed in the United Kingdom ("UK") and the European Economic Area ("EEA"). The arrangements with our Service Providers may involve transferring information outside of the UK and the EEA. However, in these situations the LMA will ensure that transferred information continues to be protected by appropriate safeguards.
Security of personal data
The LMA has reasonable administrative, technical and physical measures in place to protect your personal data. We also require our Service Providers to have adequate security measures in place for the safeguarding of personal data processed by them and ensure our contracts with them require the Service Provider (and any sub-processors) to abide by their requirements under data protection legislation.
Your rights in respect of your data
Your principal rights under data protection legislation in respect of the personal data that we hold about you are:
- the right to access that personal data;
- the right to rectification of that personal data;
- the right to erasure of your personal data;
- the right to restrict and/or object to the processing of your personal data;
- the right to portability (i.e. transfer) of your personal data; and
- the right to withdraw consent to processing of your personal data.
We provide you with tools to access and control your personal data (namely the 'Personal Profile' section of the website). Alternatively, you can contact the LMA at any time (at lma@lma.eu.com) to access or amend your data.
Please note that if you have any concerns about the handling of your personal data, you have the right to complain to a supervisory authority (namely the UK ICO).
Updating your personal data
We want to make sure that the personal data we hold about you is accurate and up to date. You may ask us to correct or remove any information that you think is no longer up to date. You can update, correct, or delete your personal data at any time by accessing your 'Personal Profile' on the website or by contacting the LMA at lma@lma.eu.com.
Third party links and domains
The LMA website may include links to third-party domains (or applications). Please note that if you click these links you may be allowing third parties to collect your personal data. The LMA has no control over these third party domains, and cannot be responsible for their individual privacy statements. You should ensure that you read the privacy notice of every domain you visit.
Data retention
We retain personal data for as long as your LMA account is active and otherwise as long as needed to fulfil the purposes for which it was collected (for example to operate your account), unless we have a legitimate interest in retaining the data for longer periods or are otherwise required to by law. We also keep personal data for as long as necessary for our legitimate business interests, to comply with our legal obligations, resolve disputes and enforce our agreements and legal rights.
