Data Protection Privacy Notice
Last Updated: 19 October 2020
The LMA is committed to protecting and respecting your privacy. This notice describes how the LMA collects and uses personal data and the rights you have in relation to your personal data.
This notice was last updated on the above date and may be amended from time to time, so please do check for any amendments. Any significant changes to this notice will be clearly indicated on the homepage of the website.
The Loan Market Association ("LMA") is registered at 8 th Floor, 20 Farringdon Street, London EC4A 4AB. The LMA acts as a data controller with respect to the personal data provided to us. The LMA is registered with the UK Information Commissioner's Office ("ICO") under the following ICO registration number: Z5349255.
If you have any questions in respect of this notice, or would like to exercise your rights as stated in this notice, please contact us at: firstname.lastname@example.org; or at our postal address: LMA, 10 Upper Bank Street, London E14 5JJ.
What personal data we collect
We collect personal information about individuals who choose to register for our website and services. The personal data we collect consists of an individual's name, work email address, work telephone number and job title. We also collect similar personal data on individuals who register to attend LMA events, speak at LMA events or take part in LMA projects (in addition we may collect profile photos and biographies for delegate booklets).
How we collect personal data
The LMA collects the personal data detailed above in relation to individuals who: (i) register for an individual LMA user account; (ii) subscribe to receive email alerts from the LMA; (iii) register for LMA events; (iv) request or purchase LMA services (e.g. provision of documents to non-member individuals); (v) are referred to us by either our members or non-members (e.g. to speak at, or attend, an LMA event); or (vi) voluntarily provide information to us for other purposes (e.g. by providing business cards to LMA staff or filling in feedback forms for LMA events).
Such data may be provided to us by you filling in the appropriate forms on our website or at our events. You may also provide us with personal information if you contact us by email, telephone, post or otherwise.
How we use personal data
The LMA uses the personal data it holds to: (i) provide membership benefits and services to you; (ii) communicate with you about our services (e.g. alerts on new documents and events); (iii) to process and respond to requests, enquiries or complaints received from you; and (iv) fulfil our legal obligations.
The LMA only uses personal data for legitimate business purposes and in accordance with data protection legislation. In particular, we use the data we collect to deliver services (for example, we need to use your personal information in order to register you for an LMA event). We may not be able to provide you with some of the features and functionality provided by LMA membership (for example, access to documentation) without access to your personal data.
The LMA has a number of legal bases for processing personal data, primarily being the legitimate business interests of the LMA in the provision of membership services. We also process data for which you have given your consent (which you may withdraw at any time through your online account settings or by contacting us at email@example.com) and where the use and processing of data is necessary to perform a contract with you.
We only request information necessary for these purposes and use this in a proportionate manner. For example, we will only contact you with updates that you have elected to receive on registration (or as subsequently updated).
If you enrol for one of our virtual conferences or events, and you interact with our sponsors through online chat facilities at those events, then we may pass your name, email address and phone number to the relevant sponsors. If you do not want your name and contact details to be passed to our sponsors, then please contact us at firstname.lastname@example.org as soon as possible, and by no later than the day after the date of the virtual conference or event itself.
How to manage your email alerts
We may ask whether you wish to receive email alerts from us and this will be presented to you as an option on the appropriate application form. We will not send you email alerts if you ask us not to.
If you have agreed to receive email alerts but you later change your mind and no longer wish to receive these emails, you can change your preferences at any time by amending your 'Personal Profile' on the website. Please note that you may also unsubscribe from LMA email alerts by clicking the 'unsubscribe' link at the bottom of any email alert sent to you by the LMA. You can also contact us directly at email@example.com and request to be removed from our distribution lists.
Disclosure of personal data
Your personal data may be disclosed to certain third party service providers (the " Service Providers") in order to allow us to deliver our membership services to you and to manage and maintain our IT systems and keep them secure. These Service Providers currently include:
- Eudonet UK (who provide our membership database)
- Adestra (who provide our membership and subscription marketing email software)
- Rackspace (who provide our servers for the website and membership database)
- WorkCast (our webinar and virtual event provider; note that individuals provide this data directly to WorkCast when registering for LMA webinars and virtual events)
- Kineo (our e-learning provider; note that individuals provide this data directly to Kineo when registering for the e-learning course)
- Clifford Chance (who provide office and IT facilities to the LMA)
- Cvent (who are our events app provider and who also provide on-site check-in and attendance management services)
- ServonDesign (our web design agency; information may be shared for the purpose of resolving technical issues with access to the LMA's website)
- Kroll (who provide cyber security services)
- Miscellaneous venue providers (on whose property we may host events, for example hotels)
In addition to the above named service providers, we may from time to time share your personal data with professional advisers, including our auditors (details for which can be found in our accounts) and external legal advisers if and when necessary to enable us to take advice on our rights and obligations and operate our business in compliance with the law. These third parties are subject to professional duties of confidentiality. They also operate their own privacy notices, which are available from their respective websites.
Please note that personal data of individuals working at a particular LMA member organisation may also be disclosed to that organisation's nominated representative and any of its senior individuals represented on an LMA working party. This would however be limited to the nominated representative or appropriate senior individual ascertaining who in their organisation is on an LMA working party and has attended LMA events. Such data would not be shared beyond an individual's organisation.
Event delegate lists
In respect of LMA events, we may disclose delegate lists (which contain job titles and institutions) to speakers, sponsors and/or exhibitors at that event in order to allow the speakers to ensure their sessions are appropriately tailored and to enable sponsors / exhibitors to know who is attending the event. Individual names and contact details of delegates are not shared with speakers, sponsors or exhibitors, save that, in relation to sponsors of virtual events only, please see "How we use personal data" above.
Storage and processing of personal data
The information that we collect is stored and processed in the United Kingdom (" UK") and the European Economic Area (" EEA"). The arrangements with our Service Providers may involve transferring information outside of the UK and the EEA. However, in these situations the LMA will ensure that transferred information continues to be protected by appropriate safeguards.
Security of personal data
The LMA has reasonable administrative, technical and physical measures in place to protect your personal data. We also require our Service Providers to have adequate security measures in place for the safeguarding of personal data processed by them and ensure our contracts with them require the Service Provider (and any sub-processors) to abide by their requirements under data protection legislation.
Your rights in respect of your data
Your principal rights under data protection legislation in respect of the personal data that we hold about you are:
- the right to access that personal data (for which we may charge a small administration fee);
- the right to rectification of that personal data;
- the right to erasure of your personal data;
- the right to restrict and/or object to the processing of your personal data;
- the right to portability (i.e. transfer) of your personal data; and
- the right to withdraw consent to processing of your personal data.
We provide you with tools to access and control your personal data (namely the 'Personal Profile' section of the website). Alternatively, you can contact the LMA at any time (at firstname.lastname@example.org) to access or amend your data.
Please note that if you have any concerns about the handling of your personal data, you have the right to complain to a supervisory authority (namely the UK ICO).
Updating your personal data
We want to make sure that the personal data we hold about you is accurate and up to date. You may ask us to correct or remove any information that you think is no longer up to date. You can update, correct, or delete your personal data at any time by accessing your 'Personal Profile' on the website or by contacting the LMA at email@example.com.
Third party links and domains
The LMA website may include links to third-party domains (or applications). Please note that if you click these links you may be allowing third parties to collect your personal data. The LMA has no control over these third party domains, and cannot be responsible for their individual privacy statements. You should ensure that you read the privacy notice of every domain you visit.
We retain personal data for as long as your LMA account is active and otherwise as long as needed to fulfil the purposes for which it was collected (for example to operate your account), unless we have a legitimate interest in retaining the data for longer periods or are otherwise required to by law. We also keep personal data for as long as necessary for our legitimate business interests, to comply with our legal obligations, resolve disputes and enforce our agreements and legal rights.